6 U.S.C. § 681e — Information shared with or provided to

Page 392 TITLE 6—DOMESTIC SECURITY § 681e website of the Agency, which shall include, at a minimum, the number of times the Director— (1) issued an initial request for information pursuant to subsection (b); or (2) issued a subpoena pursuant to subsection (c). (i) Anonymization of reports The Director shall ensure any victim informa- tion contained in a report required to be pub- lished under subsection (h) be anonymized be- fore the report is published. (Pub. L. 107–296, title XXII, § 2244, as added Pub. L. 117–103, div. Y, § 103(a)(2), Mar. 15, 2022, 136 Stat. 1049; amended Pub. L. 117–263, div. G, title LXXI, § 7143(e)(2), Dec. 23, 2022, 136 Stat. 3664.) Editorial Notes AMENDMENTS 2022—Subsec. (b)(2). Pub. L. 117–263 inserted ‘‘includ- ing that section 681e of this title shall apply to such in- formation in the same manner and to the same extent to information submitted in response to requests under paragraph (1) as it applies to information submitted under section 681b of this title’’ after ‘‘section 681b of this title’’. § 681e. Information shared with or provided to the Federal Government (a) Disclosure, retention, and use (1) Authorized activities Information provided to the Agency pursu- ant to section 681b or 681c of this title may be disclosed to, retained by, and used by, con- sistent with otherwise applicable provisions of Federal law, any Federal agency or depart- ment, component, officer, employee, or agent of the Federal Government solely for— (A) a cybersecurity purpose; (B) the purpose of identifying— (i) a cyber threat, including the source of the cyber threat; or (ii) a security vulnerability; (C) the purpose of responding to, or other- wise preventing or mitigating, a specific threat of death, a specific threat of serious bodily harm, or a specific threat of serious economic harm, including a terrorist act or use of a weapon of mass destruction; (D) the purpose of responding to, inves- tigating, prosecuting, or otherwise pre- venting or mitigating, a serious threat to a minor, including sexual exploitation and threats to physical safety; or (E) the purpose of preventing, inves- tigating, disrupting, or prosecuting an of- fense arising out of a cyber incident reported pursuant to section 681b or 681c of this title or any of the offenses listed in section 1504(d)(5)(A)(v) of this title. (2) Agency actions after receipt (A) Rapid, confidential sharing of cyber threat indicators Upon receiving a covered cyber incident or ransom payment report submitted pursuant to this section, the Agency shall imme- diately review the report to determine whether the cyber incident that is the sub- ject of the report is connected to an ongoing cyber threat or security vulnerability and where applicable, use such report to iden- tify, develop, and rapidly disseminate to ap- propriate stakeholders actionable, anonymized cyber threat indicators and de- fensive measures. (B) Principles for sharing security vulnerabilities With respect to information in a covered cyber incident or ransom payment report re- garding a security vulnerability referred to in paragraph (1)(B)(ii), the Director shall de- velop principles that govern the timing and manner in which information relating to se- curity vulnerabilities may be shared, con- sistent with common industry best practices and United States and international stand- ards. (3) Privacy and civil liberties Information contained in covered cyber inci- dent and ransom payment reports submitted to the Agency pursuant to section 681b of this title shall be retained, used, and disseminated, where permissible and appropriate, by the Federal Government in accordance with proc- esses to be developed for the protection of per- sonal information consistent with processes adopted pursuant to section 1504 of this title and in a manner that protects personal infor- mation from unauthorized use or unauthorized disclosure. (4) Digital security The Agency shall ensure that reports sub- mitted to the Agency pursuant to section 681b of this title, and any information contained in those reports, are collected, stored, and pro- tected at a minimum in accordance with the requirements for moderate impact Federal in- formation systems, as described in Federal In- formation Processing Standards Publication 199, or any successor document. (5) Prohibition on use of information in regu- latory actions (A) In general A Federal, State, local, or Tribal govern- ment shall not use information about a cov- ered cyber incident or ransom payment ob- tained solely through reporting directly to the Agency in accordance with this part to regulate, including through an enforcement action, the activities of the covered entity or entity that made a ransom payment, un- less the government entity expressly allows entities to submit reports to the Agency to meet regulatory reporting obligations of the entity. (B) Clarification A report submitted to the Agency pursu- ant to section 681b or 681c of this title may, consistent with Federal or State regulatory authority specifically relating to the preven- tion and mitigation of cybersecurity threats to information systems, inform the develop- ment or implementation of regulations re- lating to such systems. Page 393 TITLE 6—DOMESTIC SECURITY § 681g (b) Protections for reporting entities and infor- mation Reports describing covered cyber incidents or ransom payments submitted to the Agency by entities in accordance with section 681b of this title, as well as voluntarily-submitted cyber in- cident reports submitted to the Agency pursu- ant to section 681c of this title, shall— (1) be considered the commercial, financial, and proprietary information of the covered en- tity when so designated by the covered entity; (2) be exempt from disclosure under section 552(b)(3) of title 5 (commonly known as the ‘‘Freedom of Information Act’’), as well as any provision of State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of informa- tion or records; (3) be considered not to constitute a waiver of any applicable privilege or protection pro- vided by law, including trade secret protec- tion; and (4) not be subject to a rule of any Federal agency or department or any judicial doctrine regarding ex parte communications with a de- cision-making official. (c) Liability protections (1) In general No cause of action shall lie or be maintained in any court by any person or entity and any such action shall be promptly dismissed for the submission of a report pursuant to section 681b(a) of this title that is submitted in con- formance with this part and the rule promul- gated under section 681b(b) of this title, except that this subsection shall not apply with re- gard to an action by the Federal Government pursuant to section 681d(c)(2) of this title. (2) Scope The liability protections provided in this subsection shall only apply to or affect litiga- tion that is solely based on the submission of a covered cyber incident report or ransom pay- ment report to the Agency. (3) Restrictions Notwithstanding paragraph (2), no report submitted to the Agency pursuant to this part or any communication, document, material, or other record, created for the sole purpose of preparing, drafting, or submitting such report, may be received in evidence, subject to dis- covery, or otherwise used in any trial, hearing, or other proceeding in or before any court, regulatory body, or other authority of the United States, a State, or a political subdivi- sion thereof, provided that nothing in this part shall create a defense to discovery or oth- erwise affect the discovery of any communica- tion, document, material, or other record not created for the sole purpose of preparing, drafting, or submitting such report. (d) Sharing with non-Federal entities The Agency shall anonymize the victim who reported the information when making informa- tion provided in reports received under section 681b of this title available to critical infrastruc- ture owners and operators and the general pub- lic. (e) Stored Communications Act Nothing in this part shall be construed to per- mit or require disclosure by a provider of a re- mote computing service or a provider of an elec- tronic communication service to the public of information not otherwise permitted or required to be disclosed under chapter 121 of title 18 (commonly known as the ‘‘Stored Communica- tions Act’’). (Pub. L. 107–296, title XXII, § 2245, as added Pub. L. 117–103, div. Y, § 103(a)(2), Mar. 15, 2022, 136 Stat. 1051.) § 681f. Cyber Incident Reporting Council (a) Responsibility of the Secretary The Secretary shall lead an intergovernmental Cyber Incident Reporting Council, in consulta- tion with the Director of the Office of Manage- ment and Budget, the Attorney General, the Na- tional Cyber Director, Sector Risk Management Agencies, and other appropriate Federal agen- cies, to coordinate, deconflict, and harmonize Federal incident reporting requirements, includ- ing those issued through regulations. (b) Rule of construction Nothing in subsection (a) shall be construed to provide any additional regulatory authority to any Federal entity. (Pub. L. 107–296, title XXII, § 2246, as added Pub. L. 117–103, div. Y, § 103(a)(2), Mar. 15, 2022, 136 Stat. 1054.) § 681g. Federal sharing of incident reports (a) Cyber incident reporting sharing (1) In general Notwithstanding any other provision of law or regulation, any Federal agency, including any independent establishment (as defined in section 104 of title 5), that receives a report from an entity of a cyber incident, including a ransomware attack, shall provide the report to the Agency as soon as possible, but not later than 24 hours after receiving the report, unless a shorter period is required by an agree- ment made between the Department of Home- land Security (including the Cybersecurity and Infrastructure Security Agency) and the recipient Federal agency. The Director shall share and coordinate each report pursuant to section 681a(b) of this title, as added by sec- tion 103 of this division. (2) Rule of construction The requirements described in paragraph (1) and section 681e(d) of this title, as added by section 103 of this division, may not be con- strued to be a violation of any provision of law or policy that would otherwise prohibit disclo- sure or provision of information within the ex- ecutive branch. (3) Protection of information The Director shall comply with any obliga- tions of the recipient Federal agency described in paragraph (1) to protect information, in- cluding with respect to privacy, confiden- tiality, or information security, if those obli- gations would impose greater protection re-