6 U.S.C. § 1503 — Authorizations for preventing, detecting,

Page 502 TITLE 6—DOMESTIC SECURITY § 1503 (c) Submittal to Congress Not later than 60 days after December 18, 2015, the Director of National Intelligence, in con- sultation with the heads of the appropriate Fed- eral entities, shall submit to Congress the proce- dures required by subsection (a). (Pub. L. 114–113, div. N, title I, § 103, Dec. 18, 2015, 129 Stat. 2939.) § 1503. Authorizations for preventing, detecting, analyzing, and mitigating cybersecurity threats (a) Authorization for monitoring (1) In general Notwithstanding any other provision of law, a private entity may, for cybersecurity pur- poses, monitor— (A) an information system of such private entity; (B) an information system of another non- Federal entity, upon the authorization and written consent of such other entity; (C) an information system of a Federal en- tity, upon the authorization and written consent of an authorized representative of the Federal entity; and (D) information that is stored on, proc- essed by, or transiting an information sys- tem monitored by the private entity under this paragraph. (2) Construction Nothing in this subsection shall be con- strued— (A) to authorize the monitoring of an in- formation system, or the use of any informa- tion obtained through such monitoring, other than as provided in this subchapter; or (B) to limit otherwise lawful activity. (b) Authorization for operation of defensive measures (1) In general Notwithstanding any other provision of law, a private entity may, for cybersecurity pur- poses, operate a defensive measure that is ap- plied to— (A) an information system of such private entity in order to protect the rights or prop- erty of the private entity; (B) an information system of another non- Federal entity upon written consent of such entity for operation of such defensive meas- ure to protect the rights or property of such entity; and (C) an information system of a Federal en- tity upon written consent of an authorized representative of such Federal entity for op- eration of such defensive measure to protect the rights or property of the Federal Govern- ment. (2) Construction Nothing in this subsection shall be con- strued— (A) to authorize the use of a defensive measure other than as provided in this sub- section; or (B) to limit otherwise lawful activity. (c) Authorization for sharing or receiving cyber threat indicators or defensive measures (1) In general Except as provided in paragraph (2) and not- withstanding any other provision of law, a non-Federal entity may, for a cybersecurity purpose and consistent with the protection of classified information, share with, or receive from, any other non-Federal entity or the Fed- eral Government a cyber threat indicator or defensive measure. (2) Lawful restriction A non-Federal entity receiving a cyber threat indicator or defensive measure from an- other non-Federal entity or a Federal entity shall comply with otherwise lawful restric- tions placed on the sharing or use of such cyber threat indicator or defensive measure by the sharing non-Federal entity or Federal en- tity. (3) Construction Nothing in this subsection shall be con- strued— (A) to authorize the sharing or receiving of a cyber threat indicator or defensive meas- ure other than as provided in this sub- section; or (B) to limit otherwise lawful activity. (d) Protection and use of information (1) Security of information A non-Federal entity monitoring an infor- mation system, operating a defensive measure, or providing or receiving a cyber threat indi- cator or defensive measure under this section shall implement and utilize a security control to protect against unauthorized access to or acquisition of such cyber threat indicator or defensive measure. (2) Removal of certain personal information A non-Federal entity sharing a cyber threat indicator pursuant to this subchapter shall, prior to such sharing— (A) review such cyber threat indicator to assess whether such cyber threat indicator contains any information not directly re- lated to a cybersecurity threat that the non- Federal entity knows at the time of sharing to be personal information of a specific indi- vidual or information that identifies a spe- cific individual and remove such informa- tion; or (B) implement and utilize a technical ca- pability configured to remove any informa- tion not directly related to a cybersecurity threat that the non-Federal entity knows at the time of sharing to be personal informa- tion of a specific individual or information that identifies a specific individual. (3) Use of cyber threat indicators and defen- sive measures by non-Federal entities (A) In general Consistent with this subchapter, a cyber threat indicator or defensive measure shared or received under this section may, for cybersecurity purposes— (i) be used by a non-Federal entity to monitor or operate a defensive measure that is applied to— Page 503 TITLE 6—DOMESTIC SECURITY § 1504 (I) an information system of the non- Federal entity; or (II) an information system of another non-Federal entity or a Federal entity upon the written consent of that other non-Federal entity or that Federal enti- ty; and (ii) be otherwise used, retained, and fur- ther shared by a non-Federal entity sub- ject to— (I) an otherwise lawful restriction placed by the sharing non-Federal entity or Federal entity on such cyber threat indicator or defensive measure; or (II) an otherwise applicable provision of law. (B) Construction Nothing in this paragraph shall be con- strued to authorize the use of a cyber threat indicator or defensive measure other than as provided in this section. (4) Use of cyber threat indicators by State, tribal, or local government (A) Law enforcement use A State, tribal, or local government that receives a cyber threat indicator or defen- sive measure under this subchapter may use such cyber threat indicator or defensive measure for the purposes described in sec- tion 1504(d)(5)(A) of this title. (B) Exemption from disclosure A cyber threat indicator or defensive measure shared by or with a State, tribal, or local government, including a component of a State, tribal, or local government that is a private entity, under this section shall be— (i) deemed voluntarily shared informa- tion; and (ii) exempt from disclosure under any provision of State, tribal, or local freedom of information law, open government law, open meetings law, open records law, sun- shine law, or similar law requiring disclo- sure of information or records. (C) State, tribal, and local regulatory author- ity (i) In general Except as provided in clause (ii), a cyber threat indicator or defensive measure shared with a State, tribal, or local gov- ernment under this subchapter shall not be used by any State, tribal, or local govern- ment to regulate, including an enforce- ment action, the lawful activity of any non-Federal entity or any activity taken by a non-Federal entity pursuant to man- datory standards, including an activity re- lating to monitoring, operating a defensive measure, or sharing of a cyber threat indi- cator. (ii) Regulatory authority specifically relat- ing to prevention or mitigation of cybersecurity threats A cyber threat indicator or defensive measure shared as described in clause (i) may, consistent with a State, tribal, or local government regulatory authority specifically relating to the prevention or mitigation of cybersecurity threats to in- formation systems, inform the develop- ment or implementation of a regulation relating to such information systems. (e) Antitrust exemption (1) In general Except as provided in section 1507(e) of this title, it shall not be considered a violation of any provision of antitrust laws for 2 or more private entities to exchange or provide a cyber threat indicator or defensive measure, or as- sistance relating to the prevention, investiga- tion, or mitigation of a cybersecurity threat, for cybersecurity purposes under this sub- chapter. (2) Applicability Paragraph (1) shall apply only to informa- tion that is exchanged or assistance provided in order to assist with— (A) facilitating the prevention, investiga- tion, or mitigation of a cybersecurity threat to an information system or information that is stored on, processed by, or transiting an information system; or (B) communicating or disclosing a cyber threat indicator to help prevent, investigate, or mitigate the effect of a cybersecurity threat to an information system or informa- tion that is stored on, processed by, or transiting an information system. (f) No right or benefit The sharing of a cyber threat indicator or de- fensive measure with a non-Federal entity under this subchapter shall not create a right or ben- efit to similar information by such non-Federal entity or any other non-Federal entity. (Pub. L. 114–113, div. N, title I, § 104, Dec. 18, 2015, 129 Stat. 2940.) § 1504. Sharing of cyber threat indicators and de- fensive measures with the Federal Govern- ment (a) Requirement for policies and procedures (1) Interim policies and procedures Not later than 60 days after December 18, 2015, the Attorney General and the Secretary of Homeland Security shall, in consultation with the heads of the appropriate Federal enti- ties, jointly develop and submit to Congress interim policies and procedures relating to the receipt of cyber threat indicators and defen- sive measures by the Federal Government. (2) Final policies and procedures Not later than 180 days after December 18, 2015, the Attorney General and the Secretary of Homeland Security shall, in consultation with the heads of the appropriate Federal enti- ties, jointly issue and make publicly available final policies and procedures relating to the receipt of cyber threat indicators and defen- sive measures by the Federal Government. (3) Requirements concerning policies and pro- cedures Consistent with the guidelines required by subsection (b), the policies and procedures de- veloped or issued under this subsection shall—