22 U.S.C. § 10308 — Cyber protection support for personnel

Page 2332 TITLE 22—FOREIGN RELATIONS AND INTERCOURSE § 10308 this title. For complete classification of this Act to the Code, see Short Title note set out under section 2151 of this title and Tables. Statutory Notes and Related Subsidiaries DEFINITIONS For definitions of ‘‘Secretary’’ and ‘‘appropriate con- gressional committees’’ as used in this section, see sec- tion 6002 of Pub. L. 118–31, set out as a note under sec- tion 2651 of this title. § 10308. Cyber protection support for personnel of the Department of State in positions high- ly vulnerable to cyber attack (a) Definitions In this section: (1) At-risk personnel The term ‘‘at-risk personnel’’ means per- sonnel of the Department— (A) whom the Secretary determines to be highly vulnerable to cyber attacks and hos- tile information collection activities be- cause of their positions in the Department; and (B) whose personal technology devices or personal accounts are highly vulnerable to cyber attacks and hostile information col- lection activities. (2) Personal accounts The term ‘‘personal accounts’’ means ac- counts for online and telecommunications services, including telephone, residential internet access, email, text and multimedia messaging, cloud computing, social media, health care, and financial services, used by De- partment personnel outside of the scope of their employment with the Department. (3) Personal technology devices The term ‘‘personal technology devices’’ means technology devices used by personnel of the Department outside of the scope of their employment with the Department, including networks to which such devices connect. (b) Requirement to provide cyber protection sup- port The Secretary, in consultation with the Sec- retary of Homeland Security and the Director of National Intelligence, as appropriate— (1) shall offer cyber protection support for the personal technology devices and personal accounts of at-risk personnel; and (2) may provide the support described in paragraph (1) to any Department personnel who request such support. (c) Nature of cyber protection support Subject to the availability of resources, the cyber protection support provided to personnel pursuant to subsection (b) may include training, advice, assistance, and other services relating to protection against cyber attacks and hostile in- formation collection activities. (d) Privacy protections for personal devices The Department is prohibited pursuant to this section from accessing or retrieving any infor- mation from any personal technology device or personal account of Department employees un- less— (1) access or information retrieval is nec- essary for carrying out the cyber protection support specified in this section; and (2) the Department has received explicit con- sent from the employee to access a personal technology device or personal account prior to each time such device or account is accessed. (e) Rule of construction Nothing in this section may be construed— (1) to encourage Department personnel to use personal technology devices for official business; or (2) to authorize cyber protection support for senior Department personnel using personal devices, networks, and personal accounts in an official capacity. (f) Report (1) In general Not later than 180 days after December 22, 2023, the Secretary shall submit to the appro- priate committees of Congress a report regard- ing the provision of cyber protection support pursuant to subsection (b), which shall in- clude— (A) a description of the methodology used to make the determination under subsection (a)(1); and (B) guidance for the use of cyber protec- tion support and tracking of support re- quests for personnel receiving cyber protec- tion support pursuant to subsection (b). (2) Appropriate committees of Congress de- fined In this subsection, the term ‘‘appropriate committees of Congress’’ means— (A) the appropriate congressional commit- tees; (B) the Select Committee on Intelligence and the Committee on Homeland Security and Governmental Affairs of the Senate; and (C) the Permanent Select Committee on Intelligence and the Committee on Over- sight and Accountability of the House of Representatives. (Pub. L. 118–31, div. F, title LXIII, § 6308, Dec. 22, 2023, 137 Stat. 993.) Statutory Notes and Related Subsidiaries MEASURES TO PROTECT DEPARTMENT DEVICES FROM THE PROLIFERATION AND USE OF FOREIGN COMMER- CIAL SPYWARE Pub. L. 118–159, div. G, title LXXIII, § 7302, Dec. 23, 2024, 138 Stat. 2541, provided that: ‘‘(a) DEFINITIONS.—In this section: ‘‘(1) APPROPRIATE COMMITTEES OF CONGRESS.—The term ‘appropriate committees of Congress’ means— ‘‘(A) the Committee on Foreign Relations, the Se- lect Committee on Intelligence, the Committee on Homeland Security and Governmental Affairs, and the Committee on Armed Services of the Senate; and ‘‘(B) the Committee on Foreign Affairs, the Per- manent Select Committee on Intelligence, the Committee on Homeland Security, and the Com- mittee on Armed Services of the House of Rep- resentatives. ‘‘(2) COVERED DEVICE.—The term ‘covered device’ means any electronic mobile device, including smartphones, tablet computing devices, or laptop Page 2333 TITLE 22—FOREIGN RELATIONS AND INTERCOURSE § 10401 computing device, that is issued by the Department for official use. ‘‘(3) FOREIGN COMMERCIAL SPYWARE; SPYWARE.—The terms ‘foreign commercial spyware’ and ‘spyware’ have the meanings given those terms in section 1102A of the National Security Act of 1947 (50 U.S.C. 3232a). ‘‘(b) PROTECTION OF COVERED DEVICES.— ‘‘(1) REQUIREMENT.—Not later than 120 days after the date of the enactment of this Act [Dec. 23, 2024], the Secretary [of State] shall, in consultation with the relevant agencies— ‘‘(A) issue standards, guidance, best practices, and policies for Department [of State] and USAID [United States Agency for International Develop- ment] personnel to protect covered devices from being compromised by foreign commercial spyware; ‘‘(B) survey the processes used by the Department and USAID to identify and catalog instances where a covered device was compromised by foreign com- mercial spyware over the prior 2 years and it is rea- sonably expected to have resulted in an unauthor- ized disclosure of sensitive information; and ‘‘(C) submit to the appropriate committees of Congress a report on the measures in place to iden- tify and catalog instances of such compromises for covered devices by foreign commercial spyware, which may be submitted in classified form. ‘‘(2) NOTIFICATIONS.—Not later than 60 days after the date on which the Department becomes aware that a covered device was seriously compromised by foreign commercial spyware, the Secretary, in co- ordination with relevant agencies, shall notify the appropriate committees of Congress of the facts con- cerning such targeting or compromise, including— ‘‘(A) the location of the personnel whose covered device was compromised; ‘‘(B) the number of covered devices compromised; ‘‘(C) an assessment by the Secretary of the dam- age to the national security of the United States resulting from any loss of data or sensitive infor- mation; and ‘‘(D) an assessment by the Secretary of any for- eign government or foreign organization or entity, and, to the extent possible, the foreign individuals, who directed and benefitted from any information acquired from the compromise. ‘‘(3) ANNUAL REPORT.—Not later than one year after the date of the enactment of this Act, and annually thereafter for 5 years, the Secretary, in coordination with relevant agencies, shall submit to the appro- priate committees of Congress, the Committee on the Judiciary of the Senate, and the Committee on the Judiciary of the House of Representatives a report re- garding any covered device that was compromised by foreign commercial spyware, including the informa- tion described in subparagraphs (A) through (D) of paragraph (2).’’ DEFINITIONS For definitions of ‘‘Department’’, ‘‘Secretary’’, and ‘‘appropriate congressional committees’’ as used in this section, see section 6002 of Pub. L. 118–31, set out as a note under section 2651 of this title. CHAPTER 111—AUSTRALIA, UNITED KING- DOM, AND UNITED STATES (AUKUS) SECU- RITY PARTNERSHIP Sec. 10401. Definitions. SUBCHAPTER I—ADMINISTRATIVE PROVISIONS 10411. AUKUS partnership oversight and account- ability framework. 10412. Designation of senior official for Department of Defense activities relating to, and imple- mentation plan for, the AUKUS partner- ship. Sec. 10413. Reporting related to the AUKUS partnership. SUBCHAPTER II—STREAMLINING AND PRO- TECTING TRANSFERS OF UNITED STATES MILI- TARY TECHNOLOGY FROM COMPROMISE 10421. Priority for Australia and the United King- dom in foreign military sales and direct commercial sales. 10422. Identification and pre-clearance of platforms, technologies, and equipment for sale to Australia and the United Kingdom through foreign military sales and direct commer- cial sales. 10423. Expedited review of export licenses for ex- ports of advanced technologies to Australia, the United Kingdom, and Canada. SUBCHAPTER III—AUKUS SUBMARINE TRANSFER AUTHORIZATION ACT 10431. Authorization of sales of Virginia Class sub- marines to Australia. 10432. Acceptance of contributions in support of Australia, United Kingdom, and United States submarine security activities. 10433. Appropriate congressional committees and leadership defined. § 10401. Definitions In this chapter: (1) Appropriate congressional committees Except as otherwise provided, the term ‘‘ap- propriate congressional committees’’ means— (A) the Committee on Foreign Relations and the Committee on Armed Services of the Senate; and (B) the Committee on Foreign Affairs and the Committee on Armed Services of the House of Representatives. (2) AUKUS partnership (A) In general The term ‘‘AUKUS partnership’’ means the enhanced trilateral security partnership be- tween Australia, the United Kingdom, and the United States announced in September 2021. (B) Pillars The AUKUS partnership includes the fol- lowing two pillars: (i) Pillar One is focused on developing a pathway for Australia to acquire conven- tionally armed, nuclear-powered sub- marines. (ii) Pillar Two is focused on enhancing trilateral collaboration on advanced de- fense capabilities, including hypersonic and counter hypersonic capabilities, quan- tum technologies, undersea technologies, and artificial intelligence. (3) International Traffic in Arms Regulations The term ‘‘International Traffic in Arms Regulations’’ means subchapter M of chapter I of title 22, Code of Federal Regulations (or successor regulations). (Pub. L. 118–31, div. A, title XIII, § 1321, Dec. 22, 2023, 137 Stat. 501.) Statutory Notes and Related Subsidiaries SHORT TITLE Pub. L. 118–31, div. A, title XIII, § 1351, Dec. 22, 2023, 137 Stat. 514, provided that: ‘‘This part [part 3