10 U.S.C. § 393 — Reporting on penetrations of networks and

Page 423 TITLE 10—ARMED FORCES § 393 visor’s activities and ability to perform the functions specified in paragraph (2). (Added and amended Pub. L. 117–263, div. A, title XV, § 1501(b), Dec. 23, 2022, 136 Stat. 2877; Pub. L. 118–31, div. A, title XVIII, § 1801(a)(5), Dec. 22, 2023, 137 Stat. 683; Pub. L. 118–159, div. A, title XVII, § 1701(a)(8), Dec. 23, 2024, 138 Stat. 2203.) Editorial Notes REFERENCES IN TEXT Section 911 of the National Defense Authorization Act for Fiscal Year 2017, referred to in subsec. (a)(3), is section 911 of Pub. L. 114–328, which is set out as a note under section 111 of this title. Section 932(c)(3) of the National Defense Authoriza- tion Act for Fiscal Year 2014, referred to in subsec. (b)(3)(B)(ix), is section 932(c)(3) of Pub. L. 113–66, which was formerly set out as a note under section 2224 of this title and was transferred to this section and redesig- nated as subsec. (a)(3) by Pub. L. 117–263, § 1501(b)(2)(A), (B), Dec. 23, 2022, 136 Stat. 2878. The date of the enactment of this Act, referred to in subsec. (c)(1)(A), means the date of enactment of Pub. L. 116–92, which had originally enacted the text of sub- sec. (c) of this section and was approved Dec. 20, 2019. See Codification note below. CODIFICATION The text of section 932(c) of Pub. L. 113–66, formerly set out as a note under section 2224 of this title, which was transferred to this section, redesignated as subsec. (a), and amended by Pub. L. 117–263, § 1501(b)(2), was based on Pub. L. 113–66, div. A, title IX, § 932, Dec. 26, 2013, 127 Stat. 829, as amended by Pub. L. 116–283, div. A, title XVII, § 1713(a), Jan. 1, 2021, 134 Stat. 4089; Pub. L. 117–81, div. A, title XV, § 1503(a), Dec. 27, 2021, 135 Stat. 2021; Pub. L. 117–263, div. A, title X, § 1081(d), title XV, § 1501(a), Dec. 23, 2022, 136 Stat. 2797, 2877. The text of section 905 of Pub. L. 116–92, formerly set out as a note under section 391 of this title, which was transferred to this section, redesignated as subsec. (b), and amended by Pub. L. 117–263, § 1501(b)(3), was based on Pub. L. 116–92, div. A, title IX, § 905, Dec. 20, 2019, 133 Stat. 1557, as amended by Pub. L. 116–283, div. A, title XVII, § 1713(b), Jan. 1, 2021, 134 Stat. 4090; Pub. L. 117–81, div. A, title XV, § 1503(b), Dec. 27, 2021, 135 Stat. 2021; Pub. L. 117–263, div. A, title X, § 1081(c), Dec. 23, 2022, 136 Stat. 2797. The text of section 1657 of Pub. L. 116–92, formerly set out as a note under section 391 of this title, which was transferred to this section, redesignated as subsec. (c), and amended by Pub. L. 117–263, § 1501(b)(4), was based on Pub. L. 116–92, div. A, title XVI, § 1657, Dec. 20, 2019, 133 Stat. 1767. AMENDMENTS 2024—Subsec. (b)(3)(B)(ix). Pub. L. 118–159 inserted ‘‘section’’ before ‘‘932(c)(3)’’. 2023—Subsec. (b)(2)(B). Pub. L. 118–31, § 1801(a)(5)(A), substituted ‘‘designated’’ for ‘‘designed’’ in introduc- tory provisions. Subsec. (c)(4)(A). Pub. L. 118–31, § 1801(a)(5)(B), sub- stituted ‘‘subparagraph (B)’’ for ‘‘clause (ii)’’. 2022—Subsec. (a). Pub. L. 117–263, § 1501(b)(2)(A), (B), (D), transferred section 932(c) of Pub. L. 113–66 to this section, redesignated it as subsec. (a), and inserted ‘‘to Secretary of Defense’’ after ‘‘Advisor’’ in heading. See Codification note above. Subsec. (a)(1). Pub. L. 117–263, § 1501(b)(2)(C), added par. (1) and struck out former par. (1) which related to designation of a Principal Cyber Advisor by the Sec- retary of Defense. Subsec. (b). Pub. L. 117–263, § 1501(b)(3)(A), transferred section 905 of Pub. L. 116–92 to this section, redesig- nated it as subsec. (b), redesignated each subordinate provision to conform to such redesignation, and re- aligned margins. See Codification note above. Subsec. (b)(1)(B), (C). Pub. L. 117–263, § 1501(b)(3)(B)(i), substituted ‘‘this paragraph’’ for ‘‘this subsection’’. Subsec. (b)(2), (3). Pub. L. 117–263, § 1501(b)(3)(B)(ii), substituted ‘‘paragraph (1)’’ for ‘‘subsection (a)’’ in in- troductory provisions of subpars. (A) and (B). Subsec. (c). Pub. L. 117–263, § 1501(b)(4)(A), transferred section 1657 of Pub. L. 116–92 to this section, redesig- nated it as subsec. (c), redesignated each subordinate provision to conform to such redesignation, and re- aligned margins. See Codification note above. Subsec. (c)(1)(B). Pub. L. 117–263, § 1501(b)(4)(B)(ii), substituted ‘‘subparagraph (A)’’ for ‘‘paragraph (1)’’ in introductory provisions. Subsec. (c)(2), (3). Pub. L. 117–263, § 1501(b)(4)(B)(v), substituted ‘‘paragraph (1)’’ for ‘‘subsection (a)’’ in in- troductory provisions. Subsec. (c)(4)(A). Pub. L. 117–263, § 1501(b)(4)(B)(i), (vi), substituted ‘‘paragraph (2)’’ for ‘‘subsection (b)’’ and ‘‘clause (ii)’’ for ‘‘subparagraph (B)’’. Subsec. (c)(4)(B). Pub. L. 117–263, § 1501(b)(4)(B)(ii), (iv), substituted ‘‘paragraph (1)(A)’’ for ‘‘subsection (a)(1)’’ and ‘‘subparagraph (A)’’ for ‘‘paragraph (1)’’. Subsec. (c)(4)(C). Pub. L. 117–263, § 1501(b)(4)(B)(iii), substituted ‘‘subparagraph (B)’’ for ‘‘paragraph (2)’’. Subsec. (c)(5). Pub. L. 117–263, § 1501(b)(4)(B)(v), (vi), substituted ‘‘paragraph (1)’’ for ‘‘subsection (a)’’ and ‘‘paragraph (2)’’ for ‘‘subsection (b)’’. Subsec. (c)(6). Pub. L. 117–263, § 1501(b)(4)(B)(vii), struck out par. (6) which authorized each of the secre- taries of the military departments to review relevant military department’s current governance model for cybersecurity with respect to current authorities and responsibilities. Subsec. (c)(6)(B). Pub. L. 117–263, § 1501(b)(4)(B)(ii), (v), substituted ‘‘subparagraph (A)’’ for ‘‘paragraph (1)’’ in introductory provisions and ‘‘paragraph (1)’’ for ‘‘sub- section (a)’’ in cl. (i). Subsec. (c)(6)(C). Pub. L. 117–263, § 1501(b)(4)(B)(ii), substituted ‘‘subparagraph (A)’’ for ‘‘paragraph (1)’’. § 393. Reporting on penetrations of networks and information systems of certain contractors (a) PROCEDURES FOR REPORTING PENETRA- TIONS.—The Secretary of Defense shall establish procedures that require each cleared defense contractor to report to a component of the De- partment of Defense designated by the Sec- retary for purposes of such procedures when a network or information system of such con- tractor that meets the criteria established pur- suant to subsection (b) is successfully pene- trated. (b) NETWORKS AND INFORMATION SYSTEMS SUB- JECT TO REPORTING.— (1) CRITERIA.—The Secretary of Defense shall designate a senior official to, in consultation with the officials specified in paragraph (2), es- tablish criteria for covered networks to be subject to the procedures for reporting system penetrations under subsection (a). (2) OFFICIALS.—The officials specified in this subsection are the following: (A) The Under Secretary of Defense for Policy. (B) The Under Secretary of Defense for Ac- quisition and Sustainment. (C) the Under Secretary of Defense for Re- search and Engineering. (D) The Under Secretary of Defense for In- telligence and Security. (E) The Chief Information Officer of the Department of Defense. (F) The Commander of the United States Cyber Command. (c) PROCEDURE REQUIREMENTS.— Page 424 TITLE 10—ARMED FORCES § 393 (1) RAPID REPORTING.—The procedures estab- lished pursuant to subsection (a) shall require each cleared defense contractor to rapidly re- port to a component of the Department of De- fense designated pursuant to subsection (a) of each successful penetration of the network or information systems of such contractor that meet the criteria established pursuant to sub- section (b). Each such report shall include the following: (A) A description of the technique or method used in such penetration. (B) A sample of the malicious software, if discovered and isolated by the contractor, involved in such penetration. (C) A summary of information created by or for the Department in connection with any Department program that has been po- tentially compromised due to such penetra- tion. (2) ACCESS TO EQUIPMENT AND INFORMATION BY DEPARTMENT OF DEFENSE PERSONNEL.—The procedures established pursuant to subsection (a) shall— (A) include mechanisms for Department of Defense personnel to, upon request, obtain access to equipment or information of a cleared defense contractor necessary to con- duct forensic analysis in addition to any analysis conducted by such contractor; (B) provide that a cleared defense con- tractor is only required to provide access to equipment or information as described in subparagraph (A) to determine whether in- formation created by or for the Department in connection with any Department program was successfully exfiltrated from a network or information system of such contractor and, if so, what information was exfiltrated; and (C) provide for the reasonable protection of trade secrets, commercial or financial infor- mation, and information that can be used to identify a specific person. (3) DISSEMINATION OF INFORMATION.—The pro- cedures established pursuant to subsection (a) shall limit the dissemination of information obtained or derived through such procedures to entities— (A) with missions that may be affected by such information; (B) that may be called upon to assist in the diagnosis, detection, or mitigation of cyber incidents; (C) that conduct counterintelligence or law enforcement investigations; or (D) for national security purposes, includ- ing cyber situational awareness and defense purposes. (d) PROTECTION FROM LIABILITY OF CLEARED DEFENSE CONTRACTORS.—(1) No cause of action shall lie or be maintained in any court against any cleared defense contractor, and such action shall be promptly dismissed, for compliance with this section that is conducted in accord- ance with the procedures established pursuant to subsection (a). (2)(A) Nothing in this section shall be con- strued— (i) to require dismissal of a cause of action against a cleared defense contractor that has engaged in willful misconduct in the course of complying with the procedures established pursuant to subsection (a); or (ii) to undermine or limit the availability of otherwise applicable common law or statutory defenses. (B) In any action claiming that paragraph (1) does not apply due to willful misconduct de- scribed in subparagraph (A), the plaintiff shall have the burden of proving by clear and con- vincing evidence the willful misconduct by each cleared defense contractor subject to such claim and that such willful misconduct proximately caused injury to the plaintiff. (C) In this subsection, the term ‘‘willful mis- conduct’’ means an act or omission that is taken— (i) intentionally to achieve a wrongful pur- pose; (ii) knowingly without legal or factual jus- tification; and (iii) in disregard of a known or obvious risk that is so great as to make it highly probable that the harm will outweigh the benefit. (e) DEFINITIONS.—In this section: (1) CLEARED DEFENSE CONTRACTOR.—The term ‘‘cleared defense contractor’’ means a private entity granted clearance by the Department of Defense to access, receive, or store classified information for the purpose of bidding for a contract or conducting activities in support of any program of the Department of Defense. (2) COVERED NETWORK.—The term ‘‘covered network’’ means a network or information system of a cleared defense contractor that contains or processes information created by or for the Department of Defense with respect to which such contractor is required to apply enhanced protection. (Added and amended Pub. L. 114–92, div. A, title XVI, § 1641(a), Nov. 25, 2015, 129 Stat. 1114; Pub. L. 116–92, div. A, title IX, § 902(8), title XVI, § 1621(e)(1)(A)(vi), Dec. 20, 2019, 133 Stat. 1543, 1733; Pub. L. 116–283, div. A, title X, § 1081(a)(15), Jan. 1, 2021, 134 Stat. 3871; Pub. L. 117–81, div. A, title X, § 1081(a)(9), Dec. 27, 2021, 135 Stat. 1920.) Editorial Notes CODIFICATION Section, as added and amended by Pub. L. 114–92, is based on Pub. L. 112–239, div. A, title IX, § 941, Jan. 2, 2013, 126 Stat. 1889, which was formerly set out as a note under section 2224 of this title before being trans- ferred to this chapter and renumbered as this section. AMENDMENTS 2021—Subsec. (b)(2)(D). Pub. L. 117–81 inserted period at end. Pub. L. 116–283 substituted ‘‘of Defense for Intel- ligence and Security’’ for ‘‘of Defense for Intelligence.’’ 2019—Subsec. (b)(2)(B). Pub. L. 116–92, § 902(8)(A), sub- stituted ‘‘Under Secretary of Defense for Acquisition and Sustainment’’ for ‘‘Under Secretary of Defense for Acquisition, Technology, and Logistics’’. Subsec. (b)(2)(C). Pub. L. 116–92, § 1621(e)(1)(A)(vi), which directed amendment of subpar. (C) by sub- stituting ‘‘Under Secretary of Defense for Intelligence and Security’’ for ‘‘Under Secretary of Defense for In- telligence’’, could not be executed because the words ‘‘Under Secretary of Defense for Intelligence’’ did not appear. Similar amendment was subsequently directed Page 425 TITLE 10—ARMED FORCES § 394 to subpar. (D) by Pub. L. 116–283, see 2021 Amendment note above. Pub. L. 116–92, § 902(8)(B), added subpar. (C). Former subpar. (C) redesignated (D). Subsec. (b)(2)(D) to (F). Pub. L. 116–92, § 902(8)(C), re- designated subpars. (C) to (E) as (D) to (F), respec- tively. 2015—Pub. L. 114–92, § 1641(a)(1), substituted ‘‘Report- ing on penetrations of networks and information sys- tems of certain contractors’’ for ‘‘Reports to Depart- ment of Defense on penetrations of networks and infor- mation systems of certain contractors’’ in section catchline. Pub. L. 114–92, § 1641(a), transferred section 941 of Pub. L. 112–239 to this chapter and renumbered it as this sec- tion. See Codification note above. Subsec. (c)(3). Pub. L. 114–92, § 1641(a)(2), added par. (3) and struck out former par. (3). Prior to amendment, text read as follows: ‘‘The procedures established pur- suant to subsection (a) shall prohibit the dissemination outside the Department of Defense of information ob- tained or derived through such procedures that is not created by or for the Department except with the ap- proval of the contractor providing such information.’’ Subsec. (d). Pub. L. 114–92, § 1641(a)(3), added subsec. (d) and struck out former subsec. (d). Prior to amend- ment, text read as follows: ‘‘(1) IN GENERAL.—Not later than 90 days after the date of the enactment of this Act— ‘‘(A) the Secretary of Defense shall establish the procedures required under subsection (a); and ‘‘(B) the senior official designated under subsection (b)(1) shall establish the criteria required under such subsection. ‘‘(2) APPLICABILITY DATE.—The requirements of this section shall apply on the date on which the Secretary of Defense establishes the procedures required under this section.’’ § 394. Authorities concerning military cyber op- erations (a) IN GENERAL.—The Secretary of Defense shall develop, prepare, and coordinate; make ready all armed forces for purposes of; and, when appropriately authorized to do so, conduct, mili- tary cyber activities or operations in cyber- space, including clandestine military activities or operations in cyberspace, to defend the United States and its allies, including in re- sponse to malicious cyber activity carried out against the United States or a United States person by a foreign power. (b) AFFIRMATION OF AUTHORITY.—Congress af- firms that the activities or operations referred to in subsection (a), when appropriately author- ized, include the conduct of military activities or operations in cyberspace short of hostilities (as such term is used in the War Powers Resolu- tion (Public Law 93–148; 50 U.S.C. 1541 et seq.)) or in areas in which hostilities are not occurring, including for the purpose of preparation of the environment, information operations, force pro- tection, and deterrence of hostilities, or counterterrorism operations involving the Armed Forces of the United States. (c) CLANDESTINE ACTIVITIES OR OPERATIONS.—A clandestine military activity or operation in cyberspace shall be considered a traditional military activity for the purposes of section 503(e)(2) of the National Security Act of 1947 (50 U.S.C. 3093(e)(2)). (d) CONGRESSIONAL OVERSIGHT.—The Secretary shall brief the congressional defense committees about any military activities or operations in cyberspace, including clandestine military ac- tivities or operations in cyberspace, occurring during the previous quarter during the quarterly briefing required by section 484 of this title. (e) RULE OF CONSTRUCTION.—Nothing in this section may be construed to limit the authority of the Secretary to conduct military activities or operations in cyberspace, including clandes- tine military activities or operations in cyber- space, to authorize specific military activities or operations, or to alter or otherwise affect the War Powers Resolution (50 U.S.C. 1541 et seq.), the Authorization for Use of Military Force (Public Law 107–40; 50 U.S.C. 1541 note), or re- porting of sensitive military cyber activities or operations required by section 395 of this title. (f) DEFINITIONS.—In this section: (1) The term ‘‘clandestine military activity or operation in cyberspace’’ means a military activity or military operation carried out in cyberspace, or associated preparatory actions, authorized by the President or the Secretary that— (A) is marked by, held in, or conducted with secrecy, where the intent is that the activity or operation will not be apparent or acknowledged publicly; and (B) is to be carried out— (i) as part of a military operation plan approved by the President or the Secretary in anticipation of hostilities or as directed by the President or the Secretary; (ii) to deter, safeguard, or defend against attacks or malicious cyber activities against the United States or Department of Defense information, networks, sys- tems, installations, facilities, or other as- sets; or (iii) in support of information related ca- pabilities. (2) The term ‘‘foreign power’’ has the mean- ing given such term in section 101 of the For- eign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801). (3) The term ‘‘United States person’’ has the meaning given such term in such section. (Added Pub. L. 114–92, div. A, title XVI, § 1642(a), Nov. 25, 2015, 129 Stat. 1116, § 130g; renumbered § 394 and amended Pub. L. 115–232, div. A, title XVI, §§ 1631(a), 1632, Aug. 13, 2018, 132 Stat. 2123.) Editorial Notes REFERENCES IN TEXT The War Powers Resolution, referred to in subsecs. (b) and (e), is Pub. L. 93–148, Nov. 7, 1973, 87 Stat. 555, which is classified generally to chapter 33 (§ 1541 et seq.) of Title 50, War and National Defense. For complete classification of this Resolution to the Code, see Short Title note set out under section 1541 of Title 50 and Ta- bles. The Authorization for Use of Military Force, referred to in subsec. (e), is Pub. L. 107–40, Sept. 18, 2001, 115 Stat. 224, which is set out as a note under section 1541 of Title 50, War and National Defense. AMENDMENTS 2018—Pub. L. 115–232, § 1632, designated existing provi- sions as subsec. (a), inserted heading, substituted ‘‘con- duct, military cyber activities or operations in cyber- space, including clandestine military activities or oper- ations in cyberspace, to defend the United States and its allies, including in response’’ for ‘‘conduct, a mili-