Cyber Intelligence Sharing and Protection Act
Do you support it?
Want to know if it passes?
We'll email you when HR 624 moves — a committee vote, a floor vote, or a signature. Nothing else.
Free forever · unsubscribe in one click.
Your answer was recorded either way.
Which district are you in?
Your ZIP is all we need to match you to your own representatives — so we can tell you how they voted on HR 624.
You're tracking HR 624
We'll email you the moment it moves.
HR 624 — Cyber Intelligence Sharing and Protection Act
Last action — Received in the Senate and Read twice and referred to the Select Committee on Intelligence.
No card. One bill, free forever — alerts when it moves.
-
✓Introduced
-
✓In Committee
-
Died in session
This bill died with 113th Congress. It reached “In Committee” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.
This bill is no longer active — its legislative session has ended, so there is no live prognosis. It would have to be reintroduced in the current session to move again.
Summary
Cyber Intelligence Sharing and Protection Act - (Sec. 2) Directs the federal government to conduct cybersecurity activities to provide shared situational awareness enabling integrated operational actions to protect, prevent, mitigate, respond to, and recover from cyber incidents. Defines "shared situational awareness" as an environment where cyber threat information is shared in real time between all designated federal cyber operations centers to provide actionable information about all known cyber threats. Directs the President, with respect to information shared by a cybersecurity provider (a non-federal entity that provides goods or services intended to be used for cybersecurity purposes) or self-protected entity (an entity that provides goods or services for cybersecurity purposes to itself), to designate: (1) an entity within the Department of Homeland Security (DHS) as the civilian federal entity to receive cyber threat information under prescribed procedures and subject to specified exceptions, and (2) an entity within the Department of Justice (DOJ) as the civilian federal entity to receive information related to cybersecurity crimes. Requires federal agencies receiving shared cyber threat information to establish procedures to: (1) ensure that specified information is also shared in real time with appropriate federal agencies with a national security mission; (2) ensure real-time information distribution to other federal agencies; and (3) facilitate information sharing, interaction, and collaboration among and between federal, state, local, tribal, and territorial governments, cybersecurity providers, and self-protected entities. Directs the DHS, Attorney General, Director of National Intelligence (DNI), and Department of Defense (DOD) to jointly establish and periodically review policies and procedures governing the receipt, retention, use, and disclosure of non-publicly available cyber threat information shared with the federal government. Requires such procedures, consistent with the need to protect against and mitigate cyber threats in a timely manner, to: (1) minimize the impact on privacy and civil liberties; (2) reasonably limit the receipt, retention, use, and disclosure of cyber threat information associated with specific persons that is unnecessary to protect against or mitigate cyber threats in a timely manner; (3) include requirements to safeguard non-publicly available cyber threat information that may be used to identify specific persons from unauthorized access or acquisition; (4) protect the confidentiality of cyber threat information associated with specific persons; and (5) not delay or impede the flow of cyber threat information necessary to defend against or mitigate a cyber threat. Instructs: (1) the DHS, Attorney General, DNI, and DOD to submit such procedures to Congress and establish a program to monitor and oversee the compliance of federal agencies; and (2) federal agencies to implement such procedures and notify such officials and Congress of any significant violations. Prohibits such procedures from being construed to prohibit any federal agency from engaging in technical discussions regarding cyber threat information with a cybersecurity provider or self-protected entity or from providing technical assistance to address vulnerabilities or mitigate threats at their request. Requires any such activity to be coordinated with DHS and other agencies. Directs the President's designated DHS entity to share with all appropriate federal agencies all significant information resulting from: (1) technical discussions with a cybersecurity provider or self-protected entity about cyber threat information, or (2) any technical assistance it provides to such cybersecurity provider or such self-protected entity to address vulnerabilities or mitigate threats. Directs the DHS Inspector General to submit annually to Congress a review of the use of such information shared with the federal government, as well as recommendations for improvements and modifications to address privacy and civil liberties concerns. Requires the DHS Officer for Civil Rights and Civil Liberties to submit to Congress an annual report assessing the privacy and civil liberties impact of the federal government's cyber threat information sharing activities. (Sec. 3) Amends the National Security Act of 1947 to add provisions concerning cyber threat intelligence and information sharing. Defines "cyber threat intelligence" as intelligence in the possession of an element of the intelligence community directly pertaining to: (1) a vulnerability of a system or network of a government or private entity or utility; (2) a threat to the integrity, confidentiality, or availability of such a system or network or any information stored on, processed on, or transiting such a system or network; (3) efforts to deny access to or degrade, disrupt, or destroy such a system or network; or (4) efforts to gain unauthorized access to such a system or network, including for the purpose of exfiltrating information. Excludes intelligence pertaining to efforts to gain unauthorized access to such a system or network that solely involve violations of consumer terms of service or consumer licensing agreements and do not otherwise constitute unauthorized access. Requires the DNI to: (1) establish procedures to allow intelligence community elements to share cyber threat intelligence with private-sector entities and utilities, and (2) encourage the sharing of such intelligence. Requires the procedures established to ensure that such intelligence is only: (1) shared with certified entities or a person with an appropriate security clearance; (2) shared consistent with the need to protect U.S. national security; (3) used in a manner that protects such intelligence from unauthorized disclosure; and (4) used, retained, or further disclosed by a certified entity for cybersecurity purposes. Provides guidelines for the granting of security clearance approvals to certified entities or officers, employees, or independent contractors of such entities. Prohibits a certified entity receiving such intelligence from further disclosing the information to any entity other than another certified entity or a federal agency authorized to receive such intelligence. Authorizes a cybersecurity provider, with the express consent of a protected entity (an entity that contracts with a cybersecurity provider), to: (1) use cybersecurity systems to identify and obtain cyber threat information in order to protect the rights and property of the protected entity; and (2) share cyber threat information with any other entity designated by the protected entity, including, if specifically designated, the DHS and DOJ entities designated by the President. Provides cybersecurity system use and threat information sharing authority to self-protected entities. Sets forth requirements with respect to the use and protection of shared information, including anonymization or minimization of such information and prohibiting the use of such information to gain a competitive advantage and, if shared with the federal government, exempts such information from public disclosure and prohibits the use of such information for regulatory purposes. Specifies that a non-federal recipient may only use such information for a cybersecurity purpose. Prohibits a civil or criminal cause of action against a protected entity, a self-protected entity, or a cybersecurity provider acting in good faith under the above circumstances. Prohibits such shared information requirements from being construed to provide new authority to: (1) a cybersecurity provider to use a cybersecurity system to identify or obtain cyber threat information from a system or network other than a system or network owned or operated by a protected entity for which such cybersecurity provider is providing goods or services for cybersecurity purposes, or (2) a self-protected entity to use a cybersecurity system to identify or obtain cyber threat information from a system or network other than a system or network owned or operated by such self-protected entity. Allows the federal government to use shared cyber threat information for: (1) cybersecurity purposes to ensure the integrity, confidentiality, availability, or safeguarding of a system or network; (2) the investigation of cybersecurity crimes; or (3) the protection of individuals from the danger of death or serious bodily harm and the prosecution of crimes involving such dangers (including the protection of minors from child pornography, sexual exploitation, kidnapping, and trafficking). Prohibits the federal government from affirmatively searching such information for any other purpose. Prohibits the federal government from using certain personally identifiable information shared from sensitive personal documents such as library records, firearms sales records, educational records, tax returns, and medical records. Requires a federal agency receiving information that is not cyber threat information to so notify the entity or provider of such information. Prohibits federal agencies from retaining shared information for any unauthorized use. Outlines federal government liability for violations of restrictions on the disclosure, use, and protection of voluntarily shared information. Preempts any state statute that restricts or otherwise regulates specified activity authorized by this Act. States that nothing in this section shall be construed to: (1) provide additional authority to, or modify existing authority of, any element of the intelligence community to control or direct the cybersecurity efforts of a private-sector entity or a component of the federal government or a state, local, or tribal government; (2) limit or affect existing information sharing relationships of the federal government; (3) preclude the federal government from requiring an entity to report significant cyber incidents under another provision of law; or (4) provide additional authority to, or modify existing authority of, any entity to use a cybersecurity system owned or controlled by the federal government on a private-sector system or network to protect the latter system or network. Prohibits this section from being construed to authorize the DOD, National Security Agency (NSA), or any other intelligence community element to target a U.S. person for surveillance. (Sec. 4) Repeals amendments made by this Act five years after enactment of this Act. (Sec. 5) Expresses the sense of Congress that international cooperation with regard to cybersecurity should be encouraged wherever possible. (Sec. 6) Prohibits this Act from being construed to provide new or alter any existing authority for an entity to sell personal information of a consumer to another entity for marketing purposes. (Sec. 7) Prohibits this Act from being construed to authorize a federal agency to require a federally contracted cybersecurity provider to provide information about cybersecurity incidents that do not pose a threat to the federal government's information.
Bill Text
We don't have the full text on file for this bill yet.
Read HR 624 on the official United States source →Action History
-
Received in the Senate and Read twice and referred to the Select Committee on Intelligence.
-
The Clerk was authorized to correct section numbers, punctuation, and cross references, and to make other necessary technical and conforming corrections in the engrossment of H.R. 624.
-
Motion to reconsider laid on the table Agreed to without objection.
-
On passage Passed by the Yeas and Nays: 288 - 127 (Roll no. 117).
-
On motion to recommit with instructions Failed by recorded vote: 189 - 224 (Roll no. 116). (consideration: CR H2143-2144)
-
The previous question on the motion to recommit with instructions was ordered without objection. (consideration: CR H2143)
-
DEBATE - The House proceeded with 10 minutes of debate on the Perlmutter motion to recommit with instructions. The instructions contained in the motion seek to require the bill to be reported back to the House with an amendment to prohibit employers, prospective employers, or the Federal Government from requiring the disclosure of social networking or personal account passwords by an employee or job applicant without a court order. The Motion would also prohibit the Federal Government from establishing a mechanism by which it could control citizen's access to the Internet with a national firewall similar to the "Great Internet Firewall of China." Lastly, the Motion would make changes to the McCaul amendment, adding a section that requires reporting of information on the number of Americans who have been forced to disclose passwords and had information released to the Federal government or obtained in connection
-
Mr. Perlmutter moved to recommit with instructions to Intelligence (Permanent). (consideration: CR H2142; text: CR H2142)
-
The House adopted the amendment in the nature of a substitute as agreed to by the Committee of the Whole House on the state of the Union.
-
The previous question was ordered pursuant to the rule. (consideration: CR H2142)
-
The House rose from the Committee of the Whole House on the state of the Union to report H.R. 624.
-
H.AMDT.52 On agreeing to the McCaul amendment (A011) Agreed to by recorded vote: 409 - 5 (Roll no. 115).
-
H.AMDT.48 On agreeing to the LaMalfa amendment (A007) Agreed to by recorded vote: 413 - 0 (Roll no. 114).
-
H.AMDT.46 On agreeing to the Sinema amendment (A005) Agreed to by recorded vote: 411 - 0 (Roll no. 113).
-
UNFINISHED BUSINESS - The Chair announced that the unfinished business was on the adoption of amendments which had been debated earlier and on which further proceedings had been postponed.
-
The House resolved into Committee of the Whole House on the state of the Union for further consideration.
-
Considered as unfinished business. (consideration: CR H2140-2145)
-
Committee of the Whole House on the state of the Union rises leaving H.R. 624 as unfinished business.
-
On motion that the Committee rise Agreed to by voice vote.
-
Mr. Rogers (MI) moved that the Committee rise.
-
POSTPONED PROCEEDINGS - At the conclusion of debate on the McCaul amendment, the Chair put the question on adoption of the amendment and by voice vote announced that the ayes had prevailed. Mr. McCaul demanded a recorded vote and the Chair postponed further proceedings on the question of adoption of the amendment until later in the legislative day.
-
DEBATE - Pursuant to the provisions of H. Res. 164, the Committee of the Whole proceeded with 10 minutes of debate on the McCaul amendment No. 13.
-
H.AMDT.52 Amendment (A011) offered by Mr. McCaul. (consideration: CR H2136-2139, H2141-2142; text: CR H2136-2137)Amendment establishes a primary point of receipt in the Federal Government for cyber threat information sharing by designating an entity within the Department of Homeland Security as the civilian Federal entity interface to receive cyber threat information from the private sector.
-
H.AMDT.51 On agreeing to the Jackson Lee amendment (A010) Agreed to by voice vote.
-
DEBATE - Pursuant to the provisions of H. Res. 164, the Committee of the Whole proceeded with 10 minutes of debate on the Jackson Lee amendment No. 12.
-
H.AMDT.51 Amendment (A010) offered by Ms. Jackson Lee. (consideration: CR H2135-2136; text: CR H2135)Amendment clarifies that cyber security service providers need only provide information about cyber security incidents if they pose a threat to the government's information and protects individuals' private data from being accessed by the government solely because it is stored by a company that provides information services to a government agency.
-
H.AMDT.50 On agreeing to the Barton amendment (A009) Agreed to by voice vote.
-
DEBATE - Pursuant to the provisions of H. Res. 164, the Committee of the Whole proceeded with 10 minutes of debate on the Barton amendment No. 11.
-
H.AMDT.50 Amendment (A009) offered by Mr. Barton. (consideration: CR H2134-2135; text: CR H2134)Amendment clarifies that companies sharing cyber threat information with other companies cannot treat this sharing relationship as a loophole to sell a consumer's personal information for a marketing purpose.
-
H.AMDT.49 On agreeing to the Paulsen amendment (A008) Agreed to by voice vote.
-
DEBATE - Pursuant to the provisions of H. Res. 164, the Committee of the Whole proceeded with 10 minutes of debate on the Paulsen amendment No. 10.
-
H.AMDT.49 Amendment (A008) offered by Mr. Paulsen. (consideration: CR H2133-2134; text: CR H2133)Amendment establishes the sense of congress that international cooperation should be encouraged where possible in regards to cyber security.
-
POSTPONED PROCEEDINGS - At the conclusion of debate on the LaMalfa amendment, the Chair put the question on adoption of the amendment and by voice vote announced that the ayes had prevailed. Mr. Rogers (MI) demanded a recorded vote and the Chair postponed further proceedings on the question of adoption of the amendment until later in the legislative day.
-
DEBATE - Pursuant to the provisions of H.Res. 164, the Committee of the Whole proceeded with 10 minutes of debate on the LaMalfa amendment No. 9.
-
H.AMDT.48 Amendment (A007) offered by Mr. LaMalfa. (consideration: CR H2132-2133, H2141; text: CR H2132)Amendment clarifies that nothing in this bill authorizes the government to target a US person for surveillance.
-
H.AMDT.47 On agreeing to the Sanchez, Loretta amendment (A006) as modified Agreed to by voice vote. (text as modified: CR H2131)
-
H.AMDT.47 Sanchez, Loretta amendment (A006) modified by unanimous consent.
-
DEBATE - Pursuant to the provisions of H.Res. 164, the Committee of the Whole proceeded with 10 minutes of debate on the Loretta Sanchez amendment No. 8.
-
H.AMDT.47 Amendment (A006) offered by Ms. Sanchez, Loretta. (consideration: CR H2131-2132)Amendment as modified, inserts language that would include the Privacy Officer and the Officer for Civil Rights and Civil Liberties of the Department of Homeland Security as key stakeholders in the issuance of a report assessing the privacy and civil liberties impacts caused by the bill.
-
POSTPONED PROCEEDINGS - At the conclusion of debate on the Sinema amendment, the Chair put the question on adoption of the amendment and by voice vote announced that the ayes had prevailed. Ms. Sinema demanded a recorded vote and the Chair postponed further proceedings on the question of adoption of the amendment until later in the legislative day.
-
DEBATE - Pursuant to the provisions of H.Res. 164, the Committee of the Whole proceeded with 10 minutes of debate on the Sinema amendment No. 7.
-
H.AMDT.46 Amendment (A005) offered by Ms. Sinema. (consideration: CR H2130-2131, H2140; text: CR H2130)Amendment adds the Inspector General (IG) of DHS to the omnibus IG reporting requirement; adds the DHS IG to the rest of the group responsible for submitting an annual report to Congress and adds the House Committee on Homeland Security and the Senate Committee on Homeland Security and Governmental Affairs to the list of recipients of the report.
-
The House resolved into Committee of the Whole House on the state of the Union for further consideration.
-
Considered as unfinished business. (consideration: CR H2130-2139)
-
ORDER OF PROCEDURE - Mr. Sessions asked unanimous consent that, during further consideration of H.R. 624 in the Committee of the Whole and pursuant to the provisions of H.Res. 164, amendment numbered 13 offered by Mr. McCaul of Texas be modified in the form that was placed at the desk. Agreed to without objection.
-
Committee of the Whole House on the state of the Union rises leaving H.R. 624 as unfinished business.
-
On motion that the Committee rise Agreed to by voice vote.
-
Mr. Sessions moved that the Committee rise.
-
H.AMDT.45 On agreeing to the Langevin amendment Agreed to by recorded vote: 411 - 3 (Roll no. 112).
-
H.AMDT.43 On agreeing to the Connolly amendment (A002) Agreed to by recorded vote: 418 - 0 (Roll no. 111).
-
H.AMDT.42 On agreeing to the Rogers (MI) amendment Agreed to by recorded vote: 418 - 0 (Roll no. 110).
-
UNFINISHED BUSINESS - The Chair announced that the unfinished business was on adoption of amendments which had been debated and on which further proceedings had been postponed.
-
The House resolved into Committee of the Whole House on the state of the Union for further consideration.
-
Considered as unfinished business. (consideration: CR H2103-2105)
-
Committee of the Whole House on the state of the Union rises leaving H.R. 624 as unfinished business.
-
On motion that the Committee rise Agreed to by voice vote.
-
Mr. Rogers (MI) moved that the Committee rise.
-
POSTPONED PROCEEDINGS - At the conclusion of debate on the Langevin amendment, the Chair put the question on adoption of the amendment and by voice vote announced that the ayes had prevailed. Mr. Rogers (MI) demanded a recorded vote and the Chair postponed further proceedings on the question of adoption of the amendment until later in the legislative day.
-
DEBATE - Pursuant to the provisions of H. Res. 164, the Committee of the Whole proceeded with 10 minutes of debate on the Langevin amendment No. 4.
-
H.AMDT.45 Amendment (A004) offered by Mr. Langevin. (consideration: CR H2102-2103, H2105; text: CR H2102)Amendment replaces the term "local" with "political subdivision", which allows the inclusion of "utility districts" that would not otherwise be covered but that were intended to be covered in the bill.
-
H.AMDT.44 On agreeing to the Schneider amendment (A003) Agreed to by voice vote.
-
DEBATE - Pursuant to the provisions of H. Res. 164, the Committee of the Whole proceeded with 10 minutes of debate on the Schneider amendment No. 3.
-
H.AMDT.44 Amendment (A003) offered by Mr. Schneider. (consideration: CR H2101-2102; text: CR H2101)Amendment clarifies that independent contractors are eligible for security clearances for purposes of employment to handle cyber threat intelligence and cyber threat information.
-
POSTPONED PROCEEDINGS - At the conclusion of debate on the Connolly amendment, the Chair put the question on adoption of the amendment and by voice vote announced that the ayes had prevailed. Mr. Rogers (MI) demanded a recorded vote and the Chair postponed further proceedings on the question of adoption of the amendment until later in the legislative day.
-
DEBATE - Pursuant to the provisions of H. Res. 164, the Committee of the Whole proceeded with 10 minutes of debate on the Connolly amendment No. 2.
-
H.AMDT.43 Amendment (A002) offered by Mr. Connolly. (consideration: CR H2100-2101, H2104-2105; text: CR H2100)Amendment further defines how classified cyber threat intelligence may be shared and used, and adds an additional provision stipulating that classified threat intelligence may only be used, retained, or further disclosed by a certified entity specifically for cybersecurity purposes.
-
POSTPONED PROCEEDINGS - At the conclusion of debate on the Rogers (MI) amendment, the Chair put the question on adoption of the amendment and by voice vote announced that the ayes had prevailed. Mr. Rogers (MI) demanded a recorded vote and the Chair postponed further proceedings on the question of adoption of the amendment until later in the legislative day.
-
DEBATE - Pursuant to the provisions of H. Res. 164, the Committee of the Whole proceeded with 10 minutes of debate on the Rogers (MI) amendment No. 1.
-
H.AMDT.42 Amendment (A001) offered by Mr. Rogers (MI). (consideration: CR H2100, H2103-2104; text: CR H2100)Amendment corrects reported language concerning a reference in subsection (c)(4) to the procedures created in (c)(7) by clarifying that library records, firearm sales records, medical records and tax returns are not included in any information voluntarily shared with the government under CISPA.
-
GENERAL DEBATE - The Committee of the Whole proceeded with one hour of general debate on H.R. 624.
-
The Speaker designated the Honorable Ileana Ros-Lehtinen to act as Chairwoman of the Committee.
-
House resolved itself into the Committee of the Whole House on the state of the Union pursuant to H. Res. 164 and Rule XVIII.
-
Rule provides for consideration of H.R. 624 with 1 hour of general debate. Previous question shall be considered as ordered without intervening motions except motion to recommit with or without instructions. Measure will be considered read. Specified amendments are in order.
-
Considered under the provisions of rule H. Res. 164. (consideration: CR H2088-2103; text of amendment in the nature of a substitute: CR H2097-2100)
-
Rule H. Res. 164 passed House.
-
Rules Committee Resolution H. Res. 164 Reported to House. Rule provides for consideration of H.R. 624 with 1 hour of general debate. Previous question shall be considered as ordered without intervening motions except motion to recommit with or without instructions. Measure will be considered read. Specified amendments are in order.
-
Placed on the Union Calendar, Calendar No. 25.
-
Reported (Amended) by the Committee on Intelligence. H. Rept. 113-39.
-
Referred to the House Committee on Intelligence (Permanent Select).
Sponsors
- Mike J. Rogers · Primary
Sponsorship breakdown
Export CSV (upgrade) →1 sponsors · 0 co-sponsors · 546 not signed on · 322 voted No
Sponsors (1)
- Mike J. Rogers R Voted No
Co-sponsors (0)
None.
Not signed on (546)
546 members have not signed on to this bill.
Show all 546 →"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.
Votes
| Party | Yea | Nay | Present | Not Voting |
|---|---|---|---|---|
| Republican | 27 | 2 | 0 | 3 |
| D | 160 | 0 | 0 | 8 |
| Democrat | 28 | 0 | 0 | 2 |
| Whig | 2 | 0 | 0 | 0 |
| R | 190 | 3 | 0 | 5 |
| Jackson | 1 | 0 | 0 | 0 |
| Federalist | 1 | 0 | 0 | 0 |
| Total | 409 | 5 | 0 | 18 |
| % of votes cast | 95% | 1% | 0% | 4% |
How each member voted (432)
| Party | Yea | Nay | Present | Not Voting |
|---|---|---|---|---|
| R | 0 | 194 | 0 | 4 |
| Republican | 3 | 26 | 0 | 3 |
| Jackson | 0 | 1 | 0 | 0 |
| Democrat | 27 | 1 | 0 | 2 |
| D | 158 | 0 | 0 | 10 |
| Federalist | 0 | 1 | 0 | 0 |
| Whig | 1 | 1 | 0 | 0 |
| Total | 189 | 224 | 0 | 19 |
| % of votes cast | 44% | 52% | 0% | 4% |
How each member voted (432)
| Party | Yea | Nay | Present | Not Voting |
|---|---|---|---|---|
| Republican | 21 | 8 | 0 | 3 |
| D | 74 | 86 | 0 | 8 |
| Democrat | 19 | 9 | 0 | 2 |
| Whig | 1 | 1 | 0 | 0 |
| R | 171 | 23 | 0 | 4 |
| Jackson | 1 | 0 | 0 | 0 |
| Federalist | 1 | 0 | 0 | 0 |
| Total | 288 | 127 | 0 | 17 |
| % of votes cast | 67% | 29% | 0% | 4% |
How each member voted (432)
| Party | Yea | Nay | Present | Not Voting |
|---|---|---|---|---|
| Republican | 29 | 0 | 0 | 3 |
| D | 161 | 0 | 0 | 7 |
| Democrat | 29 | 0 | 0 | 1 |
| Whig | 2 | 0 | 0 | 0 |
| R | 188 | 3 | 0 | 7 |
| Jackson | 1 | 0 | 0 | 0 |
| Federalist | 1 | 0 | 0 | 0 |
| Total | 411 | 3 | 0 | 18 |
| % of votes cast | 95% | 1% | 0% | 4% |
How each member voted (432)
Subjects
Frequently asked questions
- What does HR 624 do?
- Cyber Intelligence Sharing and Protection Act - (Sec. 2) Directs the federal government to conduct cybersecurity activities to provide shared situational awareness enabling integrated operational actions to protect, prevent, mitigate, respond to, and recover from cyber incidents. Defines "shared situational awareness" as an environment where cyber threat information is shared in real time between all designated federal cyber operations centers to provide actionable information about all known cyber threats. Directs the President, with respect to information shared by a cybersecurity provider (a non-federal entity that provides goods or services intended to be used for cybersecurity purposes) or self-protected entity (an entity that provides goods or services for cybersecurity purposes to itself), to designate: (1) an entity within the Department of Homeland Security (DHS) as the civilian federal entity to receive cyber threat information under prescribed procedures and subject to specified exceptions, and (2) an entity within the Department of Justice (DOJ) as the civilian federal entity to receive information related to cybersecurity crimes. Requires federal agencies receiving shared cyber threat information to establish procedures to: (1) ensure that specified information is also shared in real time with appropriate federal agencies with a national security mission; (2) ensure real-time information distribution to other federal agencies; and (3) facilitate information sharing, interaction, and collaboration among and between federal, state, local, tribal, and territorial governments, cybersecurity providers, and self-protected entities. Directs the DHS, Attorney General, Director of National Intelligence (DNI), and Department of Defense (DOD) to jointly establish and periodically review policies and procedures governing the receipt, retention, use, and disclosure of non-publicly available cyber threat information shared with the federal government. Requires such procedures, consistent with the need to protect against and mitigate cyber threats in a timely manner, to: (1) minimize the impact on privacy and civil liberties; (2) reasonably limit the receipt, retention, use, and disclosure of cyber threat information associated with specific persons that is unnecessary to protect against or mitigate cyber threats in a timely manner; (3) include requirements to safeguard non-publicly available cyber threat information that may be used to identify specific persons from unauthorized access or acquisition; (4) protect the confidentiality of cyber threat information associated with specific persons; and (5) not delay or impede the flow of cyber threat information necessary to defend against or mitigate a cyber threat. Instructs: (1) the DHS, Attorney General, DNI, and DOD to submit such procedures to Congress and establish a program to monitor and oversee the compliance of federal agencies; and (2) federal agencies to implement such procedures and notify such officials and Congress of any significant violations. Prohibits such procedures from being construed to prohibit any federal agency from engaging in technical discussions regarding cyber threat information with a cybersecurity provider or self-protected entity or from providing technical assistance to address vulnerabilities or mitigate threats at their request. Requires any such activity to be coordinated with DHS and other agencies. Directs the President's designated DHS entity to share with all appropriate federal agencies all significant information resulting from: (1) technical discussions with a cybersecurity provider or self-protected entity about cyber threat information, or (2) any technical assistance it provides to such cybersecurity provider or such self-protected entity to address vulnerabilities or mitigate threats. Directs the DHS Inspector General to submit annually to Congress a review of the use of such information shared with the federal government, as well as recommendations for improvements and modifications to address privacy and civil liberties concerns. Requires the DHS Officer for Civil Rights and Civil Liberties to submit to Congress an annual report assessing the privacy and civil liberties impact of the federal government's cyber threat information sharing activities. (Sec. 3) Amends the National Security Act of 1947 to add provisions concerning cyber threat intelligence and information sharing. Defines "cyber threat intelligence" as intelligence in the possession of an element of the intelligence community directly pertaining to: (1) a vulnerability of a system or network of a government or private entity or utility; (2) a threat to the integrity, confidentiality, or availability of such a system or network or any information stored on, processed on, or transiting such a system or network; (3) efforts to deny access to or degrade, disrupt, or destroy such a system or network; or (4) efforts to gain unauthorized access to such a system or network, including for the purpose of exfiltrating information. Excludes intelligence pertaining to efforts to gain unauthorized access to such a system or network that solely involve violations of consumer terms of service or consumer licensing agreements and do not otherwise constitute unauthorized access. Requires the DNI to: (1) establish procedures to allow intelligence community elements to share cyber threat intelligence with private-sector entities and utilities, and (2) encourage the sharing of such intelligence. Requires the procedures established to ensure that such intelligence is only: (1) shared with certified entities or a person with an appropriate security clearance; (2) shared consistent with the need to protect U.S. national security; (3) used in a manner that protects such intelligence from unauthorized disclosure; and (4) used, retained, or further disclosed by a certified entity for cybersecurity purposes. Provides guidelines for the granting of security clearance approvals to certified entities or officers, employees, or independent contractors of such entities. Prohibits a certified entity receiving such intelligence from further disclosing the information to any entity other than another certified entity or a federal agency authorized to receive such intelligence. Authorizes a cybersecurity provider, with the express consent of a protected entity (an entity that contracts with a cybersecurity provider), to: (1) use cybersecurity systems to identify and obtain cyber threat information in order to protect the rights and property of the protected entity; and (2) share cyber threat information with any other entity designated by the protected entity, including, if specifically designated, the DHS and DOJ entities designated by the President. Provides cybersecurity system use and threat information sharing authority to self-protected entities. Sets forth requirements with respect to the use and protection of shared information, including anonymization or minimization of such information and prohibiting the use of such information to gain a competitive advantage and, if shared with the federal government, exempts such information from public disclosure and prohibits the use of such information for regulatory purposes. Specifies that a non-federal recipient may only use such information for a cybersecurity purpose. Prohibits a civil or criminal cause of action against a protected entity, a self-protected entity, or a cybersecurity provider acting in good faith under the above circumstances. Prohibits such shared information requirements from being construed to provide new authority to: (1) a cybersecurity provider to use a cybersecurity system to identify or obtain cyber threat information from a system or network other than a system or network owned or operated by a protected entity for which such cybersecurity provider is providing goods or services for cybersecurity purposes, or (2) a self-protected entity to use a cybersecurity system to identify or obtain cyber threat information from a system or network other than a system or network owned or operated by such self-protected entity. Allows the federal government to use shared cyber threat information for: (1) cybersecurity purposes to ensure the integrity, confidentiality, availability, or safeguarding of a system or network; (2) the investigation of cybersecurity crimes; or (3) the protection of individuals from the danger of death or serious bodily harm and the prosecution of crimes involving such dangers (including the protection of minors from child pornography, sexual exploitation, kidnapping, and trafficking). Prohibits the federal government from affirmatively searching such information for any other purpose. Prohibits the federal government from using certain personally identifiable information shared from sensitive personal documents such as library records, firearms sales records, educational records, tax returns, and medical records. Requires a federal agency receiving information that is not cyber threat information to so notify the entity or provider of such information. Prohibits federal agencies from retaining shared information for any unauthorized use. Outlines federal government liability for violations of restrictions on the disclosure, use, and protection of voluntarily shared information. Preempts any state statute that restricts or otherwise regulates specified activity authorized by this Act. States that nothing in this section shall be construed to: (1) provide additional authority to, or modify existing authority of, any element of the intelligence community to control or direct the cybersecurity efforts of a private-sector entity or a component of the federal government or a state, local, or tribal government; (2) limit or affect existing information sharing relationships of the federal government; (3) preclude the federal government from requiring an entity to report significant cyber incidents under another provision of law; or (4) provide additional authority to, or modify existing authority of, any entity to use a cybersecurity system owned or controlled by the federal government on a private-sector system or network to protect the latter system or network. Prohibits this section from being construed to authorize the DOD, National Security Agency (NSA), or any other intelligence community element to target a U.S. person for surveillance. (Sec. 4) Repeals amendments made by this Act five years after enactment of this Act. (Sec. 5) Expresses the sense of Congress that international cooperation with regard to cybersecurity should be encouraged wherever possible. (Sec. 6) Prohibits this Act from being construed to provide new or alter any existing authority for an entity to sell personal information of a consumer to another entity for marketing purposes. (Sec. 7) Prohibits this Act from being construed to authorize a federal agency to require a federally contracted cybersecurity provider to provide information about cybersecurity incidents that do not pose a threat to the federal government's information.
- Who sponsors HR 624?
- HR 624 is sponsored by Mike J. Rogers (R).
- What is the current status of HR 624?
- This bill died with 113th Congress. It reached “In Committee” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.
- Where can I track HR 624?
- Track HR 624 free on One Click Politics — get push/email alerts when it moves.
Make your voice heard on HR 624
Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.
Stay ahead of HR 624
Last checked for changes about 18 hours ago · updated continuously
One Click Politics tracks every bill in Congress and all 50 states.
Track this bill →