G:\CMTE\AS\MISC\CYBER_NOTICE_001.XML

.....................................................................
(Original Signature of Member)

H. R. ll

115TH CONGRESS
1ST SESSION

To amend title 10, United States Code, to require congressional notification
concerning sensitive military cyber operations and cyber weapons, and
for other purposes.

IN THE HOUSE OF REPRESENTATIVES
Mr. THORNBERRY (for himself, Mr. SMITH of Washington, Ms. STEFANIK,
and Mr. LANGEVIN) introduced the following bill; which was referred to
the Committee on lllllllllllllll

A BILL
To amend title 10, United States Code, to require congressional notification concerning sensitive military cyber operations and cyber weapons, and for other purposes.
1

Be it enacted by the Senate and House of Representa-

2 tives of the United States of America in Congress assembled,

g:\VHLC\060717\060717.069.xml
June 7, 2017 (11:54 a.m.)
VerDate Nov 24 2008

11:54 Jun 07, 2017

Jkt 000000

(660912 5)
PO 00000

Frm 00001

Fmt 6652

Sfmt 6201

C:\USERS\BJGALL~1\APPDATA\ROAMING\SOFTQUAD\XMETAL\7.0\GEN\C\CYBER_~1.X

 G:\CMTE\AS\MISC\CYBER_NOTICE_001.XML

2
1

SECTION 1. NOTIFICATION REQUIREMENTS FOR SENSITIVE

2

MILITARY CYBER OPERATIONS AND CYBER

3

WEAPONS.

4

(a) NOTIFICATION.—Chapter 3 of title 10, United

5 States Code, is amended by adding at the end the fol6 lowing new sections:
7 ‘‘§ 130j. Notification requirements for sensitive mili8
9

tary cyber operations

‘‘(a) IN GENERAL.—Except as provided in subsection

10 (d), the Secretary of Defense shall promptly submit to the
11 congressional defense committees notice in writing of any
12 sensitive military cyber operation conducted under this
13 title no later than 48 hours following such operation.
14

‘‘(b) PROCEDURES.—(1) The Secretary of Defense

15 shall establish and submit to the congressional defense
16 committees procedures for complying with the require17 ments of subsection (a) consistent with the national secu18 rity of the United States and the protection of operational
19 integrity. The Secretary shall promptly notify the congres20 sional defense committees in writing of any changes to
21 such procedures at least 14 days prior to the adoption of
22 any such changes.
23

‘‘(2) The congressional defense committees shall en-

24 sure that committee procedures designed to protect from
25 unauthorized disclosure classified information relating to
26 national security of the United States are sufficient to prog:\VHLC\060717\060717.069.xml
June 7, 2017 (11:54 a.m.)
VerDate Nov 24 2008

11:54 Jun 07, 2017

Jkt 000000

(660912 5)
PO 00000

Frm 00002

Fmt 6652

Sfmt 6201

C:\USERS\BJGALL~1\APPDATA\ROAMING\SOFTQUAD\XMETAL\7.0\GEN\C\CYBER_~1.X

 G:\CMTE\AS\MISC\CYBER_NOTICE_001.XML

3
1 tect the information that is submitted to the committees
2 pursuant to this section.
3

‘‘(3) In the event of an unauthorized disclosure of a

4 sensitive military cyber operation covered by this section,
5 the Secretary shall ensure, to the maximum extent prac6 ticable, that the congressional defense committees are no7 tified immediately of the sensitive military cyber operation
8 concerned. The notification under this paragraph may be
9 verbal or written, but in the event of a verbal notification
10 a written notification shall be provided by not later than
11 48 hours after the provision of the verbal notification.
12
13

‘‘(c) SENSITIVE MILITARY CYBER OPERATION DEFINED.—(1)

In this section, the term ‘sensitive military

14 cyber operation’ means an action described in paragraph
15 (2) that—
16

‘‘(A) is carried out by the armed forces or by

17

a foreign partner in coordination with the armed

18

forces; and

19

‘‘(B) is intended to cause effects outside a geo-

20

graphic location where United States armed forces

21

are involved in hostilities (as that term is used in

22

section 1543 of title 50, United States Code).

23

‘‘(2) The actions described in this paragraph are the

24 following:
25

‘‘(A) An offensive cyber operation.

g:\VHLC\060717\060717.069.xml
June 7, 2017 (11:54 a.m.)
VerDate Nov 24 2008

11:54 Jun 07, 2017

Jkt 000000

(660912 5)
PO 00000

Frm 00003

Fmt 6652

Sfmt 6201

C:\USERS\BJGALL~1\APPDATA\ROAMING\SOFTQUAD\XMETAL\7.0\GEN\C\CYBER_~1.X

 G:\CMTE\AS\MISC\CYBER_NOTICE_001.XML

4
1

‘‘(B) A defensive cyber operation outside the

2

Department of Defense Information Networks to de-

3

feat an ongoing or imminent threat.

4

‘‘(d) EXCEPTIONS.—The notification requirement

5 under subsection (a) does not apply—
6

‘‘(1) to a training exercise conducted with the

7

consent of all nations where the intended effects of

8

the exercise will occur; or

9

‘‘(2) to a covert action (as that term is defined

10

in section 3093 of title 50, United States Code).

11

‘‘(e) RULE

OF

CONSTRUCTION.—Nothing in this sec-

12 tion shall be construed to provide any new authority or
13 to alter or otherwise affect the War Powers Resolution (50
14 U.S.C. 1541 et seq.), the Authorization for Use of Military
15 Force (Public Law 107–40; 50 U.S.C. 1541 note), or any
16 requirement under the National Security Act of 1947 (50
17 U.S.C. 3001 et seq.).
18 ‘‘§ 130k. Notification requirements for cyber weapons
19

‘‘(a) IN GENERAL.—Except as provided in subsection

20 (c), the Secretary of Defense shall promptly submit to the
21 congressional defense committees notice in writing of the
22 following:
23

‘‘(1) With respect to a cyber capability that is

24

intended for use as a weapon, the results of any re-

25

view of the capability for legality under international

g:\VHLC\060717\060717.069.xml
June 7, 2017 (11:54 a.m.)
VerDate Nov 24 2008

11:54 Jun 07, 2017

Jkt 000000

(660912 5)
PO 00000

Frm 00004

Fmt 6652

Sfmt 6201

C:\USERS\BJGALL~1\APPDATA\ROAMING\SOFTQUAD\XMETAL\7.0\GEN\C\CYBER_~1.X

 G:\CMTE\AS\MISC\CYBER_NOTICE_001.XML

5
1

law pursuant to Department of Defense Directive

2

5000.01 no later than 48 hours after any military

3

department concerned has completed such review.

4

‘‘(2) The use as a weapon of any cyber capa-

5

bility that has been approved for such use under

6

international law by a military department no later

7

than 48 hours following such use.

8

‘‘(b) PROCEDURES.—(1) The Secretary of Defense

9 shall establish and submit to the congressional defense
10 committees procedures for complying with the require11 ments of subsection (a) consistent with the national secu12 rity of the United States and the protection of operational
13 integrity. The Secretary shall promptly notify the congres14 sional defense committees in writing of any changes to
15 such procedures at least 14 days prior to the adoption of
16 any such changes.
17

‘‘(2) The congressional defense committees shall en-

18 sure that committee procedures designed to protect from
19 unauthorized disclosure classified information relating to
20 national security of the United States are sufficient to pro21 tect the information that is submitted to the committees
22 pursuant to this section.
23

‘‘(3) In the event of an unauthorized disclosure of a

24 cyber capability covered by this section, the Secretary shall
25 ensure, to the maximum extent practicable, that the con-

g:\VHLC\060717\060717.069.xml
June 7, 2017 (11:54 a.m.)
VerDate Nov 24 2008

11:54 Jun 07, 2017

Jkt 000000

(660912 5)
PO 00000

Frm 00005

Fmt 6652

Sfmt 6201

C:\USERS\BJGALL~1\APPDATA\ROAMING\SOFTQUAD\XMETAL\7.0\GEN\C\CYBER_~1.X

 G:\CMTE\AS\MISC\CYBER_NOTICE_001.XML

6
1 gressional defense committees are notified immediately of
2 the cyber capability concerned. The notification under this
3 paragraph may be verbal or written, but in the event of
4 a verbal notification a written notification shall be pro5 vided by not later than 48 hours after the provision of
6 the verbal notification.
7

‘‘(c) EXCEPTIONS.—The notification requirement

8 under subsection (a) does not apply—
9

‘‘(1) to a training exercise conducted with the

10

consent of all nations where the intended effects of

11

the exercise will occur; or

12

‘‘(2) to a covert action (as that term is defined

13

in section 3093 of title 50, United States Code).

14

‘‘(d) RULE

OF

CONSTRUCTION.—Nothing in this sec-

15 tion shall be construed to provide any new authority or
16 to alter or otherwise affect the War Powers Resolution (50
17 U.S.C. 1541 et seq.), the Authorization for Use of Military
18 Force (Public Law 107–40; 50 U.S.C. 1541 note), or any
19 requirement under the National Security Act of 1947 (50
20 U.S.C. 3001 et seq.).’’.
21

(b) CLERICAL AMENDMENT.—The table of sections

22 at the beginning of such chapter is amended by adding
23 at the end the following new items:
‘‘130j. Notification requirements for sensitive military cyber operations.
‘‘130k. Notification requirements for cyber weapons.’’.

g:\VHLC\060717\060717.069.xml
June 7, 2017 (11:54 a.m.)
VerDate Nov 24 2008

11:54 Jun 07, 2017

Jkt 000000

(660912 5)
PO 00000

Frm 00006

Fmt 6652

Sfmt 6211

C:\USERS\BJGALL~1\APPDATA\ROAMING\SOFTQUAD\XMETAL\7.0\GEN\C\CYBER_~1.X