House Report 113-41 - PROVIDING FOR CONSIDERATION OF THE BILL (H.R. 624) TO PROVIDE FOR THE SHARING OF CERTAIN CYBER THREAT INTELLIGENCE AND CYBER THREAT INFORMATION BETWEEN THE INTELLIGENCE COMMUNITY AND CYBERSECURITY ENTITIES, AND FOR OTHER PURPOSES

[House Report 113-41]
[From the U.S. Government Publishing Office]

113th Congress Report
HOUSE OF REPRESENTATIVES
1st Session 113-41

======================================================================

PROVIDING FOR CONSIDERATION OF THE BILL (H.R. 624) TO PROVIDE FOR THE
SHARING OF CERTAIN CYBER THREAT INTELLIGENCE AND CYBER THREAT
INFORMATION BETWEEN THE INTELLIGENCE COMMUNITY AND CYBERSECURITY
ENTITIES, AND FOR OTHER PURPOSES

_______

April 16, 2013.--Referred to the House Calendar and ordered to be
printed

_______

Mr. Woodall, from the Committee on Rules,
submitted the following

R E P O R T

[To accompany H. Res. 164]

The Committee on Rules, having had under consideration
House Resolution 164, by a nonrecord vote, report the same to
the House with the recommendation that the resolution be
adopted.

SUMMARY OF PROVISIONS OF THE RESOLUTION

The resolution provides for consideration of H.R. 624, the
Cyber Intelligence Sharing and Protection Act, under a
structured rule. The resolution provides one hour of general
debate equally divided and controlled by the chair and ranking
minority member of the Permanent Select Committee on
Intelligence. The resolution waives all points of order against
consideration of the bill. The resolution makes in order as
original text for the purpose of amendment an amendment in the
nature of a substitute consisting of the text of Rules
Committee Print 113-7 and provides that it shall be considered
as read. The resolution waives all points of order against the
amendment in the nature of a substitute. The resolution makes
in order only those further amendments printed in this report.
Each such amendment may be offered only in the order printed in
this report, may be offered only by a Member designated in this
report, shall be considered as read, shall be debatable for the
time specified in this report equally divided and controlled by
the proponent and an opponent, shall not be subject to
amendment, and shall not be subject to a demand for division of
the question in the House or in the Committee of the Whole. The
resolution waives all points of order against the amendments
printed in this report. The resolution provides one motion to
recommit with or without instructions.

EXPLANATION OF WAIVERS

Although the resolution waives all points of order against
consideration of the bill, the Committee is not aware of any
points of order. The waiver is prophylactic in nature.
Although the resolution waives all points of order against
the amendment in the nature of a substitute made in order as
original text, the Committee is not aware of any points of
order. The waiver is prophylactic in nature.
Although the resolution waives all points of order against
the amendments printed in this report, the Committee is not
aware of any points of order. The waiver is prophylactic in
nature.

COMMITTEE VOTES

The results of each record vote on an amendment or motion
to report, together with the names of those voting for and
against, are printed below:

Rules Committee record vote No. 20

Motion by Ms. Slaughter to make in order and provide the
appropriate waivers for amendment #11, offered by Rep. Schiff
(CA), Rep. Eshoo (CA), Rep. Holt (NJ), Rep. Schakowsky (IL) and
Rep. Thompson (MS), which requires that private entities
sharing information with the government or other private
entities under the bill make ``reasonable efforts'' to remove
Personally Identifiable Information of persons unrelated to the
cyber threat. Defeated: 4-9.

----------------------------------------------------------------------------------------------------------------
Majority Members Vote Minority Members Vote
----------------------------------------------------------------------------------------------------------------
Ms. Foxx........................................ Nay Ms. Slaughter..................... Yea
Mr. Bishop of Utah.............................. Nay Mr. McGovern...................... Yea
Mr. Cole of Oklahoma............................ Nay Mr. Hastings of Florida........... Yea
Mr. Woodall..................................... Nay Mr. Polis......................... Yea
Mr. Nugent...................................... Nay
Mr. Webster..................................... Nay
Ms. Ros-Lehtinen................................ Nay
Mr. Burgess..................................... Nay
Mr. Sessions, Chairman.......................... Nay
----------------------------------------------------------------------------------------------------------------

Rules Committee record vote No. 21

Motion by Mr. Polis to make in order and provide the
appropriate waivers for amendment #31, offered by Rep. Amash
(MI), Rep. Radel (FL), Rep. Broun (GA), Rep. Massie (KY), Rep.
Polis (CO) and Rep. DeSantis (FL), which permits an entity to
provide through enforceable contract that it will not share
personally identifiable information with the federal
government. Defeated: 5-8.

----------------------------------------------------------------------------------------------------------------
Majority Members Vote Minority Members Vote
----------------------------------------------------------------------------------------------------------------
Ms. Foxx........................................ Nay Ms. Slaughter..................... Yea
Mr. Bishop of Utah.............................. Nay Mr. McGovern...................... Yea
Mr. Cole of Oklahoma............................ Nay Mr. Hastings of Florida........... Yea
Mr. Woodall..................................... Yea Mr. Polis......................... Yea
Mr. Nugent...................................... Nay
Mr. Webster..................................... Nay
Ms. Ros-Lehtinen................................ Nay
Mr. Burgess..................................... Nay
Mr. Sessions, Chairman.......................... Nay
----------------------------------------------------------------------------------------------------------------

Rules Committee record vote No. 22

Motion by Mr. Polis to make in order and provide the
appropriate waivers for amendment #20, offered by Rep. Polis
(CO) and Rep. Amash (MI), which limits the federal government's
use of data only for cybersecurity purposes pursuant to the
title and purpose of the bill. The amendment also narrows the
law enforcement exception to only instances of ``imminent''
danger; and amendment #23, offered by Rep. Schakowsky (IL),
Rep. DeGette (CO), Rep. Jackson Lee (TX), Rep. Schiff (CA),
Rep. Polis (CO) and Rep. Thompson (MS), which requires that the
first point of sharing information with the federal government
must be with a civilian agency, ensuring that the U.S. military
or defense agencies do not directly collect or receive cyber
information on American citizens. Defeated: 4-9.

SUMMARY OF THE AMENDMENTS MADE IN ORDER

1. Rogers, Mike (MI): MANAGER'S AMENDMENT. Corrects
reported language concerning a reference in subsection (c)(4)
to the procedures created in (c)(7). (10 minutes)
2. Connolly (VA): Further defines how classified cyber
threat intelligence may be shared and used. Adds an additional
provision stipulating that classified threat intelligence may
only be used, retained, or further disclosed by a certified
entity only for cybersecurity purposes. (10 minutes)
3. Schneider, Bradley (IL): Clarifies that independent
contractors are eligible for security clearances for purposes
of employment to handle cyber threat intelligence and cyber
threat information. (10 minutes)
4. Langevin (RI): Replaces the term ``local'' with
``political subdivision'', which allows the inclusion of
utility ``districts'' that would not otherwise be covered but
that are intended to be covered in the bill. (10 minutes)
5. Conyers (MI), Schakowsky (IL), Jackson Lee (TX),
Johnson, Hank (GA), Holt (NJ): Amends liabilty exemption to
exclude ``decisions made'' from coverage. (10 minutes)
6. Amash (MI), Massie (KY), Polis (CO), Broun (GA):
Prohibits the federal government from using, inter alia,
library records, firearms sales records, and tax returns that
it receives from private entities under CISPA. (10 minutes)
7. Sinema, Kyrsten (AZ): Adds the Inspector General (IG) of
DHS to the omnibus IG reporting requirement. Adds the DHS IG to
rest of the group responsible for submitting an annual report
to Congress. Adds the House Committee on Homeland Security and
the Senate Committee on Homeland Security and Governmental
Affairs to the recipients of the report. (10 minutes)
8. Sanchez, Loretta (CA): Inserts language that would
include the Privacy Officer and the Officer for Civil Rights
and Civil Liberties of the Department of Homeland Security in
issuing a report on assessing the privacy and civil liberties
impact of this bill. (10 minutes)
9. LaMalfa, Doug (CA), Rogers, Mike (MI): Makes clear that
nothing in this bill authorizes the government to target a US
person for surveillance. (10 minutes)
10. Paulsen (MN): Establishes the sense of congress that
international cooperation should be encouraged where possible
in regards to cyber security. (10 minutes)
11. Barton (TX): Clarifies that companies sharing cyber
threat information with other companies cannot treat this
sharing relationship as a loophole to sell a consumer's
personal information for a marketing purpose. (10 minutes)
12. Jackson Lee (TX): Clarifies that cyber security service
providers need only provide information about cyber security
incidents if they pose a threat to the government's information
and protects individuals' private data from being accessed by
the government solely because it is stored by a company that
provides information services to a government agency (10
minutes)

TEXT OF AMENDMENTS MADE IN ORDER

1. An Amendment To Be Offered by Representative Rogers of Michigan or
His Designee, Debatable for 10 Minutes

Page 12, beginning line 15, strike ``unless such information
is used in accordance with the policies and procedures
established under paragraph (7)''.
----------

2. An Amendment To Be Offered by Representative Connolly of Virginia or
His Designee, Debatable for 10 Minutes

Page 2, line 15, strike ``and''.
Page 2, line 18, strike the period and insert ``; and''.
Page 2, after line 18, insert the following:
``(D) used, retained, or further disclosed by
a certified entity for cybersecurity
purposes.''.
----------

3. An Amendment To Be Offered by Representative Schneider of Illinois
or His Designee, Debatable for 10 Minutes

Page 3, beginning on line 2, strike ``employee or officer''
and insert ``employee, independent contractor, or officer''.
----------

4. An Amendment To Be Offered by Representative Langevin of Rhode
Island or His Designee, Debatable for 10 Minutes

Page 8, line 16, strike ``a State, local, or tribal law or
regulation'' and insert ``a law or regulation of a State,
political subdivision of a State, or a tribe''.
----------

5. An Amendment To Be Offered by Representative Conyers Jr. of Michigan
or His Designee, Debatable for 10 Minutes

Page 9, beginning on line 2, strike ``good faith'' and all
that follows through ``for using'' and insert ``good faith, for
using''.
Page 9, line 6, strike ``; or'' and insert a period.
Page 9, strike lines 7 through 10.
----------

6. An Amendment To Be Offered by Representative Amash of Michigan or
His Designee, Debatable for 10 Minutes

Page 12, beginning on line 15, strike ``unless such
information is used in accordance with the policies and
procedures established under paragraph (7)''.
----------

7. An Amendment To Be Offered by Representative Sinema of Arizona or
Her Designee, Debatable for 10 Minutes

Page 17, line 17, insert ``Department of Homeland Security
and the Inspector General of the'' before ``Intelligence
Community''.
Page 17, line 21, insert ``jointly and'' before ``annually''.
Page 17, line 22, strike ``congressional intelligence
committees'' and insert ``the Committee on Homeland Security of
the House of Representatives, the Committee on Homeland
Security and Governmental Affairs of the Senate, and the
congressional intelligence committees''.
----------

8. An Amendment To Be Offered by Representative Sanchez of California
or Her Designee, Debatable for 10 Minutes

Page 18, beginning on line 24, strike ``Director of National
Intelligence and'' and insert ``Director of National
Intelligence,''.
Page 19, line 1, insert ``and the Privacy Officer and the
Officer for Civil Rights and Civil Liberties of the Department
of Homeland,'' after ``Justice,''.
----------

9. An Amendment To Be Offered by Representative LaMalfa of California
or His Designee, Debatable for 10 Minutes

Page 22, after line 7 insert the following:
``(7) Limitation on surveillance.--Nothing in this
section shall be construed to authorize the Department
of Defense or the National Security Agency or any other
element of the intelligence community to target a
United States person for surveillance.
----------

10. An Amendment To Be Offered by Representative Paulsen of Minnesota
or His Designee, Debatable for 10 Minutes

At the end of the bill, add the following new section:

SEC. 4. SENSE OF CONGRESS ON INTERNATIONAL COOPERATION.

It is the sense of Congress that international cooperation
with regard to cybersecurity should be encouraged wherever
possible under this Act and the amendments made by this Act.
----------

11. An Amendment To Be Offered by Representative Barton of Texas or His
Designee, Debatable for 10 Minutes

At the end of the bill, add the following new section:

SEC. 4. RULE OF CONSTRUCTION RELATING TO CONSUMER DATA.

Nothing in this Act or the amendments made by this Act shall
be construed to provide new or alter any existing authority for
an entity to sell personal information of a consumer to another
entity for marketing purposes.
----------

12. An Amendment To Be Offered by Representative Jackson Lee of Texas
or Her Designee, Debatable for 10 Minutes

At the end of the bill, add the following new section:

SEC. 4. SAVINGS CLAUSE WITH REGARD TO CYBERSECURITY PROVIDER OBLIGATION
TO REPORT CYBER THREAT INCIDENT INFORMATION TO
FEDERAL GOVERNMENT.

Nothing in this Act or the amendments made by this Act shall
be construed to provide authority to a department or agency of
the Federal Government to require a cybersecurity provider that
has contracted with the Federal Government to provide
information services to provide information about cybersecurity
incidents that do not pose a threat to the Federal Government's
information.