[House Report 113-41] [From the U.S. Government Publishing Office] 113th Congress Report HOUSE OF REPRESENTATIVES 1st Session 113-41 ====================================================================== PROVIDING FOR CONSIDERATION OF THE BILL (H.R. 624) TO PROVIDE FOR THE SHARING OF CERTAIN CYBER THREAT INTELLIGENCE AND CYBER THREAT INFORMATION BETWEEN THE INTELLIGENCE COMMUNITY AND CYBERSECURITY ENTITIES, AND FOR OTHER PURPOSES _______ April 16, 2013.--Referred to the House Calendar and ordered to be printed _______ Mr. Woodall, from the Committee on Rules, submitted the following R E P O R T [To accompany H. Res. 164] The Committee on Rules, having had under consideration House Resolution 164, by a nonrecord vote, report the same to the House with the recommendation that the resolution be adopted. SUMMARY OF PROVISIONS OF THE RESOLUTION The resolution provides for consideration of H.R. 624, the Cyber Intelligence Sharing and Protection Act, under a structured rule. The resolution provides one hour of general debate equally divided and controlled by the chair and ranking minority member of the Permanent Select Committee on Intelligence. The resolution waives all points of order against consideration of the bill. The resolution makes in order as original text for the purpose of amendment an amendment in the nature of a substitute consisting of the text of Rules Committee Print 113-7 and provides that it shall be considered as read. The resolution waives all points of order against the amendment in the nature of a substitute. The resolution makes in order only those further amendments printed in this report. Each such amendment may be offered only in the order printed in this report, may be offered only by a Member designated in this report, shall be considered as read, shall be debatable for the time specified in this report equally divided and controlled by the proponent and an opponent, shall not be subject to amendment, and shall not be subject to a demand for division of the question in the House or in the Committee of the Whole. The resolution waives all points of order against the amendments printed in this report. The resolution provides one motion to recommit with or without instructions. EXPLANATION OF WAIVERS Although the resolution waives all points of order against consideration of the bill, the Committee is not aware of any points of order. The waiver is prophylactic in nature. Although the resolution waives all points of order against the amendment in the nature of a substitute made in order as original text, the Committee is not aware of any points of order. The waiver is prophylactic in nature. Although the resolution waives all points of order against the amendments printed in this report, the Committee is not aware of any points of order. The waiver is prophylactic in nature. COMMITTEE VOTES The results of each record vote on an amendment or motion to report, together with the names of those voting for and against, are printed below: Rules Committee record vote No. 20 Motion by Ms. Slaughter to make in order and provide the appropriate waivers for amendment #11, offered by Rep. Schiff (CA), Rep. Eshoo (CA), Rep. Holt (NJ), Rep. Schakowsky (IL) and Rep. Thompson (MS), which requires that private entities sharing information with the government or other private entities under the bill make ``reasonable efforts'' to remove Personally Identifiable Information of persons unrelated to the cyber threat. Defeated: 4-9. ---------------------------------------------------------------------------------------------------------------- Majority Members Vote Minority Members Vote ---------------------------------------------------------------------------------------------------------------- Ms. Foxx........................................ Nay Ms. Slaughter..................... Yea Mr. Bishop of Utah.............................. Nay Mr. McGovern...................... Yea Mr. Cole of Oklahoma............................ Nay Mr. Hastings of Florida........... Yea Mr. Woodall..................................... Nay Mr. Polis......................... Yea Mr. Nugent...................................... Nay Mr. Webster..................................... Nay Ms. Ros-Lehtinen................................ Nay Mr. Burgess..................................... Nay Mr. Sessions, Chairman.......................... Nay ---------------------------------------------------------------------------------------------------------------- Rules Committee record vote No. 21 Motion by Mr. Polis to make in order and provide the appropriate waivers for amendment #31, offered by Rep. Amash (MI), Rep. Radel (FL), Rep. Broun (GA), Rep. Massie (KY), Rep. Polis (CO) and Rep. DeSantis (FL), which permits an entity to provide through enforceable contract that it will not share personally identifiable information with the federal government. Defeated: 5-8. ---------------------------------------------------------------------------------------------------------------- Majority Members Vote Minority Members Vote ---------------------------------------------------------------------------------------------------------------- Ms. Foxx........................................ Nay Ms. Slaughter..................... Yea Mr. Bishop of Utah.............................. Nay Mr. McGovern...................... Yea Mr. Cole of Oklahoma............................ Nay Mr. Hastings of Florida........... Yea Mr. Woodall..................................... Yea Mr. Polis......................... Yea Mr. Nugent...................................... Nay Mr. Webster..................................... Nay Ms. Ros-Lehtinen................................ Nay Mr. Burgess..................................... Nay Mr. Sessions, Chairman.......................... Nay ---------------------------------------------------------------------------------------------------------------- Rules Committee record vote No. 22 Motion by Mr. Polis to make in order and provide the appropriate waivers for amendment #20, offered by Rep. Polis (CO) and Rep. Amash (MI), which limits the federal government's use of data only for cybersecurity purposes pursuant to the title and purpose of the bill. The amendment also narrows the law enforcement exception to only instances of ``imminent'' danger; and amendment #23, offered by Rep. Schakowsky (IL), Rep. DeGette (CO), Rep. Jackson Lee (TX), Rep. Schiff (CA), Rep. Polis (CO) and Rep. Thompson (MS), which requires that the first point of sharing information with the federal government must be with a civilian agency, ensuring that the U.S. military or defense agencies do not directly collect or receive cyber information on American citizens. Defeated: 4-9. ---------------------------------------------------------------------------------------------------------------- Majority Members Vote Minority Members Vote ---------------------------------------------------------------------------------------------------------------- Ms. Foxx........................................ Nay Ms. Slaughter..................... Yea Mr. Bishop of Utah.............................. Nay Mr. McGovern...................... Yea Mr. Cole of Oklahoma............................ Nay Mr. Hastings of Florida........... Yea Mr. Woodall..................................... Nay Mr. Polis......................... Yea Mr. Nugent...................................... Nay Mr. Webster..................................... Nay Ms. Ros-Lehtinen................................ Nay Mr. Burgess..................................... Nay Mr. Sessions, Chairman.......................... Nay ---------------------------------------------------------------------------------------------------------------- SUMMARY OF THE AMENDMENTS MADE IN ORDER 1. Rogers, Mike (MI): MANAGER'S AMENDMENT. Corrects reported language concerning a reference in subsection (c)(4) to the procedures created in (c)(7). (10 minutes) 2. Connolly (VA): Further defines how classified cyber threat intelligence may be shared and used. Adds an additional provision stipulating that classified threat intelligence may only be used, retained, or further disclosed by a certified entity only for cybersecurity purposes. (10 minutes) 3. Schneider, Bradley (IL): Clarifies that independent contractors are eligible for security clearances for purposes of employment to handle cyber threat intelligence and cyber threat information. (10 minutes) 4. Langevin (RI): Replaces the term ``local'' with ``political subdivision'', which allows the inclusion of utility ``districts'' that would not otherwise be covered but that are intended to be covered in the bill. (10 minutes) 5. Conyers (MI), Schakowsky (IL), Jackson Lee (TX), Johnson, Hank (GA), Holt (NJ): Amends liabilty exemption to exclude ``decisions made'' from coverage. (10 minutes) 6. Amash (MI), Massie (KY), Polis (CO), Broun (GA): Prohibits the federal government from using, inter alia, library records, firearms sales records, and tax returns that it receives from private entities under CISPA. (10 minutes) 7. Sinema, Kyrsten (AZ): Adds the Inspector General (IG) of DHS to the omnibus IG reporting requirement. Adds the DHS IG to rest of the group responsible for submitting an annual report to Congress. Adds the House Committee on Homeland Security and the Senate Committee on Homeland Security and Governmental Affairs to the recipients of the report. (10 minutes) 8. Sanchez, Loretta (CA): Inserts language that would include the Privacy Officer and the Officer for Civil Rights and Civil Liberties of the Department of Homeland Security in issuing a report on assessing the privacy and civil liberties impact of this bill. (10 minutes) 9. LaMalfa, Doug (CA), Rogers, Mike (MI): Makes clear that nothing in this bill authorizes the government to target a US person for surveillance. (10 minutes) 10. Paulsen (MN): Establishes the sense of congress that international cooperation should be encouraged where possible in regards to cyber security. (10 minutes) 11. Barton (TX): Clarifies that companies sharing cyber threat information with other companies cannot treat this sharing relationship as a loophole to sell a consumer's personal information for a marketing purpose. (10 minutes) 12. Jackson Lee (TX): Clarifies that cyber security service providers need only provide information about cyber security incidents if they pose a threat to the government's information and protects individuals' private data from being accessed by the government solely because it is stored by a company that provides information services to a government agency (10 minutes) TEXT OF AMENDMENTS MADE IN ORDER 1. An Amendment To Be Offered by Representative Rogers of Michigan or His Designee, Debatable for 10 Minutes Page 12, beginning line 15, strike ``unless such information is used in accordance with the policies and procedures established under paragraph (7)''. ---------- 2. An Amendment To Be Offered by Representative Connolly of Virginia or His Designee, Debatable for 10 Minutes Page 2, line 15, strike ``and''. Page 2, line 18, strike the period and insert ``; and''. Page 2, after line 18, insert the following: ``(D) used, retained, or further disclosed by a certified entity for cybersecurity purposes.''. ---------- 3. An Amendment To Be Offered by Representative Schneider of Illinois or His Designee, Debatable for 10 Minutes Page 3, beginning on line 2, strike ``employee or officer'' and insert ``employee, independent contractor, or officer''. ---------- 4. An Amendment To Be Offered by Representative Langevin of Rhode Island or His Designee, Debatable for 10 Minutes Page 8, line 16, strike ``a State, local, or tribal law or regulation'' and insert ``a law or regulation of a State, political subdivision of a State, or a tribe''. ---------- 5. An Amendment To Be Offered by Representative Conyers Jr. of Michigan or His Designee, Debatable for 10 Minutes Page 9, beginning on line 2, strike ``good faith'' and all that follows through ``for using'' and insert ``good faith, for using''. Page 9, line 6, strike ``; or'' and insert a period. Page 9, strike lines 7 through 10. ---------- 6. An Amendment To Be Offered by Representative Amash of Michigan or His Designee, Debatable for 10 Minutes Page 12, beginning on line 15, strike ``unless such information is used in accordance with the policies and procedures established under paragraph (7)''. ---------- 7. An Amendment To Be Offered by Representative Sinema of Arizona or Her Designee, Debatable for 10 Minutes Page 17, line 17, insert ``Department of Homeland Security and the Inspector General of the'' before ``Intelligence Community''. Page 17, line 21, insert ``jointly and'' before ``annually''. Page 17, line 22, strike ``congressional intelligence committees'' and insert ``the Committee on Homeland Security of the House of Representatives, the Committee on Homeland Security and Governmental Affairs of the Senate, and the congressional intelligence committees''. ---------- 8. An Amendment To Be Offered by Representative Sanchez of California or Her Designee, Debatable for 10 Minutes Page 18, beginning on line 24, strike ``Director of National Intelligence and'' and insert ``Director of National Intelligence,''. Page 19, line 1, insert ``and the Privacy Officer and the Officer for Civil Rights and Civil Liberties of the Department of Homeland,'' after ``Justice,''. ---------- 9. An Amendment To Be Offered by Representative LaMalfa of California or His Designee, Debatable for 10 Minutes Page 22, after line 7 insert the following: ``(7) Limitation on surveillance.--Nothing in this section shall be construed to authorize the Department of Defense or the National Security Agency or any other element of the intelligence community to target a United States person for surveillance. ---------- 10. An Amendment To Be Offered by Representative Paulsen of Minnesota or His Designee, Debatable for 10 Minutes At the end of the bill, add the following new section: SEC. 4. SENSE OF CONGRESS ON INTERNATIONAL COOPERATION. It is the sense of Congress that international cooperation with regard to cybersecurity should be encouraged wherever possible under this Act and the amendments made by this Act. ---------- 11. An Amendment To Be Offered by Representative Barton of Texas or His Designee, Debatable for 10 Minutes At the end of the bill, add the following new section: SEC. 4. RULE OF CONSTRUCTION RELATING TO CONSUMER DATA. Nothing in this Act or the amendments made by this Act shall be construed to provide new or alter any existing authority for an entity to sell personal information of a consumer to another entity for marketing purposes. ---------- 12. An Amendment To Be Offered by Representative Jackson Lee of Texas or Her Designee, Debatable for 10 Minutes At the end of the bill, add the following new section: SEC. 4. SAVINGS CLAUSE WITH REGARD TO CYBERSECURITY PROVIDER OBLIGATION TO REPORT CYBER THREAT INCIDENT INFORMATION TO FEDERAL GOVERNMENT. Nothing in this Act or the amendments made by this Act shall be construed to provide authority to a department or agency of the Federal Government to require a cybersecurity provider that has contracted with the Federal Government to provide information services to provide information about cybersecurity incidents that do not pose a threat to the Federal Government's information.