Cyber Diplomacy Act of 2021

IIB 117TH CONGRESS 1ST SESSION H. R. 1251 IN THE SENATE OF THE UNITED STATES APRIL 22, 2021 Received; read twice and referred to the Committee on Foreign Relations AN ACT To support United States international cyber diplomacy, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 17:55 Apr 23, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H1251.RFS H1251 pamtmann on DSKBC07HB2PROD with BILLS 2 HR 1251 RFS SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 1 (a) SHORT TITLE.—This Act may be cited as the 2 ‘‘Cyber Diplomacy Act of 2021’’. 3 (b) TABLE OF CONTENTS.—The table of contents for 4 this Act is as follows: 5 Sec. 1. Short title; table of contents. Sec. 2. Findings. Sec. 3. Definitions. Sec. 4. United states international cyberspace policy. Sec. 5. Department of state responsibilities. Sec. 6. International cyberspace executive arrangements. Sec. 7. International strategy for cyberspace. Sec. 8. Annual country reports on human rights practices. Sec. 9. Gao report on cyber diplomacy. Sec. 10. Sense of congress on cybersecurity sanctions against north korea and cybersecurity legislation in vietnam. SEC. 2. FINDINGS. 6 Congress makes the following findings: 7 (1) The stated goal of the United States Inter- 8 national Strategy for Cyberspace, launched on May 9 16, 2011, is to ‘‘work internationally to promote an 10 open, interoperable, secure, and reliable information 11 and communications infrastructure that supports 12 international trade and commerce, strengthens inter- 13 national security, and fosters free expression and in- 14 novation * * * in which norms of responsible behav- 15 ior guide states’ actions, sustain partnerships, and 16 support the rule of law in cyberspace’’. 17 (2) In its June 24, 2013, report, the Group of 18 Governmental Experts on Developments in the Field 19 of Information and Telecommunications in the Con- 20 VerDate Sep 11 2014 17:55 Apr 23, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H1251.RFS H1251 pamtmann on DSKBC07HB2PROD with BILLS 3 HR 1251 RFS text of International Security (referred to in this 1 section as ‘‘GGE’’), established by the United Na- 2 tions General Assembly, concluded that ‘‘State sov- 3 ereignty and the international norms and principles 4 that flow from it apply to States’ conduct of [infor- 5 mation and communications technology] ICT-related 6 activities and to their jurisdiction over ICT infra- 7 structure with their territory’’. 8 (3) In January 2015, China, Kazakhstan, 9 Kyrgyzstan, Russia, Tajikistan, and Uzbekistan pro- 10 posed a troubling international code of conduct for 11 information security, which could be used as a pre- 12 text for restricting political dissent, and includes 13 ‘‘curbing the dissemination of information that in- 14 cites terrorism, separatism or extremism or that in- 15 flames hatred on ethnic, racial or religious grounds’’. 16 (4) In its July 22, 2015, consensus report, 17 GGE found that ‘‘norms of responsible State behav- 18 ior can reduce risks to international peace, security 19 and stability’’. 20 (5) On September 25, 2015, the United States 21 and China announced a commitment that neither 22 country’s government ‘‘will conduct or knowingly 23 support cyber-enabled theft of intellectual property, 24 including trade secrets or other confidential business 25 VerDate Sep 11 2014 17:55 Apr 23, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H1251.RFS H1251 pamtmann on DSKBC07HB2PROD with BILLS 4 HR 1251 RFS information, with the intent of providing competitive 1 advantages to companies or commercial sectors’’. 2 (6) At the Antalya Summit on November 15 3 and 16, 2015, the Group of 20 Leaders’ 4 communique´— 5 (A) affirmed the applicability of inter- 6 national law to state behavior in cyberspace; 7 (B) called on states to refrain from cyber- 8 enabled theft of intellectual property for com- 9 mercial gain; and 10 (C) endorsed the view that all states 11 should abide by norms of responsible behavior. 12 (7) The March 2016 Department of State 13 International Cyberspace Policy Strategy noted that 14 ‘‘the Department of State anticipates a continued in- 15 crease and expansion of our cyber-focused diplomatic 16 efforts for the foreseeable future’’. 17 (8) On December 1, 2016, the Commission on 18 Enhancing National Cybersecurity, which was estab- 19 lished within the Department of Commerce by Exec- 20 utive Order No. 13718 (81 Fed. Reg. 7441), rec- 21 ommended that ‘‘the President should appoint an 22 Ambassador for Cybersecurity to lead U.S. engage- 23 ment with the international community on cyberse- 24 curity strategies, standards, and practices’’. 25 VerDate Sep 11 2014 17:55 Apr 23, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H1251.RFS H1251 pamtmann on DSKBC07HB2PROD with BILLS 5 HR 1251 RFS (9) On April 11, 2017, the 2017 Group of 7 1 Declaration on Responsible States Behavior in 2 Cyberspace— 3 (A) recognized ‘‘the urgent necessity of in- 4 creased international cooperation to promote se- 5 curity and stability in cyberspace’’; 6 (B) expressed commitment to ‘‘promoting 7 a strategic framework for conflict prevention, 8 cooperation and stability in cyberspace, con- 9 sisting of the recognition of the applicability of 10 existing international law to State behavior in 11 cyberspace, the promotion of voluntary, non- 12 binding norms of responsible State behavior 13 during peacetime, and the development and the 14 implementation of practical cyber confidence 15 building measures (CBMs) between States’’; 16 and 17 (C) reaffirmed that ‘‘the same rights that 18 people have offline must also be protected on- 19 line’’. 20 (10) In testimony before the Select Committee 21 on Intelligence of the Senate on May 11, 2017, Di- 22 rector of National Intelligence Daniel R. Coats iden- 23 tified six cyber threat actors, including— 24 VerDate Sep 11 2014 17:55 Apr 23, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H1251.RFS H1251 pamtmann on DSKBC07HB2PROD with BILLS 6 HR 1251 RFS (A) Russia, for ‘‘efforts to influence the 1 2016 U.S. election’’; 2 (B) China, for ‘‘actively targeting the U.S. 3 Government, its allies, and U.S. companies for 4 cyber espionage’’; 5 (C) Iran, for ‘‘leverag[ing] cyber espionage, 6 propaganda, and attacks to support its security 7 priorities, influence events and foreign percep- 8 tions, and counter threats’’; 9 (D) North Korea, for ‘‘previously 10 conduct[ing] cyber-attacks against U.S. com- 11 mercial entities—specifically, Sony Pictures En- 12 tertainment in 2014’’; 13 (E) terrorists, who ‘‘use the Internet to or- 14 ganize, recruit, spread propaganda, raise funds, 15 collect intelligence, inspire action by followers, 16 and coordinate operations’’; and 17 (F) criminals, who ‘‘are also developing 18 and using sophisticated cyber tools for a variety 19 of purposes including theft, extortion, and fa- 20 cilitation of other criminal activities’’. 21 (11) On May 11, 2017, President Donald J. 22 Trump issued Executive Order No. 13800 (82 Fed. 23 Reg. 22391), entitled ‘‘Strengthening the Cybersecu- 24 VerDate Sep 11 2014 17:55 Apr 23, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H1251.RFS H1251 pamtmann on DSKBC07HB2PROD with BILLS 7 HR 1251 RFS rity of Federal Networks and Infrastructure’’, 1 which— 2 (A) designates the Secretary of State to 3 lead an interagency effort to develop an engage- 4 ment strategy for international cooperation in 5 cybersecurity; and 6 (B) notes that ‘‘the United States is espe- 7 cially dependent on a globally secure and resil- 8 ient internet and must work with allies and 9 other partners toward maintaining * * * the 10 policy of the executive branch to promote an 11 open, interoperable, reliable, and secure internet 12 that fosters efficiency, innovation, communica- 13 tion, and economic prosperity, while respecting 14 privacy and guarding against disruption, fraud, 15 and theft’’. 16 SEC. 3. DEFINITIONS. 17 In this Act: 18 (1) APPROPRIATE CONGRESSIONAL COMMIT- 19 TEES.—The term ‘‘appropriate congressional com- 20 mittees’’ means the Committee on Foreign Relations 21 of the Senate and the Committee on Foreign Affairs 22 of the House of Representatives. 23 (2) INFORMATION AND COMMUNICATIONS 24 TECHNOLOGY; ICT.—The terms ‘‘information and 25 VerDate Sep 11 2014 17:55 Apr 23, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H1251.RFS H1251 pamtmann on DSKBC07HB2PROD with BILLS 8 HR 1251 RFS communications technology’’ and ‘‘ICT’’ include 1 hardware, software, and other products or services 2 primarily intended to fulfill or enable the function of 3 information processing and communication by elec- 4 tronic means, including transmission and display, in- 5 cluding via the Internet. 6 (3) EXECUTIVE AGENCY.—The term ‘‘Executive 7 agency’’ has the meaning given the term in section 8 105 of title 5, United States Code. 9 SEC. 4. UNITED STATES INTERNATIONAL CYBERSPACE 10 POLICY. 11 (a) IN GENERAL.—It is the policy of the United 12 States to work internationally to promote an open, inter- 13 operable, reliable, unfettered, and secure Internet gov- 14 erned by the multi-stakeholder model, which— 15 (1) promotes human rights, democracy, and 16 rule of law, including freedom of expression, innova- 17 tion, communication, and economic prosperity; and 18 (2) respects privacy and guards against decep- 19 tion, fraud, and theft. 20 (b) IMPLEMENTATION.—In implementing the policy 21 described in subsection (a), the President, in consultation 22 with outside actors, including private sector companies, 23 nongovernmental organizations, security researchers, and 24 VerDate Sep 11 2014 17:55 Apr 23, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H1251.RFS H1251 pamtmann on DSKBC07HB2PROD with BILLS 9 HR 1251 RFS other relevant stakeholders, in the conduct of bilateral and 1 multilateral relations, shall pursue the following objectives: 2 (1) Clarifying the applicability of international 3 laws and norms to the use of ICT. 4 (2) Reducing and limiting the risk of escalation 5 and retaliation in cyberspace, damage to critical in- 6 frastructure, and other malicious cyber activity that 7 impairs the use and operation of critical infrastruc- 8 ture that provides services to the public. 9 (3) Cooperating with like-minded democratic 10 countries that share common values and cyberspace 11 policies with the United States, including respect for 12 human rights, democracy, and the rule of law, to ad- 13 vance such values and policies internationally. 14 (4) Encouraging the responsible development of 15 new, innovative technologies and ICT products that 16 strengthen a secure Internet architecture that is ac- 17 cessible to all. 18 (5) Securing and implementing commitments 19 on responsible country behavior in cyberspace based 20 upon accepted norms, including the following: 21 (A) Countries should not conduct, or 22 knowingly support, cyber-enabled theft of intel- 23 lectual property, including trade secrets or 24 other confidential business information, with 25 VerDate Sep 11 2014 17:55 Apr 23, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H1251.RFS H1251 pamtmann on DSKBC07HB2PROD with BILLS 10 HR 1251 RFS the intent of providing competitive advantages 1 to companies or commercial sectors. 2 (B) Countries should take all appropriate 3 and reasonable efforts to keep their territories 4 clear of intentionally wrongful acts using ICTs 5 in violation of international commitments. 6 (C) Countries should not conduct or know- 7 ingly support ICT activity that, contrary to 8 international law, intentionally damages or oth- 9 erwise impairs the use and operation of critical 10 infrastructure providing services to the public, 11 and should take appropriate measures to pro- 12 tect their critical infrastructure from ICT 13 threats. 14 (D) Countries should not conduct or know- 15 ingly support malicious international activity 16 that, contrary to international law, harms the 17 information systems of authorized emergency 18 response teams (also known as ‘‘computer 19 emergency response teams’’ or ‘‘cybersecurity 20 incident response teams’’) of another country or 21 authorize emergency response teams to engage 22 in malicious international activity. 23 (E) Countries should respond to appro- 24 priate requests for assistance to mitigate mali- 25 VerDate Sep 11 2014 17:55 Apr 23, 2021 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H1251.RFS H1251 pamtmann on DSKBC07HB2PROD with BILLS 11 HR 1251 RFS cious ICT activity emanating from their terri- 1 tory and aimed at the critical infrastructure of 2 another country. 3 (F) Countries should not restrict cross-bor- 4 der data flows or require local storage or proc- 5 essing of data. 6 (G) Countries should protect the exercise 7 of human rights and fundamental freedoms on 8 the Internet and commit to the principle that 9 the human rights that people have offline 10 should also be protected online. 11 (6) Advancing, encouraging, and supporting the 12 development and adoption of internationally recog- 13 nized technical standards and best practices. 14 SEC. 5. DEPARTMENT OF STATE RESPONSIBILITIES. 15 (a) IN GENERAL.—Section 1 of the State Depart- 16 ment Basic Authorities Act of 1956 (22 U.S.C. 2651a) 17 is amended— 18 (1) by redesignating subsection (g) as sub- 19 section (h); and 20 (2) by inserting after subsection (f) the fol- 21 lowing new subsection: 22 ‘‘(g) BUREAU OF INTERNATIONAL CYBERSPACE POL- 23 ICY.— 24 VerDate Sep 11 2014 17:55 Apr 23, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H1251.RFS H1251 pamtmann on DSKBC07HB2PROD with BILLS 12 HR 1251 RFS ‘‘(1) IN GENERAL.—There is established, within 1 the Department of State, a Bureau of International 2 Cyberspace Policy (referred to in this subsection as 3 the ‘Bureau’). The head of the Bureau shall have 4 the rank and status of ambassador and shall be ap- 5 pointed by the President, by and with the advice and 6 consent of the Senate. 7 ‘‘(2) DUTIES.— 8 ‘‘(A) IN GENERAL.—The head of the Bu- 9 reau shall perform such duties and exercise 10 such powers as the Secretary of State shall pre- 11 scribe, including implementing the policy of the 12 United States described in section 4 of the 13 Cyber Diplomacy Act of 2021. 14 ‘‘(B) DUTIES DESCRIBED.—The principal 15 duties and responsibilities of the head of the 16 Bureau shall be— 17 ‘‘(i) to serve as the principal cyber- 18 space policy official within the senior man- 19 agement of the Department of State and 20 as the advisor to the Secretary of State for 21 cyberspac [Text truncated for display. Full text available on Congress.gov.]