Cyber Diplomacy Act of 2019

I 116TH CONGRESS 1ST SESSION H. R. 739 To support United States international cyber diplomacy, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JANUARY 24, 2019 Mr. MCCAUL (for himself and Mr. ENGEL) introduced the following bill; which was referred to the Committee on Foreign Affairs A BILL To support United States international cyber diplomacy, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 3 (a) SHORT TITLE.—This Act may be cited as the 4 ‘‘Cyber Diplomacy Act of 2019’’. 5 (b) TABLE OF CONTENTS.—The table of contents for 6 this Act is as follows: 7 Sec. 1. Short title; table of contents. Sec. 2. Findings. Sec. 3. Definitions. Sec. 4. United States International Cyberspace Policy. Sec. 5. Department of State responsibilities. Sec. 6. International cyberspace executive arrangements. Sec. 7. International strategy for cyberspace. VerDate Sep 11 2014 22:02 Feb 02, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6211 E:\BILLS\H739.IH H739 pbinns on DSK79D2C42PROD with BILLS 2 •HR 739 IH Sec. 8. Annual country reports on human rights practices. Sec. 9. GAO report on cyber threats and data misuse. Sec. 10. Sense of Congress on cybersecurity sanctions against North Korea and cybersecurity legislation in Vietnam. Sec. 11. Rule of construction. SEC. 2. FINDINGS. 1 Congress makes the following findings: 2 (1) The stated goal of the United States Inter- 3 national Strategy for Cyberspace, launched on May 4 16, 2011, is to ‘‘work internationally to promote an 5 open, interoperable, secure, and reliable information 6 and communications infrastructure that supports 7 international trade and commerce, strengthens inter- 8 national security, and fosters free expression and in- 9 novation . . . in which norms of responsible behav- 10 ior guide states’ actions, sustain partnerships, and 11 support the rule of law in cyberspace’’. 12 (2) In its June 24, 2013 report, the Group of 13 Governmental Experts on Developments in the Field 14 of Information and Telecommunications in the Con- 15 text of International Security (referred to in this 16 section as ‘‘GGE’’), established by the United Na- 17 tions General Assembly, concluded that ‘‘State sov- 18 ereignty and the international norms and principles 19 that flow from it apply to States’ conduct of [infor- 20 mation and communications technology] ICT-related 21 activities and to their jurisdiction over ICT infra- 22 structure with their territory’’. 23 VerDate Sep 11 2014 22:02 Feb 02, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H739.IH H739 pbinns on DSK79D2C42PROD with BILLS 3 •HR 739 IH (3) In January 2015, China, Kazakhstan, 1 Kyrgyzstan, Russia, Tajikistan, and Uzbekistan pro- 2 posed a troubling international code of conduct for 3 information security, which could be used as a pre- 4 text for restricting political dissent, and includes 5 ‘‘curbing the dissemination of information that in- 6 cites terrorism, separatism or extremism or that in- 7 flames hatred on ethnic, racial or religious grounds’’. 8 (4) In its July 22, 2015 consensus report, GGE 9 found that ‘‘norms of responsible State behavior can 10 reduce risks to international peace, security and sta- 11 bility’’. 12 (5) On September 25, 2015, the United States 13 and China announced a commitment that neither 14 country’s government ‘‘will conduct or knowingly 15 support cyber-enabled theft of intellectual property, 16 including trade secrets or other confidential business 17 information, with the intent of providing competitive 18 advantages to companies or commercial sectors’’. 19 (6) At the Antalya Summit on November 15 20 and 16, 2015, the Group of 20 Leaders’ 21 communique´— 22 (A) affirmed the applicability of inter- 23 national law to state behavior in cyberspace; 24 VerDate Sep 11 2014 22:02 Feb 02, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H739.IH H739 pbinns on DSK79D2C42PROD with BILLS 4 •HR 739 IH (B) called on states to refrain from cyber- 1 enabled theft of intellectual property for com- 2 mercial gain; and 3 (C) endorsed the view that all states 4 should abide by norms of responsible behavior. 5 (7) The March 2016 Department of State 6 International Cyberspace Policy Strategy noted that 7 ‘‘the Department of State anticipates a continued in- 8 crease and expansion of our cyber-focused diplomatic 9 efforts for the foreseeable future’’. 10 (8) On December 1, 2016, the Commission on 11 Enhancing National Cybersecurity, which was estab- 12 lished within the Department of Commerce by Exec- 13 utive Order 13718 (81 Fed. Reg. 7441), rec- 14 ommended that ‘‘the President should appoint an 15 Ambassador for Cybersecurity to lead U.S. engage- 16 ment with the international community on cyberse- 17 curity strategies, standards, and practices’’. 18 (9) On April 11, 2017, the 2017 Group of 7 19 Declaration on Responsible States Behavior in 20 Cyberspace— 21 (A) recognized ‘‘the urgent necessity of in- 22 creased international cooperation to promote se- 23 curity and stability in cyberspace’’; 24 VerDate Sep 11 2014 22:02 Feb 02, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H739.IH H739 pbinns on DSK79D2C42PROD with BILLS 5 •HR 739 IH (B) expressed commitment to ‘‘promoting 1 a strategic framework for conflict prevention, 2 cooperation and stability in cyberspace, con- 3 sisting of the recognition of the applicability of 4 existing international law to State behavior in 5 cyberspace, the promotion of voluntary, non- 6 binding norms of responsible State behavior 7 during peacetime, and the development and the 8 implementation of practical cyber confidence 9 building measures (CBMs) between States’’; 10 and 11 (C) reaffirmed that ‘‘the same rights that 12 people have offline must also be protected on- 13 line’’. 14 (10) In testimony before the Select Committee 15 on Intelligence of the Senate on May 11, 2017, Di- 16 rector of National Intelligence Daniel R. Coats iden- 17 tified 6 cyber threat actors, including— 18 (A) Russia, for ‘‘efforts to influence the 19 2016 US election’’; 20 (B) China, for ‘‘actively targeting the US 21 Government, its allies, and US companies for 22 cyber espionage’’; 23 (C) Iran, for ‘‘leverag[ing] cyber espionage, 24 propaganda, and attacks to support its security 25 VerDate Sep 11 2014 22:02 Feb 02, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H739.IH H739 pbinns on DSK79D2C42PROD with BILLS 6 •HR 739 IH priorities, influence events and foreign percep- 1 tions, and counter threats’’; 2 (D) North Korea, for ‘‘previously 3 conduct[ing] cyber-attacks against US commer- 4 cial entities—specifically, Sony Pictures Enter- 5 tainment in 2014’’; 6 (E) terrorists, who ‘‘use the Internet to or- 7 ganize, recruit, spread propaganda, raise funds, 8 collect intelligence, inspire action by followers, 9 and coordinate operations’’; and 10 (F) criminals, who ‘‘are also developing 11 and using sophisticated cyber tools for a variety 12 of purposes including theft, extortion, and fa- 13 cilitation of other criminal activities’’. 14 (11) On May 11, 2017, President Donald J. 15 Trump issued Executive Order 13800 (82 Fed. Reg. 16 22391), entitled ‘‘Strengthening the Cybersecurity of 17 Federal Networks and Infrastructure’’, which— 18 (A) designates the Secretary of State to 19 lead an interagency effort to develop an engage- 20 ment strategy for international cooperation in 21 cybersecurity; and 22 (B) notes that ‘‘the United States is espe- 23 cially dependent on a globally secure and resil- 24 ient internet and must work with allies and 25 VerDate Sep 11 2014 22:02 Feb 02, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H739.IH H739 pbinns on DSK79D2C42PROD with BILLS 7 •HR 739 IH other partners toward maintaining . . . the pol- 1 icy of the executive branch to promote an open, 2 interoperable, reliable, and secure internet that 3 fosters efficiency, innovation, communication, 4 and economic prosperity, while respecting pri- 5 vacy and guarding against disruption, fraud, 6 and theft’’. 7 SEC. 3. DEFINITIONS. 8 In this Act: 9 (1) APPROPRIATE CONGRESSIONAL COMMIT- 10 TEES.—The term ‘‘appropriate congressional com- 11 mittees’’ means the Committee on Foreign Relations 12 of the Senate and the Committee on Foreign Affairs 13 of the House of Representatives. 14 (2) INFORMATION AND COMMUNICATIONS 15 TECHNOLOGY; ICT.—The terms ‘‘information and 16 communications technology’’ and ‘‘ICT’’ include 17 hardware, software, and other products or services 18 primarily intended to fulfill or enable the function of 19 information processing and communication by elec- 20 tronic means, including transmission and display, in- 21 cluding via the Internet. 22 (3) EXECUTIVE AGENCY.—The term ‘‘Executive 23 agency’’ has the meaning given the term in section 24 105 of title 5, United States Code. 25 VerDate Sep 11 2014 22:02 Feb 02, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H739.IH H739 pbinns on DSK79D2C42PROD with BILLS 8 •HR 739 IH SEC. 4. UNITED STATES INTERNATIONAL CYBERSPACE 1 POLICY. 2 (a) IN GENERAL.—It is the policy of the United 3 States to work internationally to promote an open, inter- 4 operable, reliable, unfettered, and secure Internet gov- 5 erned by the multi-stakeholder model, which— 6 (1) promotes human rights, democracy, and 7 rule of law, including freedom of expression, innova- 8 tion, communication, and economic prosperity; and 9 (2) respects privacy and guards against decep- 10 tion, fraud, and theft. 11 (b) IMPLEMENTATION.—In implementing the policy 12 described in subsection (a), the President, in consultation 13 with outside actors, including private sector companies, 14 nongovernmental organizations, security researchers, and 15 other relevant stakeholders, in the conduct of bilateral and 16 multilateral relations, shall pursue the following objectives: 17 (1) Clarifying the applicability of international 18 laws and norms to the use of ICT. 19 (2) Reducing and limiting the risk of escalation 20 and retaliation in cyberspace, damage to critical in- 21 frastructure, and other malicious cyber activity that 22 impairs the use and operation of critical infrastruc- 23 ture that provides services to the public. 24 (3) Cooperating with like-minded democratic 25 countries that share common values and cyberspace 26 VerDate Sep 11 2014 22:02 Feb 02, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H739.IH H739 pbinns on DSK79D2C42PROD with BILLS 9 •HR 739 IH policies with the United States, including respect for 1 human rights, democracy, and the rule of law, to ad- 2 vance such values and policies internationally. 3 (4) Encouraging the responsible development of 4 new, innovative technologies and ICT products that 5 strengthen a secure Internet architecture that is ac- 6 cessible to all. 7 (5) Securing and implementing commitments 8 on responsible country behavior in cyberspace based 9 upon accepted norms, including the following: 10 (A) Countries should not conduct, or 11 knowingly support, cyber-enabled theft of intel- 12 lectual property, including trade secrets or 13 other confidential business information, with 14 the intent of providing competitive advantages 15 to companies or commercial sectors. 16 (B) Countries should take all appropriate 17 and reasonable efforts to keep their territories 18 clear of intentionally wrongful acts using ICTs 19 in violation of international commitments. 20 (C) Countries should not conduct or know- 21 ingly support ICT activity that, contrary to 22 international law, intentionally damages or oth- 23 erwise impairs the use and operation of critical 24 infrastructure providing services to the public, 25 VerDate Sep 11 2014 22:02 Feb 02, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H739.IH H739 pbinns on DSK79D2C42PROD with BILLS 10 •HR 739 IH and should take appropriate measures to pro- 1 tect their critical infrastructure from ICT 2 threats. 3 (D) Countries should not conduct or know- 4 ingly support malicious international activity 5 that, contrary to international law, harms the 6 information systems of authorized emergency 7 response teams (also known as ‘‘computer 8 emergency response teams’’ or ‘‘cybersecurity 9 incident response teams’’) of another country or 10 authorize emergency response teams to engage 11 in malicious international activity. 12 (E) Countries should respond to appro- 13 priate requests for assistance to mitigate mali- 14 cious ICT activity emanating from their terri- 15 tory and aimed at the critical infrastructure of 16 another country. 17 (F) Countries should not restrict cross-bor- 18 der data flows or require local storage or proc- 19 essing of data. 20 (G) Countries should protect the exercise 21 of human rights and fundamental freedoms on 22 the Internet and commit to the principle that 23 the human rights that people have offline 24 should also be protected online. 25 VerDate Sep 11 2014 22:02 Feb 02, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H739.IH H739 pbinns on DSK79D2C42PROD with BILLS 11 •HR 739 IH (6) Advancing, encouraging, and supporting the 1 development and adoption of internationally recog- 2 nized technical standards and best practices. 3 SEC. 5. DEPARTMENT OF STATE RESPONSIBILITIES. 4 (a) IN GENERAL.—Section 1 of the State Depart- 5 ment Basic Authorities Act of 1956 (22 U.S.C. 2651a) 6 is amended— 7 (1) by redesignating subsection (g) as sub- 8 section (h); and 9 (2) by inserting after subsection (f) the fol- 10 lowing: 11 ‘‘(g) OFFICE OF INTERNATIONAL CYBERSPACE POL- 12 ICY.— 13 ‘‘(1) IN GENERAL.—There is established, within 14 the Department of State, an Office of International 15 Cyberspace Policy (referred to in this subsection as 16 the ‘Office’). The head of the Office shall have the 17 rank and status of ambassador and shall be ap- 18 pointed by the President, by and with the advice and 19 consent of the Senate. 20 ‘‘(2) DUTIES.— 21 ‘‘(A) IN GENERAL.—The head of the Of- 22 fice shall perform such duties and exercise such 23 powers as the Secretary of State shall prescribe, 24 including implementing the policy of the United 25 VerDate Sep 11 2014 22:02 Feb 02, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H739.IH H739 pbinns on DSK79D2C42PROD with BILLS 12 •HR 739 IH States described in section 4 of the Cyber Di- 1 plomacy Act of 2019. 2 ‘‘(B) DUTIES DESCRIBED.—The principal 3 duties and responsibilities of the head of the 4 Office shall be— 5 ‘‘(i) to serve as the principal cyber- 6 space policy official within the senior man- 7 agement of the Department of [Text truncated for display. Full text available on Congress.gov.]