II 116TH CONGRESS 1ST SESSION S. 429 To require the establishment of exchange programs relating to cybersecurity positions between the private sector and certain Federal agencies, and for other purposes. IN THE SENATE OF THE UNITED STATES FEBRUARY 7, 2019 Ms. KLOBUCHAR (for herself and Mr. THUNE) introduced the following bill; which was read twice and referred to the Committee on Homeland Secu- rity and Governmental Affairs A BILL To require the establishment of exchange programs relating to cybersecurity positions between the private sector and certain Federal agencies, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Cyber Security Ex- 4 change Act’’. 5 SEC. 2. CYBERSECURITY PROFESSIONAL EXCHANGE PRO- 6 GRAMS. 7 (a) ESTABLISHMENT OF PROGRAMS.— 8 (1) REPORTS TO CONGRESS.— 9 VerDate Sep 11 2014 22:16 Feb 19, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S429.IS S429 kjohnson on DSK79L0C42 with BILLS 2 •S 429 IS (A) IN GENERAL.—Not later than 180 1 days after the date of enactment of this Act, 2 the Director of National Intelligence, the Sec- 3 retary of Defense, the Secretary of Homeland 4 Security, the Secretary of Energy, and the At- 5 torney General shall each submit to the appro- 6 priate committees of Congress with respect to 7 that agency head a report that contains— 8 (i) a plan and timeline for imple- 9 menting the program described in para- 10 graph (2) at the agency (or, in the case of 11 the Director of National Intelligence, at an 12 element of the intelligence community); 13 and 14 (ii) an evaluation of the benefits to 15 the agency (or, in the case of the Director 16 of National Intelligence, to an element of 17 the intelligence community) from the es- 18 tablishment of the program described in 19 paragraph (2). 20 (B) INABILITY TO ESTABLISH PROGRAM.— 21 If an agency head described in subparagraph 22 (A) determines that the agency head is unable 23 to establish the program required under para- 24 graph (2) at the agency (or, in the case of the 25 VerDate Sep 11 2014 22:16 Feb 19, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S429.IS S429 kjohnson on DSK79L0C42 with BILLS 3 •S 429 IS Director of National Intelligence, at an element 1 of the intelligence community), the agency head 2 shall submit to Congress a notification that de- 3 scribes— 4 (i) the legal basis for that inability; 5 and 6 (ii) any other specific factor that pre- 7 vents the establishment of the program. 8 (2) ESTABLISHMENT.—Except in the case of a 9 determination made under paragraph (1)(B), not 10 later than 180 days after the date on which each 11 agency head described in paragraph (1)(A) submits 12 the report required under that paragraph, the agen- 13 cy head shall, after consultation with the Director of 14 the Office of Personnel Management, establish a vol- 15 untary exchange program between the applicable 16 agency (or, with respect to the Director of National 17 Intelligence, an element of the intelligence commu- 18 nity) and private sector institutions, under which— 19 (A) a covered individual who is an em- 20 ployee of the agency, or of an element of the in- 21 telligence community, as applicable— 22 (i) may elect to be temporarily de- 23 tailed to a private sector institution that 24 VerDate Sep 11 2014 22:16 Feb 19, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S429.IS S429 kjohnson on DSK79L0C42 with BILLS 4 •S 429 IS has elected to receive the covered indi- 1 vidual; and 2 (ii) during the period of detail de- 3 scribed in clause (i), shall be considered to 4 be on detail to a regular work assignment 5 in that agency or element for all purposes; 6 and 7 (B) a covered individual who is an em- 8 ployee of a private sector institution— 9 (i) may elect to be temporarily de- 10 tailed to the agency or element— 11 (I) if the agency or element has 12 elected to receive the covered indi- 13 vidual; and 14 (II) for a period of not shorter 15 than 90 days and not longer than 2 16 years; and 17 (ii) during the period of detail de- 18 scribed in clause (i)(II), shall— 19 (I) receive from the private sector 20 institution financial compensation, 21 benefits, and any other type of com- 22 pensation or support otherwise pro- 23 vided by or through the private sector 24 institution during the course of the 25 VerDate Sep 11 2014 22:16 Feb 19, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S429.IS S429 kjohnson on DSK79L0C42 with BILLS 5 •S 429 IS employment of the covered individual 1 with the private sector institution; and 2 (II) be considered to be an em- 3 ployee of the private sector institution, 4 and not of the agency or element, for 5 all purposes. 6 (b) RULES OF CONSTRUCTION.—Nothing in this Act 7 may be construed to— 8 (1) modify or otherwise affect any program that 9 is in effect on the day before the date of enactment 10 of this Act; or 11 (2) prevent a covered individual who is detailed 12 under subsection (a)(2)(B) from serving as an in- 13 structor at an institution of higher education or a 14 research institution during that period of detail. 15 (c) DEFINITIONS.—In this section— 16 (1) the term ‘‘appropriate committees of Con- 17 gress’’ means— 18 (A) with respect to the Director of Na- 19 tional Intelligence— 20 (i) the Select Committee on Intel- 21 ligence of the Senate; and 22 (ii) the Permanent Select Committee 23 on Intelligence of the House of Represent- 24 atives; 25 VerDate Sep 11 2014 22:16 Feb 19, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S429.IS S429 kjohnson on DSK79L0C42 with BILLS 6 •S 429 IS (B) with respect to the Secretary of De- 1 fense— 2 (i) the Committee on Armed Services 3 of the Senate; and 4 (ii) the Committee on Armed Services 5 of the House of Representatives; 6 (C) with respect to the Secretary of Home- 7 land Security— 8 (i) the Committee on Homeland Secu- 9 rity and Governmental Affairs of the Sen- 10 ate; and 11 (ii) the Committee on Oversight and 12 Reform of the House of Representatives; 13 (D) with respect to the Secretary of En- 14 ergy— 15 (i) the Committee on Armed Services 16 of the Senate; 17 (ii) the Committee on Energy and 18 Natural Resources of the Senate; 19 (iii) the Committee on Armed Services 20 of the House of Representatives; and 21 (iv) the Committee on Energy and 22 Commerce of the House of Representa- 23 tives; and 24 (E) with respect to the Attorney General— 25 VerDate Sep 11 2014 22:16 Feb 19, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S429.IS S429 kjohnson on DSK79L0C42 with BILLS 7 •S 429 IS (i) the Committee on the Judiciary of 1 the Senate; and 2 (ii) the Committee on the Judiciary of 3 the House of Representatives; 4 (2) the term ‘‘covered individual’’ means an in- 5 dividual who has demonstrated expertise and work 6 experience in cybersecurity or a related discipline; 7 (3) the term ‘‘cybersecurity or a related dis- 8 cipline’’— 9 (A) means a discipline relating to cyberse- 10 curity; and 11 (B) includes— 12 (i) a field or discipline relating to— 13 (I) intrusion detection; 14 (II) secure software development; 15 (III) attack mitigation; 16 (IV) system administration; 17 (V) network services; 18 (VI) operating systems; 19 (VII) software application; 20 (VIII) enterprise architecture; 21 (IX) internet services; 22 (X) data management; 23 (XI) system analysis; or 24 (XII) malware analysis; and 25 VerDate Sep 11 2014 22:16 Feb 19, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S429.IS S429 kjohnson on DSK79L0C42 with BILLS 8 •S 429 IS (ii) any other field or discipline that 1 the Director of National Intelligence, the 2 Secretary of Defense, the Secretary of 3 Homeland Security, the Secretary of En- 4 ergy, or the Attorney General determines 5 appropriate for the purposes of the appli- 6 cable program established by that agency 7 head under subsection (a)(2); 8 (4) the term ‘‘institution of higher education’’ 9 has the meaning given the term in section 101 of the 10 Higher Education Act of 1965 (20 U.S.C. 1001); 11 (5) the term ‘‘intelligence community’’ has the 12 meaning given the term in section 3 of the National 13 Security Act of 1947 (50 U.S.C. 3003); and 14 (6) the term ‘‘private sector institution’’ in- 15 cludes— 16 (A) a nonpublic or commercial person or 17 business; 18 (B) a research institution; 19 (C) an institution of higher education; and 20 (D) any other institution that the Director 21 of National Intelligence, the Secretary of De- 22 fense, the Secretary of Homeland Security, the 23 Secretary of Energy, or the Attorney General 24 determines appropriate for the purposes of the 25 VerDate Sep 11 2014 22:16 Feb 19, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S429.IS S429 kjohnson on DSK79L0C42 with BILLS 9 •S 429 IS applicable program established by that agency 1 head under subsection (a)(2). 2 Æ VerDate Sep 11 2014 22:16 Feb 19, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6301 E:\BILLS\S429.IS S429 kjohnson on DSK79L0C42 with BILLS