Cyber Deterrence and Response Act of 2019

II 116TH CONGRESS 1ST SESSION S. 602 To address state-sponsored cyber activities against the United States, and for other purposes. IN THE SENATE OF THE UNITED STATES FEBRUARY 28, 2019 Mr. GARDNER (for himself and Mr. COONS) introduced the following bill; which was read twice and referred to the Committee on Foreign Relations A BILL To address state-sponsored cyber activities against the United States, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Cyber Deterrence and 4 Response Act of 2019’’. 5 SEC. 2. FINDINGS. 6 Congress finds the following: 7 (1) On February 13, 2018, the Director of Na- 8 tional Intelligence stated in his testimony before the 9 Select Committee on Intelligence of the Senate that 10 VerDate Sep 11 2014 00:16 Mar 07, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S602.IS S602 kjohnson on DSK79L0C42 with BILLS 2 •S 602 IS ‘‘Russia, China, Iran, and North Korea will pose the 1 greatest cyber threats to the United States during 2 the next year’’ through the use of cyber operations 3 as low-cost tools of statecraft, and assessed that 4 these countries would ‘‘work to use cyber operations 5 to achieve strategic objectives unless they face clear 6 repercussions for their cyber operations’’. 7 (2) The 2017 Worldwide Threat Assessment of 8 the United States Intelligence Community stated 9 that ‘‘The potential for surprise in the cyber realm 10 will increase in the next year and beyond as billions 11 more digital devices are connected, with relatively 12 little built-in security, and both nation states and 13 malign actors become more emboldened and better 14 equipped in the use of increasingly widespread cyber 15 toolkits. The risk is growing that some adversaries 16 will conduct cyber attacks, such as data deletion or 17 localized and temporary disruptions of critical infra- 18 structure, against the United States in a crisis short 19 of war.’’. 20 (3) On March 29, 2017, President Donald J. 21 Trump considered it necessary to continue the na- 22 tional emergency declared in Executive Order 13694 23 (50 U.S.C. 1701 note; relating to blocking the prop- 24 erty of certain persons engaging in significant mali- 25 VerDate Sep 11 2014 00:16 Mar 07, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S602.IS S602 kjohnson on DSK79L0C42 with BILLS 3 •S 602 IS cious cyber-enabled activities) as ‘‘Significant mali- 1 cious cyber-enabled activities originating from, or di- 2 rected by persons located, in whole or in substantial 3 part, outside the United States, continue to pose an 4 unusual and extraordinary threat to the national se- 5 curity, foreign policy, and economy of the United 6 States.’’. 7 (4) On January 5, 2017, former Director of 8 National Intelligence, James Clapper, former Under 9 Secretary of Defense for Intelligence, Marcel Lettre, 10 and the Commander of the United States Cyber 11 Command, Admiral Michael Rogers, submitted joint 12 testimony to the Committee on Armed Services of 13 the Senate that stated that ‘‘as of late 2016 more 14 than 30 nations are developing offensive cyber at- 15 tack capabilities’’ and that ‘‘Protecting critical infra- 16 structure, such as crucial energy, financial, manu- 17 facturing, transportation, communication, and health 18 systems, will become an increasingly complex na- 19 tional security challenge.’’. 20 (5) There is significant evidence that hackers 21 affiliated with foreign governments have conducted 22 cyber operations targeting companies and critical in- 23 frastructure sectors in the United States as the De- 24 VerDate Sep 11 2014 00:16 Mar 07, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S602.IS S602 kjohnson on DSK79L0C42 with BILLS 4 •S 602 IS partment of Justice and the Department of the 1 Treasury have announced that— 2 (A) on March 15, 2018, 5 Russian entities 3 and 19 Russian individuals were designated 4 under the Countering America’s Adversaries 5 Through Sanctions Act (Public Law 115–44; 6 131 Stat. 886), as well as pursuant to Execu- 7 tive Order 13694, for interference in the United 8 States elections in 2016 and other malicious 9 cyber-enabled activities; 10 (B) on March 24, 2016, 7 Iranians work- 11 ing for entities affiliated with Iran’s Revolu- 12 tionary Guard Corps were indicted for con- 13 ducting distributed denial of service attacks 14 against the financial sector in the United States 15 from 2012 to 2013; and 16 (C) on May 19, 2014, 5 Chinese military 17 hackers were charged for hacking United States 18 companies in the nuclear power, metals, and 19 solar products industries, and engaging in eco- 20 nomic espionage. 21 (6) In May 2017, North Korea released the 22 WannaCry pseudo-ransomware, which posed a sig- 23 nificant risk to the economy, national security, and 24 the citizens of the United States and the world, as 25 VerDate Sep 11 2014 00:16 Mar 07, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S602.IS S602 kjohnson on DSK79L0C42 with BILLS 5 •S 602 IS it resulted in the infection of more than 300,000 1 computer systems in more than 150 countries, in- 2 cluding in the healthcare sector of the United King- 3 dom, demonstrating the global reach and cost of 4 cyber-enabled malicious activity. 5 (7) In June 2017, Russia carried out the most 6 destructive cyber-enabled operation in history, re- 7 leasing the NotPetya malware that caused billions of 8 dollars’ worth of damage within Ukraine and across 9 Europe, Asia, and the Americas. 10 (8) In May 2018, the Department of State, 11 pursuant to section 3(b) of Executive Order 13800 12 (6 U.S.C. 1501 note prec.; relating to strengthening 13 the cybersecurity of Federal networks and critical in- 14 frastructure), prepared recommendations to the 15 President on deterring adversaries and better pro- 16 tecting the people of the United States from cyber 17 threats, which stated ‘‘With respect to activities 18 below the threshold of the use of force, the United 19 States should, working with likeminded partners 20 when possible, adopt an approach of imposing swift, 21 costly, and transparent consequences on foreign gov- 22 ernments responsible for significant malicious cyber 23 activities aimed at harming U.S. national interests.’’. 24 VerDate Sep 11 2014 00:16 Mar 07, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S602.IS S602 kjohnson on DSK79L0C42 with BILLS 6 •S 602 IS SEC. 3. ACTIONS TO ADDRESS STATE-SPONSORED CYBER 1 ACTIVITIES AGAINST THE UNITED STATES. 2 (a) DESIGNATION AS A CRITICAL CYBER THREAT 3 ACTOR.— 4 (1) IN GENERAL.—The President, acting 5 through the Secretary of State, and in coordination 6 with the heads of other relevant Federal agencies, 7 shall designate as a critical cyber threat actor— 8 (A) each foreign person and each agency 9 or instrumentality of a foreign state that the 10 President determines to be knowingly respon- 11 sible for or complicit in, or to have engaged in, 12 directly or indirectly, state-sponsored cyber ac- 13 tivities that are reasonably likely to result in, or 14 have contributed to, a significant threat to the 15 national security, foreign policy, economic 16 health, or financial stability of the United 17 States and that have the purpose or effect of— 18 (i) causing a significant disruption to 19 the availability of a computer or network 20 of computers; 21 (ii) harming, or otherwise significantly 22 compromising the provision of service by, a 23 computer or network of computers that 24 support one or more entities in a critical 25 infrastructure sector; 26 VerDate Sep 11 2014 00:16 Mar 07, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S602.IS S602 kjohnson on DSK79L0C42 with BILLS 7 •S 602 IS (iii) significantly compromising the 1 provision of services by one or more enti- 2 ties in a critical infrastructure sector; 3 (iv) causing a significant misappro- 4 priation of funds or economic resources, 5 trade secrets, personal identifiers, or finan- 6 cial information for commercial or competi- 7 tive advantage or private financial gain; 8 (v) destabilizing the financial sector of 9 the United States by tampering with, alter- 10 ing, or causing a misappropriation of data; 11 or 12 (vi) interfering with or undermining 13 election processes or institutions by tam- 14 pering with, altering, or causing a mis- 15 appropriation of data; 16 (B) each foreign person that the President 17 has determined to have knowingly, significantly, 18 and materially assisted, sponsored, or provided 19 financial, material, or technological support for, 20 or goods or services to or in support of, any ac- 21 tivities described in subparagraph (A) by a for- 22 eign person or agency or instrumentality of a 23 foreign state designated as a critical cyber 24 threat actor under subparagraph (A); and 25 VerDate Sep 11 2014 00:16 Mar 07, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S602.IS S602 kjohnson on DSK79L0C42 with BILLS 8 •S 602 IS (C) each agency or instrumentality of a 1 foreign state that the President has determined 2 to have significantly and materially assisted, 3 sponsored, or provided financial, material, or 4 technological support for, or goods or services 5 to or in support of, any activities described in 6 subparagraph (A) by a foreign person or agency 7 or instrumentality of a foreign state designated 8 as a critical cyber threat actor under subpara- 9 graph (A). 10 (2) TRANSMISSION TO CONGRESS.—Not later 11 than 7 days after designating a foreign person or 12 agency or instrumentality of a foreign state as a 13 critical cyber threat actor under paragraph (1), the 14 President shall transmit to the appropriate congres- 15 sional committees in classified or unclassified form a 16 report identifying the designee. 17 (b) NON-TRAVEL-RELATED SANCTIONS.— 18 (1) IN GENERAL.—The President shall impose 19 one or more of the sanctions described in paragraph 20 (2) with respect to each foreign person and each 21 agency or instrumentality of a foreign state des- 22 ignated as a critical cyber threat actor under sub- 23 section (a). 24 VerDate Sep 11 2014 00:16 Mar 07, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S602.IS S602 kjohnson on DSK79L0C42 with BILLS 9 •S 602 IS (2) SANCTIONS DESCRIBED.—The sanctions de- 1 scribed in this paragraph to be imposed on a foreign 2 person and agency or instrumentality of a foreign 3 state designated as a critical cyber threat actor 4 under subsection (a) are the following: 5 (A) With respect to an agency or instru- 6 mentality of a foreign state, the President may 7 provide for the withdrawal, limitation, or sus- 8 pension of non-humanitarian development as- 9 sistance from the United States to the foreign 10 state under chapter 1 of part I of the Foreign 11 Assistance Act of 1961 (22 U.S.C. 2151 et 12 seq.). 13 (B) With respect to an agency or instru- 14 mentality of a foreign state, the President may 15 provide for the withdrawal, limitation, or sus- 16 pension of security assistance from the United 17 States to the foreign state under part II of the 18 Foreign Assistance Act of 1961 (22 U.S.C. 19 2301 et seq.). 20 (C) The President may direct the United 21 States executive director to each international 22 financial institution to use the voice and vote of 23 the United States to oppose any loan from the 24 international financial institution that would 25 VerDate Sep 11 2014 00:16 Mar 07, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S602.IS S602 kjohnson on DSK79L0C42 with BILLS 10 •S 602 IS benefit the foreign person or agency or instru- 1 mentality of a foreign state. 2 (D) The President may direct the Overseas 3 Private Investment Corporation, the United 4 States International Development Finance Cor- 5 poration, or any other Federal agency not to 6 approve the issuance of any (or to issue a speci- 7 fied number of) guarantees, insurance, exten- 8 sions of credit, or participations in the exten- 9 sion of credit that would benefit the foreign 10 person or agency or instrumentality of a foreign 11 state. 12 (E) With respect to a foreign person, the 13 President may, pursuant to such regulations or 14 guidelines as the President may prescribe, pro- 15 hibit any United States person from investing 16 in or purchasing significant amounts of equity 17 or debt instruments of that would benefit the 18 foreign person. 19 (F) The President may, pursuant to proce- 20 dures the President shall prescribe, which shall 21 include the opportunity to appeal actions under 22 this subparagraph, prohibit any Federal agency 23 from procuring, or entering into any contract 24 for the procurement of, any goods, technology, 25 VerDate Sep 11 2014 00:16 Mar 07, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S602.IS S602 kjohnson on DSK79L0C42 with BILLS 11 •S 602 IS or services, or classes of goods, technology, or 1 services, from the foreign person or agency or 2 instrumentality of a foreign state. 3 (G) The President may order the heads of 4 the appropriate Federal agencies to not issue 5 any (or to issue a specified number of) specific 6 licenses, and to not grant any other specific au- 7 thority (or to grant a specified number of au- 8 thorities), to export any goods or technology to 9 the foreign person or agency or instrumentality 10 of a foreign state under— 11 (i) the Export Control Reform Act of 12 2018 (50 U.S.C. 4801 et seq.); 13 (ii) the Arms Export Control Act (22 14 U.S.C. 2751 et seq.); 15 (iii) the Atomic Energy Act of 1954 16 (42 U.S.C. 2011 et seq.); or 17 (iv) any other statute that requires 18 the prior review and approval of the 19 United States Government as a condition 20 for the export or reexport of goods or serv- 21 ices. 22 (H) With respect to a foreign person, the 23 President may exercise all of the powers grant- 24 ed to the President under the International 25 VerDate Sep 11 2014 00:16 Mar 07, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S602.IS S602 kjohnson on DSK79L0C42 with BILLS 12 •S 602 IS Emergency Economic Powers Act (50 U.S.C. 1 1701 et seq.) (except that the requirements of 2 section 202 of such Act (50 U.S.C. 1701) shall 3 not apply) to the extent necessary to block and 4 prohibit all transactions in property and inter- 5 ests in property of the foreign person if such 6 property and interests in property are in the 7 United States, come within the United States, 8 or are or come within the possession or control 9 of a United States person. 10 (I) With respect to a foreign person, the 11 President may, pursuant to such regulations a [Text truncated for display. Full text available on Congress.gov.]