A resolution urging the establishment of a Cyber League of Indo-Pacific States to address cyber threats.

III 116TH CONGRESS 1ST SESSION S. RES. 140 Urging the establishment of a Cyber League of Indo-Pacific States to address cyber threats. IN THE SENATE OF THE UNITED STATES APRIL 3, 2019 Mr. GARDNER (for himself and Mr. COONS) submitted the following resolution; which was referred to the Committee on Foreign Relations RESOLUTION Urging the establishment of a Cyber League of Indo-Pacific States to address cyber threats. Whereas the world has benefitted greatly from technological innovations under the leadership of the United States in the post-World War era, including the creation of the World Wide Web which has provided an entirely new platform for wealth creation and human flourishing through cyber-commerce and connectivity; Whereas cybercrime affects companies large and small, as well as infrastructure that is vital to the economy as a whole; Whereas a 2018 study from the Center for Strategic and International Studies, in partnership with McAfee, esti- mates that the global economic losses from cybercrime are approximately $600,000,000,000 annually and rising; VerDate Sep 11 2014 22:43 Apr 03, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6300 E:\BILLS\SR140.IS SR140 pamtmann on DSKBFK8HB2PROD with BILLS 2 •SRES 140 IS Whereas, according to the Pew Charitable Trust, 64 percent of people in the United States had fallen victim to cybercriminals as of 2017; Whereas, on July 9, 2012, General Keith Alexander, then-Di- rector of the National Security Agency, termed theft of United States intellectual property ‘‘the greatest transfer of wealth in history’’; Whereas, on September 25, 2015, the United States and the People’s Republic of China announced a commitment that ‘‘neither country’s government will conduct or know- ingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business in- formation, with the intent of providing competitive ad- vantages to companies or commercial sectors’’; Whereas the People’s Republic of China nonetheless con- tinues to contribute to the rise of cybercrime, exploiting weaknesses in the international system to undermine fair competition in technology and cyberspace, including through theft of intellectual property and state-sponsored malicious actions to undermine and weaken competition; Whereas, according to the 2019 Worldwide Threat Assess- ment by the Director of National Intelligence: ‘‘China, Russia, Iran, and North Korea increasingly use cyber op- erations to threaten both minds and machines in an ex- panding number of ways—to steal information, to influ- ence our citizens, or to disrupt critical infrastructure.’’; Whereas, from 2011 to 2018, more than 90 percent of cases handled by the Department of Justice alleging economic espionage by or to benefit a foreign country involved the People’s Republic of China; VerDate Sep 11 2014 22:43 Apr 03, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6300 E:\BILLS\SR140.IS SR140 pamtmann on DSKBFK8HB2PROD with BILLS 3 •SRES 140 IS Whereas more than 2⁄3 of the cases handled by the Depart- ment of Justice involving theft of trade secrets have a nexus to the People’s Republic of China; Whereas experts have asserted that the Made in China 2025 strategy of the Government of the People’s Republic of China will incentivize Chinese entities to engage in unfair competitive behavior, including additional theft of tech- nologies and intellectual property; Whereas the Democratic People’s Republic of Korea has also contributed to the rise of cybercrime and according to the 2018 Worldwide Threat Assessment by the Director of National Intelligence: ‘‘We expect the heavily sanctioned North Korea to use cyber operations to raise funds and to gather intelligence or launch attacks on South Korea and the United States. . . . North Korean actors devel- oped and launched the WannaCry ransomware in May 2017, judging from technical links to previously identified North Korean cyber tools, tradecraft, and operational in- frastructure. We also assess that these actors conducted the cyber theft of $81 million from the Bank of Ban- gladesh in 2016.’’; Whereas section 2(a)(8) of the North Korea Sanctions and Policy Enhancement Act of 2016 (22 U.S.C. 9201(a)(8)) states, ‘‘The Government of North Korea has provided technical support and conducted destructive and coercive cyberattacks, including against Sony Pictures Entertain- ment and other United States persons.’’; Whereas the United States has taken action on its own against international cybercrime, including through— (1) the North Korea Sanctions and Policy Enhance- ment Act of 2016 (Public Law 114–122), which imposed mandatory sanctions against persons engaging in signifi- VerDate Sep 11 2014 22:43 Apr 03, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6300 E:\BILLS\SR140.IS SR140 pamtmann on DSKBFK8HB2PROD with BILLS 4 •SRES 140 IS cant activities undermining cybersecurity on behalf of the Democratic People’s Republic of Korea; and (2) criminal charges filed by the Department of Jus- tice on October 25, 2018, in which the Department al- leged that the Chinese intelligence services conducted cyber intrusions against at least a dozen companies in order to obtain information on a commercial jet engine; Whereas the March 2016 Department of State International Cyberspace Policy Strategy noted that ‘‘the Department of State anticipates a continued increase and expansion of our cyber-focused diplomatic efforts for the foreseeable future’’; Whereas concerted action by countries that share concerns about state-sponsored cyber theft is necessary to prevent the growth of cybercrime and other destabilizing national security and economic outcomes; and Whereas section 215 of the Asia Reassurance Initiative Act of 2018 (Public Law 115–409) calls for ‘‘robust cyberse- curity cooperation between the United States and nations in the Indo-Pacific region’’ and ‘‘authorized to be appro- priated $100,000,000 for each of the fiscal years 2019 through 2023 to enhance cooperation between the United States and the Indo-Pacific nations for the purpose of combatting cybersecurity threats’’: Now, therefore, be it Resolved, That the Senate— 1 (1) urges the President to propose and cham- 2 pion the negotiation of a treaty with like-minded 3 partners in the Indo-Pacific to ensure a free and 4 open Internet free from economically crippling 5 cyberattacks; 6 VerDate Sep 11 2014 22:43 Apr 03, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\SR140.IS SR140 pamtmann on DSKBFK8HB2PROD with BILLS 5 •SRES 140 IS (2) calls for the treaty, which can be referred 1 to as the Cyber League of Indo-Pacific States (in 2 this resolution referred to as ‘‘CLIPS’’), to include 3 the creation of an Information Sharing Analysis 4 Center to provide around-the-clock cyber threat 5 monitoring and mitigation for governments that are 6 parties to the treaty; and 7 (3) calls for members of CLIPS— 8 (A) to consult on emerging cyber threats; 9 (B) to pledge not to conduct or support 10 theft of intellectual property, including trade se- 11 crets or other confidential business information; 12 (C) to introduce and enforce minimum 13 criminal punishment for cyber theft; 14 (D) to extradite alleged cyber thieves, con- 15 sistent with existing agreements and respecting 16 national sovereignty; 17 (E) to enforce laws protecting intellectual 18 property, including patents; 19 (F) to ensure that government agencies 20 comply with software license terms; 21 (G) to minimize data localization require- 22 ments (consistent with the Agreement between 23 the United States of America, the United Mexi- 24 can States, and Canada, signed at Buenos 25 VerDate Sep 11 2014 22:43 Apr 03, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\SR140.IS SR140 pamtmann on DSKBFK8HB2PROD with BILLS 6 •SRES 140 IS Aires November 30, 2018 (commonly known as 1 the ‘‘United States-Mexico-Canada Agree- 2 ment’’)); 3 (H) to seek cooperation with respect to the 4 standards described in the Arrangement on the 5 Recognition of Common Criteria Certificates in 6 the field of Information Technology Security, 7 dated May 14, 2014; 8 (I) to provide for public input when devis- 9 ing legislation on cybersecurity; and 10 (J) to cooperate on the attribution of 11 cyberattacks and impose appropriate con- 12 sequences. 13 Æ VerDate Sep 11 2014 22:43 Apr 03, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6301 E:\BILLS\SR140.IS SR140 pamtmann on DSKBFK8HB2PROD with BILLS