Assessing a Cyber State of Distress Act of 2020

II 116TH CONGRESS 2D SESSION S. 4226 To require the Secretary of Homeland Security to conduct an assessment of the feasibility and advisability of establishing a fund for the response to, and recovery from, a cyber state of distress, and for other purposes. IN THE SENATE OF THE UNITED STATES JULY 20, 2020 Mr. PETERS introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs A BILL To require the Secretary of Homeland Security to conduct an assessment of the feasibility and advisability of estab- lishing a fund for the response to, and recovery from, a cyber state of distress, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Assessing a Cyber 4 State of Distress Act of 2020’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 VerDate Sep 11 2014 03:08 Jul 25, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S4226.IS S4226 kjohnson on DSK79L0C42PROD with BILLS 2 •S 4226 IS (1) APPROPRIATE CONGRESSIONAL COMMIT- 1 TEES.—The term ‘‘appropriate congressional com- 2 mittees’’ means— 3 (A) the Committee on Homeland Security 4 and Governmental Affairs of the Senate; and 5 (B) the Committee on Homeland Security 6 and the Committee on Oversight and Reform of 7 the House of Representatives. 8 (2) CRITICAL INFRASTRUCTURE.—The term 9 ‘‘critical infrastructure’’ has the meaning given the 10 term in section 1016(e) of the USA PATRIOT Act 11 (42 U.S.C. 5195c(e)). 12 (3) CYBER RESPONSE AND RECOVERY FUND.— 13 The term ‘‘Cyber Response and Recovery Fund’’ 14 means a fund intended to support the response and 15 recovery from a significant cyber incident, the dis- 16 bursement of which may be triggered by a declara- 17 tion of a cyber state of distress. 18 (4) CYBER STATE OF DISTRESS.—The term 19 ‘‘cyber state of distress’’ means a state of distress 20 that— 21 (A) begins with a Federal declaration; and 22 (B) triggers additional financial and mate- 23 rial assistance in responding to significant cyber 24 incidents. 25 VerDate Sep 11 2014 03:08 Jul 25, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S4226.IS S4226 kjohnson on DSK79L0C42PROD with BILLS 3 •S 4226 IS (5) STATE.—The term ‘‘State’’ means any 1 State of the United States, the District of Columbia, 2 the Commonwealth of Puerto Rico, the Northern 3 Mariana Islands, the United States Virgin Islands, 4 Guam, American Samoa, and any other territory or 5 possession of the United States. 6 SEC. 3. ASSESSMENT OF CYBER STATE OF DISTRESS. 7 (a) IN GENERAL.—Not later than 180 days after the 8 enactment of this Act, the Secretary of Homeland Secu- 9 rity, in consultation with the head of any agency or non- 10 Federal entity determined appropriate by the Secretary, 11 shall conduct an assessment of the feasibility and advis- 12 ability of establishing an authority for the declaration of 13 a cyber state of distress. 14 (b) ELEMENTS.—The assessment required under 15 subsection (a) shall include— 16 (1) a review of recommendations developed by 17 the Cyberspace Solarium Commission under section 18 1652(k) of the John S. McCain National Defense 19 Authorization Act for Fiscal Year 2019 (Public Law 20 115–232; 132 Stat. 2146); and 21 (2) the development of additional recommenda- 22 tions relating to— 23 (A) the determinations that the Secretary 24 should make and any other actions that should 25 VerDate Sep 11 2014 03:08 Jul 25, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S4226.IS S4226 kjohnson on DSK79L0C42PROD with BILLS 4 •S 4226 IS be taken before the Secretary is authorized to 1 declare or renew a cyber state of distress, in- 2 cluding whether the declaration or any renewal 3 should require congressional oversight or ap- 4 proval; 5 (B) the definition of the term ‘‘significant 6 cyber incident’’, which shall include a consider- 7 ation of the threat and scope or magnitude of 8 the impact of such an incident; 9 (C) the authority for the coordination, in- 10 cluding the extent and type of coordination, of 11 the response of— 12 (i) Federal, State, local, and Tribal 13 governments, including the National 14 Guard; and 15 (ii) private entities; 16 (D) the appropriate duration of a cyber 17 state of distress and any renewal of a cyber 18 state of distress; 19 (E) whether there should be a limitation 20 on the number of renewals of a cyber state of 21 distress, with or without congressional oversight 22 or approval; 23 (F) the interaction, duplication, coordina- 24 tion, and deconfliction of— 25 VerDate Sep 11 2014 03:08 Jul 25, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S4226.IS S4226 kjohnson on DSK79L0C42PROD with BILLS 5 •S 4226 IS (i) authorities or functions for the 1 preparation for, response to, or recovery 2 from a significant cyber incident that the 3 Secretary of Homeland Security rec- 4 ommends granting or assigning under this 5 paragraph; and 6 (ii) existing authorities or functions 7 established by law or policy that may re- 8 late to preparing for, responding to, or re- 9 covery from a significant cyber incident, 10 including under— 11 (I) the Robert T. Stafford Dis- 12 aster Relief and Emergency Assist- 13 ance Act (42 U.S.C. 5121 et seq.); 14 (II) the National Emergencies 15 Act (50 U.S.C. 1601 et seq.); 16 (III) continuity of government 17 plans; 18 (IV) other national disaster 19 plans; and 20 (V) any other Federal authority 21 the Secretary of Homeland Security 22 determines appropriate; 23 VerDate Sep 11 2014 03:08 Jul 25, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S4226.IS S4226 kjohnson on DSK79L0C42PROD with BILLS 6 •S 4226 IS (G) appropriate exemptions from applica- 1 ble legal requirements necessary to facilitate ac- 2 tivities during a cyber state of distress; 3 (H) the scope of any allowable activities— 4 (i) in preparation for a declaration of 5 a cyber state of distress; 6 (ii) during a cyber state of distress; or 7 (iii) immediately following the termi- 8 nation of the cyber state of distress; 9 (I) the scope of any other interaction be- 10 tween Federal entities and between Federal and 11 non-Federal entities; and 12 (J) any other aspects of a cyber state of 13 distress that the Secretary of Homeland Secu- 14 rity determines relevant. 15 SEC. 4. ASSESSMENT OF CYBER RESPONSE AND RECOVERY 16 FUND. 17 (a) IN GENERAL.—Not later than 180 days after the 18 date of enactment of this Act, the Secretary of Homeland 19 Security shall conduct an assessment of the feasibility and 20 advisability of establishing a Cyber Response and Recov- 21 ery Fund. 22 (b) ELEMENTS.—The assessment required under 23 subsection (a) shall include— 24 VerDate Sep 11 2014 03:08 Jul 25, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S4226.IS S4226 kjohnson on DSK79L0C42PROD with BILLS 7 •S 4226 IS (1) a review of recommendations developed by 1 the Cyberspace Solarium Commission under section 2 1652(k) of the John S. McCain National Defense 3 Authorization Act for Fiscal Year 2019 (Public Law 4 115–232; 132 Stat. 2146); and 5 (2) the development of additional recommenda- 6 tions relating to— 7 (A) the administration of a Cyber Re- 8 sponse and Recovery Fund; 9 (B) the eligibility of entities that may re- 10 ceive direct or indirect support under a Cyber 11 Response and Recovery Fund, including eligi- 12 bility for the receipt of direct or indirect sup- 13 port by— 14 (i) Federal entities; 15 (ii) State, local, and Tribal govern- 16 ments; 17 (iii) owners and operators of critical 18 infrastructure; and 19 (iv) private sector entities that are not 20 owners or operators of critical infrastruc- 21 ture; 22 (C) allowable expenses for a Cyber Re- 23 sponse and Recovery Fund; 24 VerDate Sep 11 2014 03:08 Jul 25, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S4226.IS S4226 kjohnson on DSK79L0C42PROD with BILLS 8 •S 4226 IS (D) whether any entity receiving funds 1 from the Cyber Response and Recovery Fund 2 should be required to match funds or reimburse 3 any funds to the Cyber Response and Recovery 4 Fund; and 5 (E) with respect to funding available for 6 the response to, and recovery from a significant 7 cyber incident, the interaction, duplication, co- 8 ordination, and deconfliction of that funding, or 9 applications for that funding, provided— 10 (i) from a Cyber Response and Recov- 11 ery Fund; or 12 (ii) under— 13 (I) the Robert T. Stafford Dis- 14 aster Relief and Emergency Assist- 15 ance Act (42 U.S.C. 5121 et seq.); 16 (II) the National Emergencies 17 Act (50 U.S.C. 1601 et seq.); or 18 (III) any other Federal grant 19 program relating to cybersecurity or 20 natural disaster response or recovery. 21 SEC. 5. BRIEFING. 22 (a) IN GENERAL.—Not later than 180 days after the 23 date of enactment of this Act, the Secretary of Homeland 24 Security shall provide a briefing to each appropriate con- 25 VerDate Sep 11 2014 03:08 Jul 25, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S4226.IS S4226 kjohnson on DSK79L0C42PROD with BILLS 9 •S 4226 IS gressional committee on the assessments carried out by 1 the Secretary of Homeland Security under sections 3 and 2 4 that includes— 3 (1) the findings from the assessments; and 4 (2) legislative proposals for the establishment 5 of— 6 (A) an authority for the declaration of a 7 cyber state of distress; and 8 (B) a Cyber Response and Recovery Fund. 9 (b) FORMAT.—Each briefing required under sub- 10 section (a)— 11 (1) shall be completed in a manner that is un- 12 classified; and 13 (2) may include a classified component. 14 Æ VerDate Sep 11 2014 03:08 Jul 25, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6301 E:\BILLS\S4226.IS S4226 kjohnson on DSK79L0C42PROD with BILLS