Section 1 Short title
This Act may be cited as the “Providing Retaliation Options against Those Engaging in Cyberattacks Targeting the United States Act” or “PROTECT US Act”.
Providing Retaliation Options against Those Engaging in Cyberattacks Targeting the United States Act
A BILL
To impose penalties on state-sponsors of cyberattacks, and for other purposes.
Sec. 2 Findings
Congress finds the following:
Article XXI of the GATT 1994 (as such term is defined in section 2(1)(B) of the Uruguay Round Agreements Act (19 U.S.C. 3501(1)(B))) allows a member of the World Trade Organization to take any action which such member considers necessary for the protection of such member’s essential security interests.
Protecting the United States from malicious cyber-enabled activities is essential to the security interests of the United States.
Sec. 3 Imposition of penalties on state-sponsors of cyberattacks
In general— The President is authorized to impose penalties described in subsection (c) with respect to each country on the list required by subsection (b).
List of state-Sponsors of cyberattacks—
In general— Not later than 60 days after the date of the enactment of this Act, the President shall submit to Congress a list of countries designated as state-sponsors of cyberattacks pursuant to paragraph (2).
Countries designated— If the President, in consultation with the Secretary of Homeland Security, the Secretary of Defense, the Attorney General, and the Chairman of the United States International Trade Commission, determines that the United States or a United States person has been targeted in a malicious cyber-enabled activity originating from, or directed by a person located, in whole or in substantial part, in a foreign country, and such activity is reasonably likely to result in, or have materially contributed to, a threat to the national security or foreign policy of the United States, or harmed the economic health or financial stability of the United States or a United States person, or has the purpose or effect of—
harming or otherwise significantly compromising the provision of services by a computer or network of computers that support the United States or a United States person in a critical infrastructure sector,
significantly compromising the provision of services by the United States or a United States person in a critical infrastructure sector,
causing significant disruption to the availability of a computer or network of computers owned or operated by the United States or a United States person, or
causing a significant misappropriation of funds or economic resources, trade secrets, personally identifiable information, or financial information of the United States or a United States person,
Updates of list— The President shall submit to Congress an updated list under paragraph (1) as new information becomes available.
Penalties—
Trade-related penalty— The President may impose a duty, in addition to any other duty imposed, on any article or service imported directly or indirectly into the United States that is produced in whole or in part in a country that is included on the list of state-sponsors of cyberattacks required by subsection (b).
Other actions— The President may take any of the following actions with respect to a country that is included on the list of state-sponsors of cyberattacks required by subsection (b):
A private demarche.
An official public demarche.
A public condemnation.
A public condemnation within one or more multilateral fora.
The delay or cancellation of one or more scientific exchanges.
The delay or cancellation of one or more cultural exchanges.
The denial of one or more working, official, or state visits.
The delay or cancellation of one or more working, official, or state visits.
The withdrawal, limitation, or suspension of United States development assistance under chapter 1 of part I of the Foreign Assistance Act of 1961.
Directing the Export-Import Bank of the United States, the Overseas Private Investment Corporation, or the Trade and Development Agency to not approve the issuance of any (or a specified number of) guarantees, insurance, extensions of credit, or participations in extensions of credit.
The withdrawal, limitation, or suspension of United States security assistance under part II of the Foreign Assistance Act of 1961.
Consistent with section 701 of the International Financial Institutions Act, directing the United States Executive Directors at international financial institutions to oppose and vote against loans primarily benefitting the country.
Ordering the heads of the appropriate United States agencies to not issue any (or a specified number of) specific licenses, and to not grant any other specific authority (or a specified number of authorities), to export any goods or technology to such country under—
the Export Administration Act of 1979 (as continued in effect pursuant the International Emergency Economic Powers Act);
the Arms Export Control Act;
the Atomic Energy Act of 1954; or
any other statute that requires the prior review and approval of the United States Government as a condition for the export or re-export of goods or services.
Prohibiting any United States financial institution from making loans or providing credits.
Prohibiting the United States Government from procuring, or entering into any contract for the procurement of, any goods or services.
Suspension or withdrawal of extension of nondiscriminatory treatment to the products of the country pursuant to section 404 of the Trade Act of 1974.
Ordering a trade embargo.
Ordering a cyber counterattack.
Removal from list—
In general— A country may be removed from the list of state-sponsors of cyberattacks required by subsection (b) if—
the President determines that the country no longer meets the requirements for designation as a state-sponsor of cyberattacks under subsection (b)(2); or
Congress enacts a law that provides for such removal.
Moratorium—
In general— A country that has been removed from the list pursuant to paragraph (1)(B) may not be added back to the list by the President until at least the date that is one year after the date of such removal.
Rule of construction— Nothing in this paragraph shall be construed as prohibiting Congress from adding a country that has been removed from the list pursuant to paragraph (1)(B) back to the list by a date that is earlier than the date described in subparagraph (A).
Definitions— In this section:
Critical infrastructure sector— The term critical infrastructure sector means any of the designated critical infrastructure sectors identified in Presidential Policy Directive 21.
Entity— The term entity means a partnership, association, trust, joint venture, corporation, group, subgroup, government, or other organization.
List— The term list means the list of state-sponsors of cyberattacks.
Misappropriation— The term misappropriation means any taking or obtaining by improper means, without permission or consent, or under false pretenses.
Person— The term person means a natural person or an entity.
United States person— The term United States person shall be broadly construed to include but not be limited to any United States citizen, permanent resident alien, entity organized under the laws of the United States or any jurisdiction within the United States (including foreign branches), any governmental or quasi-governmental entity existing in the United States, or any other person in the United States.