H.R. 3776 — what changed

The Group of Governmental Experts (GGE) on Developments in the Field of Information and Telecommunications in the Context of International Security, established by the United Nations General Assembly, concluded in its June 24, 2013, report “that State sovereignty and the international norms and principles that flow from it apply to States’ conduct of [information and communications technology or ICT] related activities and to their jurisdiction over ICT infrastructure with their territory.”.

On January 13, 2015, China, Kazakhstan, Kyrgyzstan, Russia, Tajikistan, and Uzbekistan proposed a troubling international code of conduct for information security which defines responsible State behavior in cyberspace to include “curbing the dissemination of information” and the “right to independent control of information and communications technology” when a country’s political security is threatened.

The July 22, 2015, GGE consensus report found that, “norms of responsible State behavior can reduce risks to international peace, security and stability.”.

On September 25, 2015, the United States and China announced a commitment “that neither country’s government will conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information, with the intent of providing competitive advantages to companies or commercial sectors.”.

At the Antalya Summit from November 15–16, 2015, the Group of 20 (G20) Leaders’ Communique affirmed the applicability of international law to State behavior in cyberspace, called on States to refrain from cyber-enabled theft of intellectual property for commercial gain, and endorsed the view that all States should abide by norms of responsible behavior.

The March 2016 Department of State International Cyberspace Policy Strategy noted that, “the Department of State anticipates a continued increase and expansion of our cyber-focused diplomatic efforts for the foreseeable future.”.

On December 1, 2016, the Commission on Enhancing National Cybersecurity established within the Department of Commerce recommended “the President should appoint an Ambassador for Cybersecurity to lead U.S. engagement with the international community on cybersecurity strategies, standards, and practices.”.

In testimony before the Select Committee on Intelligence of the Senate on May 11, 2017, the Director of National Intelligence identified six cyber threat actors, including Russia for “efforts to influence the 2016 US election”; China, for “actively targeting the US Government, its allies, and US companies for cyber espionage”; Iran for “leverage[ing] cyber espionage, propaganda, and attacks to support its security priorities, influence events and foreign perceptions, and counter threats”; North Korea for “previously conduct[ing] cyber-attacks against US commercial entities—specifically, Sony Pictures Entertainment in 2014”; terrorists, who “use the Internet to organize, recruit, spread propaganda, raise funds, collect intelligence, inspire action by followers, and coordinate operations”; and criminals who “are also developing and using sophisticated cyber tools for a variety of purposes including theft, extortion, and facilitation of other criminal activities”.

In general— The President is encouraged to enter into executive arrangements with foreign governments that support the United States international cyberspace policy described in section 3.

Existing executive arrangements— Not later than 60 days after the date of the enactment of this Act, the President shall satisfy the requirements of subsection (c) for the following executive arrangements already in effect:

The arrangement announced between the United States and Japan on April 25, 2014.

The arrangement announced between the United States and the United Kingdom on January 16, 2015.

The arrangement announced between the United States and China on September 25, 2015.

The arrangement announced between the United States and Korea on October 16, 2015.

The arrangement announced between the United States and Australia on January 19, 2016.

The arrangement announced between the United States and India on June 7, 2016.

The arrangement announced between the United States and Argentina on April 27, 2017.

The arrangement announced between the United States and Kenya on June 22, 2017.

The arrangement announced between the United States and Israel on June 26, 2017.

Any other similar bilateral or multilateral arrangement announced before the date of the enactment of this Act.

Elements— The strategy required under subsection (a) shall include the following:

A review of actions and activities undertaken to support the United States international cyberspace policy described in section 3.

A plan of action to guide the diplomacy of the Department of State with regard to foreign countries, including conducting bilateral and multilateral activities to develop the norms of responsible international behavior in cyberspace, and status review of existing efforts in multilateral fora to obtain agreements on international norms in cyberspace.

A review of alternative concepts with regard to international norms in cyberspace offered by foreign countries.

A detailed description of new and evolving threats to United States national security in cyberspace from foreign countries, State-sponsored actors, and private actors to Federal and private sector infrastructure of the United States, intellectual property in the United States, and the privacy of citizens of the United States.

A review of policy tools available to the President to deter and de-escalate tensions with foreign countries, State-sponsored actors, and private actors regarding threats in cyberspace, and to what degree such tools have been used and whether or not such tools have been effective.

A review of resources required to conduct activities to build responsible norms of international cyber behavior.

A clarification of the applicability of international laws and norms, including the law of armed conflict, to the use of ICT.

A clarification that countries that fall victim to malicious cyber activities have the right to take proportionate countermeasures under international law, including exercising the right to collective and individual self-defense.

A plan of action to guide the diplomacy of the Department of State with regard to existing mutual defense agreements, including the inclusion in such agreements of information relating to the applicability of malicious cyber activities in triggering mutual defense obligations.

Public availability— The strategy required under subsection (a) shall be available to the public in unclassified form, including through publication in the Federal Register.

In general— If the Secretary of State determines that such is appropriate, the strategy required under subsection (a) may include a classified annex consistent with United States national security interests.

Rule of construction— Nothing in this subsection may be construed as authorizing the public disclosure of an unclassified annex under subparagraph (A).

Briefing— Not later than 30 days after the production of the strategy required under subsection (a), the Secretary of State shall brief the Committee on Foreign Affairs of the House of Representatives and the Committee on Foreign Relations of the Senate on such strategy, including any material contained in a classified annex.

Updates— The strategy required under subsection (a) shall be updated—

not later than 90 days after there has been any material change to United States policy as described in such strategy; and