1. Short title
This Act may be cited as the “Defend COVID Research from Hackers Act”.
Defend COVID Research from Hackers Act
A BILL
To authorize the imposition of sanctions on certain foreign persons that have threatened the national security, foreign policy, public health, or economic health or financial stability of the United States, and for other purposes.
2. Authorization of imposition of sanctions on certain foreign persons
In general— The President is authorized to impose sanctions described in subsection (b) with respect to any foreign person determined by the President—
to be responsible for or complicit in, or to have engaged in, directly or indirectly, activities, including cyber-enabled activities, originating from, or directed by foreign persons that are reasonably likely to result in, or have materially contributed to, a significant threat to the national security, foreign policy, public health, or economic health or financial stability of the United States and that have the purpose or effect of—
harming, or otherwise significantly compromising the provision of services by a computer or network of computers that support one or more entities in a critical infrastructure sector;
significantly compromising the provision of services by one or more entities in a critical infrastructure sector;
causing a significant disruption to the availability of a computer or network of computers; or
causing a significant misappropriation of funds or economic resources, trade secrets, personal identifiers, intellectual property, or financial information for commercial or competitive advantage or private financial gain;
to be responsible for or complicit in, or to have engaged in, or to have knowingly materially benefitted from, the receipt or use for commercial or competitive advantage or private financial gain, of funds or economic resources, trade secrets, personal identifiers, intellectual property, or financial information misappropriated through cyber-enabled activities and with respect to which such actions are reasonably likely to result in, or have materially contributed to, a significant threat to the national security, foreign policy, public health, or economic health or financial stability of the United States;
to have materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services in support of—
any activity described in paragraphs (1) and (2); or
any person whose property or interests in property are blocked pursuant to this section;
to be owned or controlled by, or to have acted or purported to act for or on behalf of, directly or indirectly, any person whose property or interests in property are blocked pursuant to this section; or
to have attempted to engage in any of the activities described in paragraphs (1) through (3).
Sanctions described— The sanctions to be imposed with respect to a foreign person described in subsection (a) are the following:
Blocking of property— The President shall exercise all of the powers granted to the President by the International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.) (except that the requirements of section 202 of such Act (50 U.S.C. 1701) shall not apply) to the extent necessary to block and prohibit all transactions in property and interests in property of the person if such property and interests in property are in the United States, come within the United States, or are or come within the possession or control of a United States person.
Inadmissibility of certain individuals—
Ineligibility for visas, admission, or parole— An alien who is a foreign person under subsection (a), or an alien who is an officer or director of a foreign person under such subsection, is—
inadmissible to the United States;
ineligible to receive a visa or other documentation to enter the United States; and
otherwise ineligible to be admitted or paroled into the United States or to receive any other benefit under the Immigration and Nationality Act (8 U.S.C. 1101 et seq.).
Current visas revoked— An alien who is a foreign person under subsection (a), or an alien who is an officer or director of a foreign person under such subsection, is subject to the following:
Revocation of any visa or other entry documentation regardless of when the visa or other entry documentation is or was issued.
A revocation under clause (i) shall—
take effect immediately; and
cancel any other valid visa or entry documentation that is in the foreign person’s or alien’s possession, as the case may be.
Penalties— The penalties provided for in subsections (b) and (c) of section 206 of the International Emergency Economic Powers Act (50 U.S.C. 1705) shall apply to a person that violates, attempts to violate, conspires to violate, or causes a violation of this section, including regulations promulgated in accordance therewith, to the same extent that such penalties apply to a person that commits an unlawful act described in section 206(a) of such Act.
Exception— Sanctions imposed pursuant to this section shall not apply to an alien if admitting or paroling the alien into the United States is necessary to permit the United States to comply with the Agreement regarding the Headquarters of the United Nations, signed at Lake Success June 26, 1947, and entered into force November 21, 1947, between the United Nations and the United States, or other applicable international obligations of the United States.
Exception To comply with national security— The following activities shall be exempt from sanctions under this section:
Activities subject to the reporting requirements under title V of the National Security Act of 1947 (50 U.S.C. 3091 et seq.).
Activities subject to any authorized intelligence or law enforcement activities of the United States.
Implementation and regulatory authority— The President is authorized to exercise all authorities provided to the President under sections 203 and 205 of the International Emergency Economic Powers Act (50 U.S.C. 1702 and 1704) to carry out this Act and may issue such regulations, licenses, and orders as are necessary to carry out this Act.
Exception related to the importation of goods—
In general— The authorities and requirements to impose sanctions pursuant to this section shall not include the authority or requirement to impose sanctions on the importation of goods.
Good defined— In this section, the term “good” means any article, natural or man-made substance, material, supply or manufactured product, including inspection and test equipment and excluding technical data.
Report on cyber-Enabled activities—
In general— Not later than 180 days after the date of the enactment of this Act, the Secretary of State, in consultation with the Director of National Intelligence, shall submit to the appropriate congressional committees a report detailing the extent of known cyber-enabled activities or attempted cyber-enabled activities as described in this section by foreign persons related to the 2019 novel coronavirus and whether such activities qualify for the imposition of sanctions pursuant to this section.
Form— The report required under subsection (a) shall be unclassified but may contain a classified annex.
Definitions— In this section:
Admitted; alien— The terms “admitted” and “alien” have the meanings given such terms in section 101 of the Immigration and Nationality Act (8 U.S.C. 1101).
Appropriate congressional committees— The term “appropriate congressional committees” means—
in the House of Representatives—
the Committee on Foreign Affairs; and
the Committee on Ways and Means; and
in the Senate—
the Committee on Foreign Relations; and
the Committee on Banking, Housing, and Urban Affairs.
Critical infrastructure sector— The term “critical infrastructure sector” means any of the designated critical infrastructure sectors identified in Presidential Policy Directive 21.
Entity— The term “entity” means a partnership, association, trust, joint venture, corporation, group, subgroup, or other organization.
Foreign government— The term “foreign government” means any government of a country other than the United States.
Foreign person— The term “foreign person” means an individual or entity that is not a United States person.
Knowingly— The term “knowingly” with respect to conduct, a circumstance, or a result, means that a person has actual knowledge, or should have known, of the conduct, the circumstance, or the result.
Misappropriation— The term “misappropriation” means any taking or obtaining by improper means, without permission or consent, or under false pretenses.
Person— The term “person” means an individual or entity.
United States person— The term “United States person” means any United States citizen, permanent resident alien, entity organized under the laws of the United States or any jurisdiction within the United States (including foreign branches), or any person in the United States.
3. Stopping trafficking in botnets
Section 1030 of title 18, United States Code, is amended—
in subsection (a)—
in paragraph (7), by adding “or” at the end; and
by adding at the end the following new paragraph:
“(8) knowingly traffics in access to a protected computer, if the trafficker knows the protected computer has been damaged in a manner prohibited by this section.”
in subsection (c)(3)—
in subparagraph (A), by striking “(a)(4) or (a)(7)” and inserting “(a)(4), (a)(7), or (a)(8)”; and
in subparagraph (B), by striking “(a)(4), or (a)(7)” and inserting “(a)(4), (a)(7), or (a)(8)”;
in subsection (e)—
in paragraph (11), by striking “and” at the end;
in paragraph (12), by striking the period at the end and inserting “; and”; and
by adding at the end the following new paragraph:
“(13) the term “traffic” has the meaning given such term in section 1029(e)(5) of this title.”
in subsection (g), by inserting “, except for a violation of subsection (a)(8),” after “violation of this section”.
4. Injunctions against fraud and abuse
Section 1345 of title 18, United States Code, is amended—
in the section heading by striking “fraud” and inserting “fraud and abuse”;
in subsection (a)—
in paragraph (1)—
subparagraph (B), by striking “; or” and inserting a semicolon;
in subparagraph (C), by striking the semicolon and inserting “; or”; and
by adding at the end the following new subparagraph:
“(D) violating or about to violate section 1030(a)(5) of this title where such conduct has caused or would cause damage (as defined in section 1030) without authorization to 100 or more protected computers (as defined in section 1030) during any 1-year period, including by—
“(i) damage of the protected computers without authorization; or
“(ii) installing or maintaining control over malicious software on the protected computers that, without authorization, have caused or would cause damage to the protected computers;”
in paragraph (2) by inserting “, a violation under subsection (a)(1)(D),” after “(as defined in section 3322(d) of this title)”; and
by adding at the end the following new subsection:
“(c)
“(1) No cause of action may lie or be maintained in any court against any person and shall be promptly dismissed if such cause of action is with respect to an act that is in compliance with any restraining order, prohibition, or other action under subsection (b), if issued in circumstances described in subsection (a)(1)(D).
“(2) A restraining order, prohibition, or other action under subsection (b), if issued in circumstances described in subsection (a)(1)(D), may, upon application of the Attorney General, provide that the United States shall pay to such person a fee for reimbursement for such costs as are reasonably necessary and which have been directly incurred in complying with the restraining order, prohibition, or other action.”