---
kind: "section"
citation: "10 U.S.C. § 398a"
title: "10"
title_heading: "Armed Forces"
number: "398a"
heading: "Pilot program for sharing cyber capabilities and related information with foreign operational partners"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/10/398a"
units:
  - "Subtitle A — General Military Law"
  - "Part I — Organization and General Military Powers"
  - "Chapter 19 — Cyber and Information Operations Matters"
---

# §398a. Pilot program for sharing cyber capabilities and related information with foreign operational partners

- (a) **Authority to Establish Pilot Program to Share Cyber Capabilities.—** The [Secretary](/usc/10/4951.md?p=3) of Defense may, with the concurrence of the Secretary of State, provide [cyber](/usc/10/2200e.md?p=1) capabilities and related information developed or procured by the [Department](/usc/10/101.md?p=a-6) of Defense to foreign countries or organizations described in [subsection (b)](#b) without compensation, to meet operational imperatives if the [Secretary](/usc/10/4951.md?p=3) of Defense determines that the provision of such [cyber](/usc/10/2200e.md?p=1) capabilities is in the [national security](/usc/10/801.md?p=16) interests of the [United States](/usc/10/101.md?p=a-1).
- (b) **List of Foreign Countries.—** The [Secretary](/usc/10/4951.md?p=3) of Defense, with the concurrence of the Secretary of State, shall—
  - (1) establish—
    - (A) a list of foreign countries that the [Secretary](/usc/10/4951.md?p=3) of Defense considers suitable for sharing of [cyber](/usc/10/2200e.md?p=1) capabilities and related information under the authority established under [subsection (a)](#a); and
    - (B) criteria for establishing the list under [subparagraph (A)](#b-1-A);
  - (2) not later than 14 days after establishing the list required by [paragraph (1)](#b-1), submit to the [appropriate committees of Congress](/usc/10/301.md?p=1) such list; and
  - (3) notify the [appropriate committees of Congress](/usc/10/301.md?p=1) in writing of any changes to the list established under [paragraph (1)](#b-1) at least 14 days prior to the adoption of any such changes.
- (c) **Procedures.—** Prior to the first use of the authority provided by [subsection (a)](#a), the [Secretaries](/usc/10/4951.md?p=3) of Defense and [State](/usc/10/4951.md?p=4) shall—
  - (1) establish and submit to the [appropriate committees of Congress](/usc/10/301.md?p=1) procedures for a coordination process for [subsection (a)](#a) that is consistent with the operational timelines required to support the [national security](/usc/10/801.md?p=16) of the [United States](/usc/10/101.md?p=a-1); and
  - (2) notify the [appropriate committees of Congress](/usc/10/301.md?p=1) in writing of any changes to the procedures established under [paragraph (1)](#c-1) at least 14 days prior to the adoption of any such changes.
- (d) **Notification Required.—**
  - (1) The [Secretary](/usc/10/4951.md?p=3) of Defense and Secretary of State jointly shall promptly submit to the [appropriate committees of Congress](/usc/10/301.md?p=1) notice in writing of any use of the authority provided by [subsection (a)](#a) no later than 48 hours following the use of the authority.
  - (2) Notification under [paragraph (1)](#d-1) shall include a certification that the provision of the [cyber](/usc/10/2200e.md?p=1) capabilities was in the [national security](/usc/10/801.md?p=16) interests of the [United States](/usc/10/101.md?p=a-1).
  - (3) The notification under [paragraph (1)](#d-1) shall include an analysis of whether the transfer and the underlying operational imperative could have been met using another authority.
- (e) **Termination.—** The authority established under [subsection (a)](#a) shall terminate on the date that is 3 years after the date on which this authority becomes law.
- (f) **Performance Metrics.—**
  - (1) The [Secretary](/usc/10/4951.md?p=3) of Defense shall maintain performance metrics to track the results of sharing [cyber](/usc/10/2200e.md?p=1) capabilities and related information with foreign operational partners under a pilot [program](/usc/10/2101.md?p=1) authorized by [subsection (a)](#a).
  - (2) The performance metrics under [paragraph (1)](#f-1) shall include the following:
    - (A) Whom the [cyber](/usc/10/2200e.md?p=1) capability was used against.
    - (B) The effect of the [cyber](/usc/10/2200e.md?p=1) capability, including whether and how the transfer of the [cyber](/usc/10/2200e.md?p=1) capability improved the operational [cyber](/usc/10/2200e.md?p=1) posture of the [United States](/usc/10/101.md?p=a-1) and achieved operational objectives of the [United States](/usc/10/101.md?p=a-1), or had no effect.
    - (C) Such other outcome-based or appropriate performance metrics as the [Secretary](/usc/10/4951.md?p=3) considers appropriate for evaluating the effectiveness of a pilot [program](/usc/10/2101.md?p=1) carried out under [subsection (a)](#a).
- (g) **Definitions.—** In this section:
  - (1) The term “[appropriate committees of Congress](/usc/10/301.md?p=1)” means—
    - (A) the [congressional defense committees](/usc/10/101.md?p=a-16);
    - (B) the Committee on Foreign Relations of the Senate; and
    - (C) Committee on Foreign Affairs of the House of Representatives.
  - (2) The term “[cyber](/usc/10/2200e.md?p=1) capability” means a device or computer [program](/usc/10/2101.md?p=1), including any combination of software, firmware, or hardware, designed to create an effect in or through cyberspace.
- (h) **Rule of Construction.—** Nothing in this section shall be construed as amending, diminishing, or otherwise impacting reporting or other obligations under the War Powers Resolution.

## Source credit

(Added Pub. L. 117–263, div. A, title XV, § 1551(a), Dec. 23, 2022, 136 Stat. 2918, § 398; renumbered § 398a and amended Pub. L. 118–31, div. A, title XV, § 1501, title XVIII, § 1801(a)(6), (7), Dec. 22, 2023, 137 Stat. 533, 683.)

## Notes

### Editorial Notes

### References in Text

The War Powers Resolution, referred to in subsec. (h), is Pub. L. 93–148, Nov. 7, 1973, 87 Stat. 555, which is classified generally to chapter 33 (§ 1541 et seq.) of Title 50, War and National Defense. For complete classification of this Resolution to the Code, see Short Title note set out under section 1541 of Title 50 and Tables.

### Amendments

2023—Pub. L. 118–31, §§ 1501(1), 1801(a)(6), made identical amendments, renumbering section 398 of this title relating to pilot program for sharing cyber capabilities and related information with foreign operational partners as this section.

Subsec. (b)(1)(A). Pub. L. 118–31, § 1801(a)(7)(A)(i), substituted “subsection (a)” for “paragraph (a)”.

Subsec. (b)(2). Pub. L. 118–31, § 1801(a)(7)(A)(ii), substituted “paragraph (1)” for “paragraph (a)”.

Subsec. (b)(3). Pub. L. 118–31, § 1801(a)(7)(A)(iii), substituted “paragraph (1)” for “clause (1)”.

Subsec. (e). Pub. L. 118–31, § 1801(a)(7)(B), substituted “subsection (a)” for “paragraph (a)”.

Subsecs. (f) to (h). Pub. L. 118–31, § 1501(2), added subsec. (f) and redesignated former subsecs. (f) and (g) as (g) and (h), respectively.