---
kind: "section"
citation: "6 U.S.C. § 681e"
title: "6"
title_heading: "Domestic Security"
number: "681e"
heading: "Information shared with or provided to the Federal Government"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/6/681e"
units:
  - "Chapter 1 — Homeland Security Organization"
  - "Subchapter XVIII — Cybersecurity and Infrastructure Security Agency"
  - "Part D — Cyber Incident Reporting"
---

# §681e. Information shared with or provided to the Federal Government

- (a) **Disclosure, retention, and use—**
  - (1) **Authorized activities—** Information provided to the [Agency](/usc/6/650.md?p=1) pursuant to section [681b](/usc/6/681b.md) or [681c](/usc/6/681c.md) of this title may be disclosed to, retained by, and used by, consistent with otherwise applicable provisions of Federal law, any [Federal agency](/usc/6/677a.md?p=4) or [department](/usc/6/641.md?p=1), component, officer, employee, or agent of the Federal Government solely for—
    - (A) a [cybersecurity purpose](/usc/6/650.md?p=6);
    - (B) the purpose of identifying—
      - (i) a [cyber threat](/usc/6/681.md?p=6), including the source of the [cyber threat](/usc/6/681.md?p=6); or
      - (ii) a [security vulnerability](/usc/6/650.md?p=25);
    - (C) the purpose of responding to, or otherwise preventing or mitigating, a specific threat of death, a specific threat of serious bodily harm, or a specific threat of serious economic harm, including a terrorist act or use of a weapon of mass destruction;
    - (D) the purpose of responding to, investigating, prosecuting, or otherwise preventing or mitigating, a serious threat to a minor, including sexual exploitation and threats to physical safety; or
    - (E) the purpose of preventing, investigating, disrupting, or prosecuting an offense arising out of a [cyber incident](/usc/6/681.md?p=5) reported pursuant to section [681b](/usc/6/681b.md) or [681c](/usc/6/681c.md) of this title or any of the offenses listed in [section 1504(d)(5)(A)(v) of this title](/usc/6/1504.md?p=d-5-A-v).
  - (2) **Agency actions after receipt—**
    - (A) **Rapid, confidential sharing of cyber threat indicators—** Upon receiving a [covered cyber incident](/usc/6/681.md?p=3) or [ransom payment](/usc/6/681.md?p=8) report submitted pursuant to this section, the [Agency](/usc/6/650.md?p=1) shall immediately review the report to determine whether the [cyber incident](/usc/6/681.md?p=5) that is the subject of the report is connected to an ongoing [cyber threat](/usc/6/681.md?p=6) or [security vulnerability](/usc/6/650.md?p=25) and where applicable, use such report to identify, develop, and rapidly disseminate to appropriate stakeholders actionable, anonymized [cyber threat indicators](/usc/6/650.md?p=5) and [defensive measures](/usc/6/650.md?p=9-A).
    - (B) **Principles for sharing security vulnerabilities—** With respect to information in a [covered cyber incident](/usc/6/681.md?p=3) or [ransom payment](/usc/6/681.md?p=8) report regarding a [security vulnerability](/usc/6/650.md?p=25) referred to in [paragraph (1)(B)(ii)](#a-1-B-ii), the [Director](/usc/6/650.md?p=10) shall develop principles that govern the timing and manner in which information relating to [security vulnerabilities](/usc/6/650.md?p=25) may be shared, consistent with common industry best practices and [United States](/usc/6/101.md?p=19-A) and international standards.
  - (3) **Privacy and civil liberties—** Information contained in [covered cyber incident](/usc/6/681.md?p=3) and [ransom payment](/usc/6/681.md?p=8) reports submitted to the [Agency](/usc/6/650.md?p=1) pursuant to [section 681b of this title](/usc/6/681b.md) shall be retained, used, and disseminated, where permissible and appropriate, by the Federal Government in accordance with processes to be developed for the protection of personal information consistent with processes adopted pursuant to [section 1504 of this title](/usc/6/1504.md) and in a manner that protects personal information from unauthorized use or unauthorized disclosure.
  - (4) **Digital security—** The [Agency](/usc/6/650.md?p=1) shall ensure that reports submitted to the [Agency](/usc/6/650.md?p=1) pursuant to [section 681b of this title](/usc/6/681b.md), and any information contained in those reports, are collected, stored, and protected at a minimum in accordance with the requirements for moderate impact Federal [information systems](/usc/6/650.md?p=14), as described in Federal Information Processing Standards Publication 199, or any successor document.
  - (5) **Prohibition on use of information in regulatory actions—**
    - (A) **In general—** A Federal, [State](/usc/6/101.md?p=17), local, or [Tribal government](/usc/6/601.md?p=14) shall not use information about a [covered cyber incident](/usc/6/681.md?p=3) or [ransom payment](/usc/6/681.md?p=8) obtained solely through reporting directly to the [Agency](/usc/6/650.md?p=1) in accordance with this part to regulate, including through an enforcement action, the activities of the [covered entity](/usc/6/681.md?p=4) or [entity](/usc/6/301c.md?p=2) that made a [ransom payment](/usc/6/681.md?p=8), unless the government [entity](/usc/6/301c.md?p=2) expressly allows [entities](/usc/6/301c.md?p=2) to submit reports to the [Agency](/usc/6/650.md?p=1) to meet regulatory reporting obligations of the [entity](/usc/6/301c.md?p=2).
    - (B) **Clarification—** A report submitted to the [Agency](/usc/6/650.md?p=1) pursuant to section [681b](/usc/6/681b.md) or [681c](/usc/6/681c.md) of this title may, consistent with Federal or [State](/usc/6/101.md?p=17) regulatory authority specifically relating to the prevention and mitigation of [cybersecurity threats](/usc/6/650.md?p=8-A) to [information systems](/usc/6/650.md?p=14), inform the development or implementation of regulations relating to such systems.
- (b) **Protections for reporting entities and information—** Reports describing [covered cyber incidents](/usc/6/681.md?p=3) or [ransom payments](/usc/6/681.md?p=8) submitted to the [Agency](/usc/6/650.md?p=1) by [entities](/usc/6/301c.md?p=2) in accordance with [section 681b of this title](/usc/6/681b.md), as well as voluntarily-submitted [cyber incident](/usc/6/681.md?p=5) reports submitted to the [Agency](/usc/6/650.md?p=1) pursuant to [section 681c of this title](/usc/6/681c.md), shall—
  - (1) be considered the commercial, financial, and proprietary information of the [covered entity](/usc/6/681.md?p=4) when so designated by the [covered entity](/usc/6/681.md?p=4);
  - (2) be exempt from disclosure under [section 552(b)(3) of title 5](/usc/5/552.md?p=b-3) (commonly known as the “Freedom of Information Act”), as well as any provision of [State](/usc/6/101.md?p=17), Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records;
  - (3) be considered not to constitute a waiver of any applicable privilege or protection provided by law, including trade secret protection; and
  - (4) not be subject to a rule of any [Federal agency](/usc/6/677a.md?p=4) or [department](/usc/6/641.md?p=1) or any judicial doctrine regarding ex parte communications with a decision-making official.
- (c) **Liability protections—**
  - (1) **In general—** No cause of action shall lie or be maintained in any court by any person or [entity](/usc/6/301c.md?p=2) and any such action shall be promptly dismissed for the submission of a report pursuant to [section 681b(a) of this title](/usc/6/681b.md?p=a) that is submitted in conformance with this part and the rule promulgated under [section 681b(b) of this title](/usc/6/681b.md?p=b), except that this subsection shall not apply with regard to an action by the Federal Government pursuant to [section 681d(c)(2) of this title](/usc/6/681d.md?p=c-2).
  - (2) **Scope—** The liability protections provided in this subsection shall only apply to or affect litigation that is solely based on the submission of a [covered cyber incident](/usc/6/681.md?p=3) report or [ransom payment](/usc/6/681.md?p=8) report to the [Agency](/usc/6/650.md?p=1).
  - (3) **Restrictions—** Notwithstanding [paragraph (2)](#c-2), no report submitted to the [Agency](/usc/6/650.md?p=1) pursuant to this part or any communication, document, material, or other record, created for the sole purpose of preparing, drafting, or submitting such report, may be received in evidence, subject to discovery, or otherwise used in any trial, hearing, or other proceeding in or before any court, regulatory body, or other authority of the [United States](/usc/6/101.md?p=19-A), a [State](/usc/6/101.md?p=17), or a political subdivision thereof, provided that nothing in this part shall create a defense to discovery or otherwise affect the discovery of any communication, document, material, or other record not created for the sole purpose of preparing, drafting, or submitting such report.
- (d) **Sharing with non-Federal entities—** The [Agency](/usc/6/650.md?p=1) shall anonymize the victim who reported the information when making information provided in reports received under [section 681b of this title](/usc/6/681b.md) available to [critical infrastructure](/usc/6/101.md?p=4) owners and operators and the general public.
- (e) **Stored Communications Act—** Nothing in this part shall be construed to permit or require disclosure by a provider of a remote computing service or a provider of an electronic communication service to the public of information not otherwise permitted or required to be disclosed under [chapter 121](/usc/18/chptI/ch121.md) of title 18 (commonly known as the “Stored Communications Act”).

## Source credit

(Pub. L. 107–296, title XXII, § 2245, as added Pub. L. 117–103, div. Y, § 103(a)(2), Mar. 15, 2022, 136 Stat. 1051.)