§398a Pilot program for sharing cyber capabilities and related information with foreign operational partners

Summary

The Secretary of Defense, with the Secretary of State’s agreement, may give certain cyber tools and related information that the Department of Defense created or bought to foreign partners for free when needed for operations and when the Secretary decides it is in the national security interests of the United States. The Defense Secretary must make a list of which countries are suitable and the rules for making that list, and send the list to the appropriate committees of Congress within 14 days of making it. Any change to the list must be reported at least 14 days before the change. Before the first use, the Defense and State Secretaries must create and send procedures for coordinating these transfers and tell Congress of any changes to those procedures at least 14 days before changes take effect. After any use, they must notify the appropriate committees within 48 hours, certify the transfer served U.S. national security interests, and explain whether another authority could have been used. The authority ends 3 years after it becomes law. The Defense Secretary must track results with performance measures, including whom the tool was used against, the effect (including whether it improved the operational cyber posture of the United States and met operational goals or had no effect), and other outcome-based metrics. Appropriate committees of Congress means the congressional defense committees, the Senate Committee on Foreign Relations, and the House Committee on Foreign Affairs. Cyber capability means a device or computer program (software, firmware, or hardware) made to create an effect in or through cyberspace. Nothing here changes reporting or other duties under the War Powers Resolution.