§395 Notification Requirements for Sensitive Military Cyber Operations

Summary

The Secretary of Defense must notify the congressional defense committees in writing within 48 hours after any sensitive military cyber operation, unless an exception applies. The Secretary must also create and give the committees the procedures for how those notices will work and tell the committees in writing at least 14 days before any changes to those procedures. The committees must keep the information safe from unauthorized disclosure. If a sensitive operation is leaked without authorization, the Secretary must tell the committees right away. That notice can be spoken at first, but a signed written notice must follow within 48 hours. A "sensitive military cyber operation" means an offensive or defensive cyber action done by U.S. armed forces against a foreign terrorist group or a foreign country (including its forces or proxies) where the U.S. is not in open hostilities or has not publicly acknowledged hostilities, and that has medium or high levels of risk in areas like collateral effects, intelligence gain or loss, chance of political retaliation, or chance of unintended detection — or any action the Secretary decides is appropriate. The 48-hour notice rule does not apply to training exercises with all nations’ consent or to covert actions. This section does not change other laws like the War Powers Resolution, the AUMF, or the National Security Act.