§395 Notification Requirements for Sensitive Military Cyber Operations

Summary

The Secretary of Defense must tell the congressional defense committees in writing about any sensitive military cyber operation no later than 48 hours after it happens, unless an exception applies. The Secretary must make and send procedures for how to do this, and must notify the committees in writing at least 14 days before changing those procedures. The committees must keep the information safe. If there is an unauthorized leak about one of these operations, the Secretary must notify the committees right away; a verbal notice is allowed but must be followed by a signed written notice within 48 hours. Sensitive military cyber operation — a US armed forces action meant to create a cyber effect against a foreign terrorist group or a country (including its armed forces or proxies) where the US is not involved in hostilities or has not publicly acknowledged involvement, and that meets risk criteria like medium or high collateral effects, intelligence impact, chance of political retaliation, or chance of unintended detection, or any operation the Secretary decides is appropriate. The rule covers both offensive and defensive cyber operations. The notification rule does not apply to multinational training exercises with consent of all nations where the effects will occur, or to covert actions under the National Security Act. Nothing here creates new military authority or changes the War Powers Resolution, the Authorization for Use of Military Force, or requirements of the National Security Act.