§398a Pilot Program for Sharing Cyber Capabilities and Related Information with Foreign Operational Partners

Summary

Allows the Secretary of Defense, with the Secretary of State’s agreement, to give U.S. cyber tools and related information to certain foreign partners for free when doing so serves U.S. national security and is needed for operations. The Secretary must make a list of eligible countries and the rules for picking them, send that list to the congressional defense committees, the Senate Foreign Relations Committee, and the House Foreign Affairs Committee within 14 days of creating it, and tell those committees at least 14 days before any changes. Before the first use, the Secretaries of Defense and State must set up and send to those committees coordination procedures that fit operational timelines, and they must give 14 days’ notice before changing those procedures. After each time the authority is used, the Secretaries must notify those committees in writing within 48 hours. The notice must say that the transfer was in the national security interest and analyze whether another legal authority could have done the same job. The authority ends 3 years after it becomes law. The Defense Department must keep performance data, including whom the cyber tool was used against, what effect it had (including whether it improved U.S. cyber operations or met objectives, or had no effect), and other outcome-based measures. “Appropriate committees of Congress” and “cyber capability” are defined in the section. This does not change War Powers Resolution reporting or other obligations.