§398a Pilot Program for Sharing Cyber Capabilities and Related Information with Foreign Operational Partners

Summary

The Secretary of Defense may, if the Secretary of State agrees, give cyber tools and related information that the Department of Defense made or bought to certain foreign countries or groups for free when needed for U.S. national security. The Defense and State Secretaries must make a list of which countries are allowed and the rules for making that list. They must send that list to the right congressional committees within 14 days and tell those committees at least 14 days before any changes. Before the first use, they must give Congress written procedures for how they will coordinate fast enough to meet operational needs and tell Congress 14 days before changing those procedures. After any use, they must notify Congress in writing within 48 hours, certify it was in the U.S. national security interest, and say whether another legal authority could have been used. The authority ends 3 years after it becomes law. The Secretary of Defense must track results using performance measures, like who was targeted and what effect it had. “Appropriate committees of Congress” means the congressional defense committees, the Senate Committee on Foreign Relations, and the House Committee on Foreign Affairs. “Cyber capability” means a device or computer program (software, firmware, or hardware) made to cause effects in or through cyberspace. Nothing here changes War Powers Resolution reporting or duties.