§9524 Imposition of Sanctions with Respect to Activities of the Russian Federation Undermining Cybersecurity

Summary

Starting 60 days after August 2, 2017, the President must punish people who, on behalf of the Russian government, knowingly carry out major cyberattacks that harm computers, networks, or democratic institutions, or who are owned or controlled by those people. The President must also impose at least five sanctions from section 9529 on anyone who knowingly gives material, technical, or non-financial support for those attacks, and at least three sanctions from section 8923(c) on anyone who knowingly provides financial services for those attacks. The punishments can include using the powers in the International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.) to freeze and block all property and transactions in the United States or under U.S. control, and refusing or revoking visas and excluding aliens under 8 U.S.C. 1201(i). The President can only waive these sanctions if he tells the relevant congressional committees in writing that the waiver is needed for vital national security or will help enforce the law, and certifies that Russia has made significant efforts to cut down on cyber intrusions. "Significant activities undermining cybersecurity" means major attacks that block or damage systems, steal or release data without permission to influence people or steal money, use destructive malware, or carry out large denial-of-service attacks.