§9524 Imposition of Sanctions with Respect to Activities of the Russian Federation Undermining Cybersecurity

Summary

Starting 60 days after August 2, 2017, the President must punish people who knowingly carry out major cyberattacks for the Russian government, or who are owned, controlled by, or act for those people. If someone knowingly helps those attacks in a big way (except by giving financial services), the President must use at least five penalties from the list in section 9529. If someone knowingly provides financial services to support those attacks, the President must use at least three penalties from the list in section 8923(c). The penalties the President can use include blocking and banning transactions in any U.S.-connected property and stopping visas or entry for foreign nationals. The President can only waive these actions if he sends Congress a written finding that the waiver is vital to national security or helps enforce the law, and certifies that Russia has made real efforts to cut back on cyber intrusions. “Significant activities undermining cybersecurity” means big attacks like blocking or damaging computer networks, stealing or releasing data for influence or profit, destructive malware, and major denial-of-service attacks.