§3330 Reports to the Intelligence Community on Penetrations of Networks and Information Systems of Certain Contractors

Summary

The Director of National Intelligence must make rules that force every cleared intelligence contractor to quickly tell a part of the intelligence community when a covered network or information system is successfully broken into. The Director must also set the criteria for which contractor systems are covered, after talking with other officials. Each report must say how the break‑in happened, include a sample of any malware the contractor found, and give a short summary of any intelligence program data that might have been compromised. The rules must let intelligence staff, on request, access contractor equipment or records for extra forensic checks, but only to find out whether information created by or for the intelligence community was taken and, if so, what was taken. The rules must protect trade secrets, business and financial records, and most personal data (except the suspected intruder’s name). The intelligence community may not share information from these reports outside the community unless the contractor agrees, or it is shared with the congressional intelligence committees and the defense subcommittees of the appropriations committees for oversight, or with law enforcement. The Director had to put the rules and criteria in place within 90 days after July 7, 2014, and, within 180 days after July 7, 2014, must allow a contractor that is also a cleared defense contractor to file one combined report that meets both sets of rules. A cleared intelligence contractor means a company allowed to handle classified intelligence work. A covered network means a contractor system that stores or processes intelligence community data and needs extra protection. These rules do not change any existing government access to contractor systems that hold government data.