§3330 Reports to the Intelligence Community on Penetrations of Networks and Information Systems of Certain Contractors

Summary

Requires the Director of National Intelligence to make rules that force cleared intelligence contractors to quickly tell a designated part of the intelligence community whenever a covered contractor network or system is successfully hacked. The report must describe how the hack was done, give a sample of any malicious software found, and summarize any intelligence-related information that might have been exposed. The rules must let intelligence community staff, on request, examine contractor equipment or files to do extra forensic work, but only to find out whether intelligence community information was taken and what was taken. The rules must protect trade secrets, commercial or financial data, and personal data (except the suspected intruder’s name). Information gathered this way cannot be shared outside the intelligence community unless the contractor agrees, or it is sent to the congressional intelligence committees or the Defense Subcommittees of the House and Senate Appropriations Committees for oversight, or to law enforcement for an investigation. Definitions: “Cleared intelligence contractor” = a private company cleared to handle classified intelligence information. “Covered network” = a contractor’s system that holds or processes intelligence community information and needs extra protection. Not later than 90 days after July 7, 2014, the Director must issue the rules and criteria, and the rules take effect when issued. Not later than 180 days after July 7, 2014, the Director and the Secretary of Defense must allow a single report if a contractor is cleared by both. Existing government access rights to contractor systems are not changed.