Title 50, War and National DefenseRelease 119-110

§3371c Notification of Significant Foreign Cyber Intrusions and Active Measures Campaigns Directed at Elections for Federal Offices

Title 50 › CHAPTER 45 — MISCELLANEOUS INTELLIGENCE COMMUNITY AUTHORITIES › SUBCHAPTER IV — COLLECTION, ANALYSIS, AND SHARING OF INTELLIGENCE › § 3371c

Last updated Sep 22, 2026|Official source

Summary

The Director of National Intelligence, the Director of the FBI, and the Secretary of Homeland Security must work together if they determine that on or after December 20, 2019, a major foreign cyber attack or a secret foreign influence operation aimed at an upcoming federal election has happened or is happening, and they have moderate or high confidence that a foreign government or a foreign group or person is responsible. If they make that determination, they must give a classified briefing within 14 days to congressional leaders (the Senate majority and minority leaders, the Speaker of the House, and the House minority leader), the congressional intelligence committees, and certain other listed congressional committees. The briefing must describe the incident, identify who is blamed, say whether the information should be released to the public, and include any other joint information the three officials think is appropriate. For a cyber attack on election systems, the Department of Homeland Security must offer a briefing to the owners or operators of the affected systems about the attack and steps to fix or lower the risk; that briefing can be classified and shown only to people with proper clearances. All briefings must protect intelligence sources and methods. Definitions (one line each): active measures campaign = a foreign covert or semi‑covert intelligence operation; cyber intrusion = an unauthorized electronic event that harms election systems or their data; electronic election infrastructure = electronic systems used by the federal, state, or local government, political parties, or campaigns for federal elections; high confidence = based on high‑quality information from multiple sources; moderate confidence = credible and plausible but less fully corroborated; other appropriate congressional committees = specified Armed Services, Foreign Affairs/Relations, Homeland Security, and Appropriations committees in each chamber.

Full Legal Text

Title 50, §3371c

War and National Defense, Source: USLM XML via OLRC

(a)Definitions
In this section: (1) Active measures campaign
(2)Candidate, election, and political party
The terms “candidate”, “election”, and “political party” have the meanings given those terms in section 30101 of title 52.
(3)Congressional leadership
The term “congressional leadership” includes the following:
(A)The majority leader of the Senate.
(B)The minority leader of the Senate.
(C)The Speaker of the House of Representatives.
(D)The minority leader of the House of Representatives.
(4)Cyber intrusion
The term “cyber intrusion” means an electronic occurrence that actually or imminently jeopardizes, without lawful authority, electronic election infrastructure, or the integrity, confidentiality, or availability of information within such infrastructure.
(5)Electronic election infrastructure
The term “electronic election infrastructure” means an electronic information system of any of the following that is related to an election for Federal office:
(A)The Federal Government.
(B)A State or local government.
(C)A political party.
(D)The election campaign of a candidate.
(6)Federal office
The term “Federal office” has the meaning given that term in section 30101 of title 52.
(7)High confidence
The term “high confidence”, with respect to a determination, means that the determination is based on high-quality information from multiple sources.
(8)Moderate confidence
The term “moderate confidence”, with respect to a determination, means that a determination is credibly sourced and plausible but not of sufficient quality or corroborated sufficiently to warrant a higher level of confidence.
(9)Other appropriate congressional committees
The term “other appropriate congressional committees” means—
(A)the Committee on Armed Services, the Committee on Foreign Relations, the Committee on Homeland Security and Governmental Affairs, and the Committee on Appropriations of the Senate; and
(B)the Committee on Armed Services, the Committee on Foreign Affairs, the Committee on Homeland Security, and the Committee on Appropriations of the House of Representatives.
(b)Determinations of significant foreign cyber intrusions and active measures campaigns
The Director of National Intelligence, the Director of the Federal Bureau of Investigation, and the Secretary of Homeland Security shall jointly carry out subsection (c) if such Directors and the Secretary jointly determine—
(1)that on or after December 20, 2019, a significant foreign cyber intrusion or active measures campaign intended to influence an upcoming election for any Federal office has occurred or is occurring; and
(2)with moderate or high confidence, that such intrusion or campaign can be attributed to a foreign state or to a foreign nonstate person, group, or other entity.
(c)Briefing
(1)In general
Not later than 14 days after making a determination under subsection (b), the Director of National Intelligence, the Director of the Federal Bureau of Investigation, and the Secretary of Homeland Security shall jointly provide a briefing to the congressional leadership, the congressional intelligence committees and, consistent with the protection of sources and methods, the other appropriate congressional committees. The briefing shall be classified and address, at a minimum, the following:
(A)A description of the significant foreign cyber intrusion or active measures campaign, as the case may be, covered by the determination.
(B)An identification of the foreign state or foreign nonstate person, group, or other entity, to which such intrusion or campaign has been attributed.
(C)The desirability and feasibility of the public release of information about the cyber intrusion or active measures campaign.
(D)Any other information such Directors and the Secretary jointly determine appropriate.
(2)Electronic election infrastructure briefings
With respect to a significant foreign cyber intrusion covered by a determination under subsection (b), the Secretary of Homeland Security, in consultation with the Director of National Intelligence and the Director of the Federal Bureau of Investigation, shall offer to the owner or operator of any electronic election infrastructure directly affected by such intrusion, a briefing on such intrusion, including steps that may be taken to mitigate such intrusion. Such briefing may be classified and made available only to individuals with appropriate security clearances.
(3)Protection of sources and methods
This subsection shall be carried out in a manner that is consistent with the protection of sources and methods.

Legislative History

Notes & Related Subsidiaries

Statutory Notes and Related Subsidiaries

Definitions For definition of “congressional intelligence committees” as used in this section, see section 5003 of div. E of Pub. L. 116–92, set out as a note under section 3003 of this title.

Reference

Citations & Metadata

Citation

50 U.S.C. § 3371c

Title 50, War and National Defense

Last Updated

Sep 22, 2026

Release point: 119-110