Title 6, Domestic SecurityRelease 119-110

§1505 Protection From Liability

Title 6 › CHAPTER 6 — CYBERSECURITY › SUBCHAPTER I — CYBERSECURITY INFORMATION SHARING › § 1505

Last updated Sep 22, 2026|Official source

Summary

Private companies or organizations cannot be sued for monitoring their computer systems or for sharing or receiving information about cyber threats or defensive steps, as long as they follow the rules in this law. Any lawsuit like that must be thrown out quickly. If the information is sent to the federal government, it must be shared in the way required by section 1504(c)(1)(B) and only after the earlier of (1) when interim policies and procedures and guidelines are sent to Congress under sections 1504(a)(1) and 1504(b)(1), or (2) 60 days after December 18, 2015. The law does not create a duty to share, or to warn or act on received information, and it does not take away other legal defenses.

Full Legal Text

Title 6, §1505

Domestic Security, Source: USLM XML via OLRC

(a)Monitoring of information systems

No cause of action shall lie or be maintained in any court against any private entity, and such action shall be promptly dismissed, for the monitoring of an information system and information under section 1503(a) of this title that is conducted in accordance with this subchapter.

(b)Sharing or receipt of cyber threat indicators

No cause of action shall lie or be maintained in any court against any private entity, and such action shall be promptly dismissed, for the sharing or receipt of a cyber threat indicator or defensive measure under section 1503(c) of this title if—

(1)such sharing or receipt is conducted in accordance with this subchapter; and

(2)in a case in which a cyber threat indicator or defensive measure is shared with the Federal Government, the cyber threat indicator or defensive measure is shared in a manner that is consistent with section 1504(c)(1)(B) of this title and the sharing or receipt, as the case may be, occurs after the earlier of—

(A)the date on which the interim policies and procedures are submitted to Congress under section 1504(a)(1) of this title and guidelines are submitted to Congress under section 1504(b)(1) of this title; or

(B)the date that is 60 days after December 18, 2015.

(c)Construction

Nothing in this subchapter shall be construed—

(1)to create—

(A)a duty to share a cyber threat indicator or defensive measure; or

(B)a duty to warn or act based on the receipt of a cyber threat indicator or defensive measure; or

(2)to undermine or limit the availability of otherwise applicable common law or statutory defenses.

Reference

Citations & Metadata

Citation

6 U.S.C. § 1505

Title 6, Domestic Security

Last Updated

Sep 22, 2026

Release point: 119-110