§ 398. 1 1 Another section 398 is set out preceding this section. Pilot program for sharing cyber capabilities and related information with foreign operational partners

• (a) The Secretary of Defense may, with the concurrence of the Secretary of State, provide cyber capabilities and related information developed or procured by the Department of Defense to foreign countries or organizations described in subsection (b) without compensation, to meet operational imperatives if the Secretary of Defense determines that the provision of such cyber capabilities is in the national security interests of the United States.
• (b) The Secretary of Defense, with the concurrence of the Secretary of State, shall—
  • (1) establish—
    • (A) a list of foreign countries that the Secretary of Defense considers suitable for sharing of cyber capabilities and related information under the authority established under paragraph 2 2 So in original. Probably should be “subsection”. (a); and
    • (B) criteria for establishing the list under subparagraph (A);
  • (2) not later than 14 days after establishing the list required by paragraph (a), 3 3 So in original. Probably should be “(1),”. submit to the appropriate committees of Congress such list; and
  • (3) notify the appropriate committees of Congress in writing of any changes to the list established under clause 4 4 So in original. Probably should be “paragraph”. (1) at least 14 days prior to the adoption of any such changes.
• (c) Prior to the first use of the authority provided by subsection (a), the Secretaries of Defense and State shall—
  • (1) establish and submit to the appropriate committees of Congress procedures for a coordination process for subsection (a) that is consistent with the operational timelines required to support the national security of the United States; and
  • (2) notify the appropriate committees of Congress in writing of any changes to the procedures established under paragraph (1) at least 14 days prior to the adoption of any such changes.
• (d)
  • (1) The Secretary of Defense and Secretary of State jointly shall promptly submit to the appropriate committees of Congress notice in writing of any use of the authority provided by subsection (a) no later than 48 hours following the use of the authority.
  • (2) Notification under paragraph (1) shall include a certification that the provision of the cyber capabilities was in the national security interests of the United States.
  • (3) The notification under paragraph (1) shall include an analysis of whether the transfer and the underlying operational imperative could have been met using another authority.
• (e) The authority established under paragraph 2 (a) shall terminate on the date that is 3 years after the date on which this authority becomes law.
• (f) In this section:
  • (1) The term “appropriate committees of Congress” means—
    • (A) the congressional defense committees;
    • (B) the Committee on Foreign Relations of the Senate; and
    • (C) Committee on Foreign Affairs of the House of Representatives.
  • (2) The term “cyber capability” means a device or computer program, including any combination of software, firmware, or hardware, designed to create an effect in or through cyberspace.
• (g) Nothing in this section shall be construed as amending, diminishing, or otherwise impacting reporting or other obligations under the War Powers Resolution.