{"identifier":"/us/usc/t6/s151","title_num":"6","num":"§ 151.","heading":"Federal intrusion detection and prevention system","status":null,"guid":"idf787a652-4154-11e7-bab8-e125cf475dd2","source_credit":"(Pub. L. 107–296, title II, § 230, as added Pub. L. 114–113, div. N, title II, § 223(a)(6), Dec. 18, 2015, 129 Stat. 2964.)","seq_in_title":43,"parent_identifier":"/us/usc/t6/ch1/schII/ptC","ancestors":[{"identifier":"/us/usc/t6","level":"title","num":"Title 6—","heading":"DOMESTIC SECURITY","status":null,"is_section":false},{"identifier":"/us/usc/t6/ch1","level":"chapter","num":"CHAPTER 1—","heading":"HOMELAND SECURITY ORGANIZATION","status":null,"is_section":false},{"identifier":"/us/usc/t6/ch1/schII","level":"subchapter","num":"SUBCHAPTER II—","heading":"INFORMATION ANALYSIS","status":null,"is_section":false},{"identifier":"/us/usc/t6/ch1/schII/ptC","level":"part","num":"Part C—","heading":"Office of Science and Technology","status":null,"is_section":false}],"xml":"
§ 151. Federal intrusion detection and prevention system(a) DefinitionsIn this section—(1) the term “agency” has the meaning given the term in section 3502 of title 44;\n\n(2) the term “agency information” means information collected or maintained by or on behalf of an agency;\n\n(3) the term “agency information system” has the meaning given the term in section 149 of this title; and\n\n(4) the terms “cybersecurity risk” and “information system” have the meanings given those terms in section 148 of this title.\n\n\n(b) Requirement(1) In generalNot later than 1 year after December 18, 2015, the Secretary shall deploy, operate, and maintain, to make available for use by any agency, with or without reimbursement—(A) a capability to detect cybersecurity risks in network traffic transiting or traveling to or from an agency information system; and\n\n(B) a capability to prevent network traffic associated with such cybersecurity risks from transiting or traveling to or from an agency information system or modify such network traffic to remove the cybersecurity risk.\n\n\n(2) Regular improvement

The Secretary shall regularly deploy new technologies and modify existing technologies to the intrusion detection and prevention capabilities described in paragraph (1) as appropriate to improve the intrusion detection and prevention capabilities.

\n\n\n\n(c) ActivitiesIn carrying out subsection (b), the Secretary—(1) may access, and the head of an agency may disclose to the Secretary or a private entity providing assistance to the Secretary under paragraph (2), information transiting or traveling to or from an agency information system, regardless of the location from which the Secretary or a private entity providing assistance to the Secretary under paragraph (2) accesses such information, notwithstanding any other provision of law that would otherwise restrict or prevent the head of an agency from disclosing such information to the Secretary or a private entity providing assistance to the Secretary under paragraph (2);\n\n(2) may enter into contracts or other agreements with, or otherwise request and obtain the assistance of, private entities to deploy, operate, and maintain technologies in accordance with subsection (b);\n\n(3) may retain, use, and disclose information obtained through the conduct of activities authorized under this section only to protect information and information systems from cybersecurity risks;\n\n(4) shall regularly assess through operational test and evaluation in real world or simulated environments available advanced protective technologies to improve detection and prevention capabilities, including commercial and noncommercial technologies and detection technologies beyond signature-based detection, and acquire, test, and deploy such technologies when appropriate;\n\n(5) shall establish a pilot through which the Secretary may acquire, test, and deploy, as rapidly as possible, technologies described in paragraph (4); and\n\n(6) shall periodically update the privacy impact assessment required under section 208(b) of the E-Government Act of 2002 (44 U.S.C. 3501 note).\n\n\n(d) PrinciplesIn carrying out subsection (b), the Secretary shall ensure that—(1) activities carried out under this section are reasonably necessary for the purpose of protecting agency information and agency information systems from a cybersecurity risk;\n\n(2) information accessed by the Secretary will be retained no longer than reasonably necessary for the purpose of protecting agency information and agency information systems from a cybersecurity risk;\n\n(3) notice has been provided to users of an agency information system concerning access to communications of users of the agency information system for the purpose of protecting agency information and the agency information system; and\n\n(4) the activities are implemented pursuant to policies and procedures governing the operation of the intrusion detection and prevention capabilities.\n\n\n(e) Private entities(1) ConditionsA private entity described in subsection (c)(2) may not—(A) disclose any network traffic transiting or traveling to or from an agency information system to any entity other than the Department or the agency that disclosed the information under subsection (c)(1), including personal information of a specific individual or information that identifies a specific individual not directly related to a cybersecurity risk; or\n\n(B) use any network traffic transiting or traveling to or from an agency information system to which the private entity gains access in accordance with this section for any purpose other than to protect agency information and agency information systems against cybersecurity risks or to administer a contract or other agreement entered into pursuant to subsection (c)(2) or as part of another contract with the Secretary.\n\n\n(2) Limitation on liability

No cause of action shall lie in any court against a private entity for assistance provided to the Secretary in accordance with this section and any contract or agreement entered into pursuant to subsection (c)(2).

\n\n\n(3) Rule of construction

Nothing in paragraph (2) shall be construed to authorize an Internet service provider to break a user agreement with a customer without the consent of the customer.

\n\n\n\n(f) Privacy Officer review

Not later than 1 year after December 18, 2015, the Privacy Officer appointed under section 142 of this title, in consultation with the Attorney General, shall review the policies and guidelines for the program carried out under this section to ensure that the policies and guidelines are consistent with applicable privacy laws, including those governing the acquisition, interception, retention, use, and disclosure of communications.

\n\n\n(Pub. L. 107–296, title II, § 230, as added Pub. L. 114–113, div. N, title II, § 223(a)(6), Dec. 18, 2015, 129 Stat. 2964.)\n\n\nReferences in Text

Section 208(b) of the E-Government Act of 2002, referred to in subsec. (c)(6), is section 208(b) of title II of Pub. L. 107–347, which is set out in a note under section 3501 of Title 44, Public Printing and Documents.

\n\nAgency Responsibilities

Pub. L. 114–113, div. N, title II, § 223(b), Dec. 18, 2015, 129 Stat. 2966, provided that:\n“(1) In general.—Except as provided in paragraph (2)—“(A) not later than 1 year after the date of enactment of this Act [Dec. 18, 2015] or 2 months after the date on which the Secretary makes available the intrusion detection and prevention capabilities under section 230(b)(1) of the Homeland Security Act of 2002 [6 U.S.C. 151(b)(1)], as added by subsection (a), whichever is later, the head of each agency shall apply and continue to utilize the capabilities to all information traveling between an agency information system and any information system other than an agency information system; and\n\n“(B) not later than 6 months after the date on which the Secretary makes available improvements to the intrusion detection and prevention capabilities pursuant to section 230(b)(2) of the Homeland Security Act of 2002 [6 U.S.C. 151(b)(2)], as added by subsection (a), the head of each agency shall apply and continue to utilize the improved intrusion detection and prevention capabilities.\n\n\n“(2) Exception.—The requirements under paragraph (1) shall not apply to the Department of Defense, a national security system, or an element of the intelligence community.\n\n“(3) Definition.—Notwithstanding section 222 [6 U.S.C. 1521], in this subsection, the term ‘agency information system’ means an information system owned or operated by an agency.\n\n“(4) Rule of construction.—Nothing in this subsection shall be construed to limit an agency from applying the intrusion detection and prevention capabilities to an information system other than an agency information system under section 230(b)(1) of the Homeland Security Act of 2002 [6 U.S.C. 151(b)(1)], as added by subsection (a), at the discretion of the head of the agency or as provided in relevant policies, directives, and guidelines.”\n\n\n

\n\n\n
","provision":null,"duplicates":[],"release":{"label":"115-35","currency_date":"2017-05-17","congress":115,"law_num":35,"excluded_laws":[],"update_num":null,"seq":99,"is_partial":false,"caveat":null,"titles_affected":["01","02","05","05a","06","07","08","10","12","15","16","19","20","21","22","23","26","28","30","31","33","36","38","40","41","42","43","48","49","50","51","54"],"ingested_titles":[]},"served_from":{"label":"115-35","currency_date":"2017-05-17","congress":115,"law_num":35,"excluded_laws":[],"update_num":null,"seq":99,"is_partial":false,"caveat":null,"titles_affected":["01","02","05","05a","06","07","08","10","12","15","16","19","20","21","22","23","26","28","30","31","33","36","38","40","41","42","43","48","49","50","51","54"],"ingested_titles":[]},"content_first_seen":{"label":"114-195","currency_date":"2016-07-20","congress":114,"law_num":195,"excluded_laws":[],"update_num":null,"seq":75,"is_partial":false,"caveat":null,"titles_affected":["05","06","22","26","27","28a","49","50"],"ingested_titles":[]},"is_exact":true,"note":null}