§ 395. Notification requirements for sensitive military cyber operations

Legislative history

Reconstructed from this section’s Code source credit and amendment notes, resolved against the local Statutes at Large. Editorial notes are evidence, not the law that made the change.

1. 2017

   National Defense Authorization Act for Fiscal Year 2018

   Pub. L. 115–91 div. A title XVI § 1631(a) · 131 Stat. 1283

   Enacted · 10 U.S.C. § 395

   Added Pub. L. 115–91, div. A, title XVI, § 1631(a), Dec. 12, 2017, 131 Stat. 1736, § 130j

   Source evidence

   Code source credit
   Added Pub. L. 115–91, div. A, title XVI, § 1631(a), Dec. 12, 2017, 131 Stat. 1736, § 130j

   Enacted provision · exact public law section
   (a) Notification.— Chapter 3 of title 10, United States Code, is amended by adding at the end the following new sections: “§ 130j. Notification requirements for sensitive military cyber operations “(a) In General.— Except as provided in subsection (d), the Secretary of Defense shall promptly submit to the congressional defense committees notice in writing of any sensitive military cyber operation conducted under this title no later than 48 hours following such operation. “(b) Procedures.— (1) The Secretary of Defense shall establish and submit to the congressional defense committees procedures for complying with the requirements of subsection (a) consistent with the national security of the United States and the protection of operational integrity. The Secretary shall promptly notify the congressional defense committees in writing of any changes to such procedures at least 14 days prior to the adoption of any such changes. “(2) The congressional defense committees shall ensure that committee procedures designed to protect from unauthorized disclosure classified information relating to national security of the United States are sufficient to protect the information that is submitted to the committees pursuant to this section. “(3) In the event of an unauthorized disclosure of a sensitive military cyber operation covered by this section, the Secretary shall ensure, to the maximum extent practicable, that the congressional defense committees are notified immediately of the sensitive military cyber operation concerned. The notification under this paragraph may be verbal or written, but in the event of a verbal notification a written notification shall be provided by not later than 48 hours after the provision of the verbal notification. “(c) Sensitive Military Cyber Operation Defined.— (1) In this section, the term ‘sensitive military cyber operation’ means an action described in paragraph (2) that— “(A) is carried out by the armed forces of the United States; and “(B) is intended to cause cyber effects outside a geographic location— “(i) where the armed forces of the United States are involved in hostilities (as that term is used in section 1543 of title 50, United States Code); or “(ii) with respect to which hostilities have been declared by the United States. “(2) The actions described in this paragraph are the following: “(A) An offensive cyber operation. “(B) A defensive cyber operation outside the Department of Defense Information Networks to defeat an ongoing or imminent threat. “(d) Exceptions.— The notification requirement under subsection (a) does not apply— “(1) to a training exercise conducted with the consent of all nations where the intended effects of the exercise will occur; or “(2) to a covert action (as that term is defined in section 3093 of title 50, United States Code). “(e) Rule of Construction.— Nothing in this section shall be construed to provide any new authority or to alter or otherwise affect the War Powers Resolution (50 U.S.C. 1541 et seq.), the Authorization for Use of Military Force (Public Law 107–40; 50 U.S.C. 1541 note), or any requirement under the National Security Act of 1947 (50 U.S.C. 3001 et seq.). “§ 130k. Notification requirements for cyber weapons “(a) In General.— Except as provided in subsection (c), the Secretary of Defense shall promptly submit to the congressional defense committees notice in writing of the following: “(1) With respect to a cyber capability that is intended for use as a weapon, on a quarterly basis, the aggregated results of all reviews of the capability for legality under international law pursuant to Department of Defense Directive 5000.01 carried out by any military department concerned. “(2) The use as a weapon of any cyber capability that has been approved for such use under international law by a military department no later than 48 hours following such use. “(b) Procedures.— (1) The Secretary of Defense shall establish and submit to the congressional defense committees procedures for complying with the requirements of subsection (a) consistent with the national security of the United States and the protection of operational integrity. The Secretary shall promptly notify the congressional defense committees in writing of any changes to such procedures at least 14 days prior to the adoption of any such changes. “(2) The congressional defense committees shall ensure that committee procedures designed to protect from unauthorized disclosure classified information relating to national security of the United States are sufficient to protect the information that is submitted to the committees pursuant to this section. “(3) In the event of an unauthorized disclosure of a cyber capability covered by this section, the Secretary shall ensure, to the maximum extent practicable, that the congressional defense committees are notified immediately of the cyber capability concerned. The notification under this paragraph may be verbal or written, but in the event of a verbal notification a written notification shall be provided by not later than 48 hours after the provision of the verbal notification. “(c) Exceptions.— The notification requirement under subsection (a) does not apply— “(1) to a training exercise conducted with the consent of all nations where the intended effects of the exercise will occur; or “(2) to a covert action (as that term is defined in section 3093 of title 50, United States Code). “(d) Rule of Construction.— Nothing in this section shall be construed to provide any new authority or to alter or otherwise affect the War Powers Resolution (50 U.S.C. 1541 et seq.), the Authorization for Use of Military Force (Public Law 107–40; 50 U.S.C. 1541 note), or any requirement under the National Security Act of 1947 (50 U.S.C. 3001 et seq.).” .

2. 2018

   John S. McCain National Defense Authorization Act for Fiscal Year 2019

   Pub. L. 115–232 § 1631(a) · 132 Stat. 1636

   Changed · 10 U.S.C. § 395

   Pub. L. 115–232, § 1631(a), renumbered section 130j of this title as this section

   Source evidence

   Code amendment note
   Pub. L. 115–232, § 1631(a), renumbered section 130j of this title as this section.

   Enacted provision · exact public law section
   (a) In General.— Part I of subtitle A of title 10, United States Code, is amended— (1) by transferring sections 130g, 130j, and 130k to chapter 19 of such part to appear after section 393 of such chapter; and (2) by redesignating such sections 130g, 130j, and 130k, as transferred by paragraph (1), as sections 394, 395, and 396, respectively.

3. 2018

   John S. McCain National Defense Authorization Act for Fiscal Year 2019

   Pub. L. 115–232 § 1081(a)(1) · 132 Stat. 1636

   Substituted · 10 U.S.C. § 395(d)(2)

   Pub. L. 115–232, § 1081(a)(1), substituted “section 503 of the National Security Act of 1947 (50 U.S.C. 3093)” for “section 3093 of title 50, United States Code”

   Source evidence

   Code amendment note
   Subsec. (d)(2). Pub. L. 115–232, § 1081(a)(1), substituted “section 503 of the National Security Act of 1947 (50 U.S.C. 3093)” for “section 3093 of title 50, United States Code”.

   Enacted provision · exact public law section
   (1) Sections 130j and 130k, as added by section 1631 of the National Defense Authorization Act for Fiscal Year 2018 (Public Law 115–91; 131 Stat. 1736), are amended by striking “section 3093 of title 50, United States Code” both places it appears and inserting “section 503 of the National Security Act of 1947 (50 U.S.C. 3093)”.

4. 2019

   National Defense Authorization Act for Fiscal Year 2020

   Pub. L. 116–92 § 1632(1) · 133 Stat. 1198

   Inserted · 10 U.S.C. § 395(b)(3)

   Pub. L. 116–92, § 1632(1), inserted “, signed by the Secretary, or the Secretary’s designee,” after “written notification”

   Source evidence

   Code amendment note
   Subsec. (b)(3). Pub. L. 116–92, § 1632(1), inserted “, signed by the Secretary, or the Secretary’s designee,” after “written notification”.

   Enacted provision · exact public law section
   (1) in subsection (b)(3), by inserting “, signed by the Secretary, or the Secretary’s designee,” after “written notification”; and

5. 2019

   National Defense Authorization Act for Fiscal Year 2020

   Pub. L. 116–92 § 1632(2)(A) · 133 Stat. 1198

   1. Added · 10 U.S.C. § 395(c)(1)(B); 10 U.S.C. § 395(c)(1)(C)

      Pub. L. 116–92, § 1632(2)(A), added subpar. (B)

   2. Redesignated · 10 U.S.C. § 395(c)(1)(B); 10 U.S.C. § 395(c)(1)(C)

      Pub. L. 116–92, § 1632(2)(A), redesignated former subpar. (B) as (C)

   Source evidence

   Code amendment note
   Subsec. (c)(1)(B), (C). Pub. L. 116–92, § 1632(2)(A), added subpar. (B) and redesignated former subpar. (B) as (C).

   Enacted provision · exact public law section
   (A) in paragraph (1)— (i) in subparagraph (A), by striking “and” after the semicolon at the end; (ii) by redesignating subparagraph (B) as subparagraph (C); and (iii) by inserting after subparagraph (A) the following new subparagraph: “(B) is determined to— “(i) have a medium or high collateral effects estimate; “(ii) have a medium or high intelligence gain or loss; “(iii) have a medium or high probability of political retaliation, as determined by the political military assessment contained within the associated concept of operations; “(iv) have a medium or high probability of detection when detection is not intended; or “(v) result in medium or high collateral effects; and” ; and

6. 2019

   National Defense Authorization Act for Fiscal Year 2020

   Pub. L. 116–92 § 1632(2)(B) · 133 Stat. 1198

   Struck · 10 U.S.C. § 395(c)(2)(B)

   Pub. L. 116–92, § 1632(2)(B), struck out “outside the Department of Defense Information Networks to defeat an ongoing or imminent threat” after “A defensive cyber operation”

   Source evidence

   Code amendment note
   Subsec. (c)(2)(B). Pub. L. 116–92, § 1632(2)(B), struck out “outside the Department of Defense Information Networks to defeat an ongoing or imminent threat” after “A defensive cyber operation”.

   Enacted provision · exact public law section
   (B) in paragraph (2)(B), by striking “outside the Department of Defense Information Networks to defeat an ongoing or imminent threat”.

7. 2021

   William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021

   Pub. L. 116–283 div. A title XVII § 1702 · 134 Stat. 3388

   Amended · 10 U.S.C. § 395(c)

   Pub. L. 116–283 amended subsec. (c) generally. Prior to amendment, subsec. (c) defined “sensitive military cyber operation” as used in this section

   Source evidence

   Code amendment note
   Subsec. (c). Pub. L. 116–283 amended subsec. (c) generally. Prior to amendment, subsec. (c) defined “sensitive military cyber operation” as used in this section.

   Enacted provision · exact public law section
   SEC. 1702. MODIFICATION OF SCOPE OF NOTIFICATION REQUIREMENTS FOR SENSITIVE MILITARY CYBER OPERATIONS.   Subsection (c) of section 395 of title 10, United States Code, is amended to read as follows: “(c) Sensitive Military Cyber Operation Defined.— (1) In this section, the term ‘sensitive military cyber operation’ means an action described in paragraph (2) that— “(A) is carried out by the armed forces of the United States; “(B) is intended to achieve a cyber effect against a foreign terrorist organization or a country, including its armed forces and the proxy forces of that country located elsewhere— “(i) with which the armed forces of the United States are not involved in hostilities (as that term is used in section 4 of the War Powers Resolution (50 U.S.C. 1543)); or “(ii) with respect to which the involvement of the armed forces of the United States in hostilities has not been acknowledged publicly by the United States; and “(C) (i) is determined to— “(I) have a medium or high collateral effects estimate; “(II) have a medium or high intelligence gain or loss; “(III) have a medium or high probability of political retaliation, as determined by the political military assessment contained within the associated concept of operations; “(IV) have a medium or high probability of detection when detection is not intended; or “(V) result in medium or high collateral effects; or “(ii) is a matter the Secretary determines to be appropriate. “(2) The actions described in this paragraph are the following: “(A) An offensive cyber operation. “(B) A defensive cyber operation.” .

8 of 8 references resolved to an enrolled provision