Division F — Intelligence Authorization Act for Fiscal Year 2023

“(a) Post-employment Restrictions.—

“(1) Covered post-service position.—

“(A) Permanent restriction.—Except as provided by paragraph (2)(A)(i), an employee of an element of the intelligence community who occupies a covered intelligence position may not occupy a covered post-service position for a designated prohibited foreign country following the date on which the employee ceases to occupy a covered intelligence position.

“(B) Temporary restriction.—Except as provided by paragraph (2)(A)(ii), an employee of an element of the intelligence community who occupies a covered intelligence position may not occupy a covered post-service position during the 30-month period following the date on which the employee ceases to occupy a covered intelligence position.

“(2) Waiver.—

“(A) Authority to grant temporary waiver.—

“(i) Waivers of permanent restriction.—On a case-by-case basis, the Director of National Intelligence may temporarily waive the restriction in paragraph (1)(A) with respect to an employee or former employee who is subject to that restriction only after—

“(I) the employee or former employee submits to the Director a written application for such waiver in such form and manner as the Director determines appropriate;

“(II) the Director determines that not granting such waiver would result in a grave detrimental impact to current or future intelligence operations of the United States; and

“(III) the Director provides the congressional intelligence committees with a detailed justification stating why not granting such waiver would result in a grave detrimental impact to current or future intelligence operations of the United States.

“(ii) Waivers of temporary restriction.—On a case-by-case basis, the Director may temporarily waive the restriction in paragraph (1)(B) with respect to an employee or former employee who is subject to that restriction only after—

“(I) the employee or former employee submits to the Director a written application for such waiver in such form and manner as the Director determines appropriate; and

“(II) the Director determines that such waiver is necessary to advance the national security interests of the United States.

“(B) Period of waiver.—A waiver issued under subparagraph (A) shall apply for a period not exceeding 5 years. The Director may renew such a waiver.

“(C) Revocation.—The Director may revoke a waiver issued under subparagraph (A) to an employee or former employee, effective on the date that is 60 days after the date on which the Director provides the employee or former employee written notice of such revocation.

“(D) Tolling.—The 30-month restriction in paragraph (1)(B) shall be tolled for an employee or former employee during the period beginning on the date on which a waiver is issued under subparagraph (A) and ending on the date on which the waiver expires or on the effective date of a revocation under subparagraph (C), as the case may be.

“(E) Notification.—Not later than 30 days after the date on which the Director issues a waiver under subparagraph (A) or a revocation of a waiver under subparagraph (C), the Director shall submit to the congressional intelligence committees written notification of the waiver or revocation, as the case may be. Such notification shall include the following:

“(i) With respect to a waiver issued to an employee or former employee—

“(I) the details of the application, including the covered intelligence position held or formerly held by the employee or former employee;

“(II) the nature of the activities of the employee or former employee after ceasing to occupy a covered intelligence position;

“(III) a description of the national security interests that will be advanced by reason of issuing such waiver; and

“(IV) the specific reasons why the Director determines that issuing such waiver will advance such interests.

“(ii) With respect to a revocation of a waiver issued to an employee or former employee—

“(I) the details of the waiver, including any renewals of such waiver, and the dates of such waiver and renewals; and

“(II) the specific reasons why the Director determined that such revocation is warranted.

“(b) Covered Post-service Employment Reporting.—

“(1) Requirement.—During the period described in paragraph (2), an employee who ceases to occupy a covered intelligence position shall—

“(A) report covered post-service employment to the head of the element of the intelligence community that employed such employee in such covered intelligence position upon accepting such covered post-service employment; and

“(B) annually (or more frequently if the head of such element considers it appropriate) report covered post-service employment to the head of such element.

“(2) Period described.—The period described in this paragraph is the period beginning on the date on which an employee ceases to occupy a covered intelligence position.

“(3) Regulations.—The head of each element of the intelligence community shall issue regulations requiring, as a condition of employment, each employee of such element occupying a covered intelligence position to sign a written agreement requiring the regular reporting of covered post-service employment to the head of such element pursuant to paragraph (1).”

“SEC. 121. COUNTERINTELLIGENCE AND NATIONAL SECURITY PROTECTIONS FOR INTELLIGENCE COMMUNITY GRANT FUNDING.

“(a) Disclosure as Condition for Receipt of Grant.—The head of an element of the intelligence community may not award a grant to a person or entity unless the person or entity has certified to the head of the element that the person or entity has disclosed to the head of the element any material financial or material in-kind support that the person or entity knows, or should have known, derives from the People’s Republic of China, the Russian Federation, the Islamic Republic of Iran, the Democratic People’s Republic of Korea, or the Republic of Cuba, during the 5-year period ending on the date of the person or entity’s application for the grant.

“(b) Process for Review of Grant Applicants Prior to Award.—

“(1) In general.—The head of an element of the intelligence community may not award a grant to a person or entity who submitted a certification under subsection (a) until such certification is received by the head of an element of the intelligence community and submitted to the Director of National Intelligence pursuant to the process set forth in paragraph (2).

“(2) Process.—

“(A) In general.—The Director of National Intelligence, in coordination with such heads of elements of the intelligence community as the Director considers appropriate, shall establish a process to review the awarding of a grant to an applicant who submitted a certification under subsection (a).

“(B) Elements.—The process established under subparagraph (A) shall include the following:

“(i) The immediate transmission of a copy of each applicant’s certification made under subsection (a) to the Director of National Intelligence.

“(ii) The review of the certification and any accompanying disclosures submitted under subsection (a) as soon as practicable.

“(iii) Authorization for the heads of the elements of the intelligence community to take such actions as may be necessary, including denial or revocation of a grant, to ensure a grant does not pose an unacceptable risk of—

“(I) misappropriation of United States intellectual property, research and development, and innovation efforts; or

“(II) other counterintelligence threats.

“(c) Annual Report Required.—Not later than 1 year after the date of the enactment of the Intelligence Authorization Act for Fiscal Year 2023 and not less frequently than once each year thereafter, the Director of National Intelligence shall submit to the congressional intelligence committees an annual report identifying the following for the 1-year period covered by the report:

“(1) The number of applications for grants received by each element of the intelligence community.

“(2) The number of such applications that were reviewed using the process established under subsection (b)(2), disaggregated by element of the intelligence community.

“(3) The number of such applications that were denied and the number of grants that were revoked, pursuant to the process established under subsection (b)(2), disaggregated by element of the intelligence community.”

“Sec. 121. Counterintelligence and national security protections for intelligence community grant funding.”.

“(c) Use by Federal Government.—

“(1) Secretary of defense authority.—With respect to a covered author who produces a covered work in the course of employment at a covered institution described in subparagraphs (A) through (L) of subsection (d)(2), the Secretary of Defense may direct the covered author to provide the Federal Government with an irrevocable, royalty-free, worldwide, nonexclusive license to reproduce, distribute, perform, or display such covered work for purposes of the United States Government.

“(2) Director of national intelligence authority.—With respect to a covered author who produces a covered work in the course of employment at the covered institution described in subsection (d)(2)(M), the Director of National Intelligence may direct the covered author to provide the Federal Government with an irrevocable, royalty-free, world-wide, nonexclusive license to reproduce, distribute, perform, or display such covered work for purposes of the United States Government.”

; and

“(M) National Intelligence University.”

“SEC. 313. INSIDER THREAT POLICY COMPLIANCE AND REPORTING.

“The head of each element of the intelligence community shall—

“(1) implement the policy established in accordance with section 102A(f)(8); and

“(2) concurrent with the submission to Congress of budget justification materials in support of the budget of the President for a fiscal year that is submitted to Congress under section 1105(a) of title 31, United States Code, submit to Congress a certification as to whether the element is in compliance with such policy.”

“Sec. 313. Insider threat policy compliance and reporting.”.

“SEC. 515. SUBMISSION OF COVERED DOCUMENTS AND CLASSIFIED ANNEXES.

“(a) Covered Document Defined.—In this section, the term ‘covered document’ means any executive order, memorandum, or policy directive issued by the President, including national security Presidential memoranda and Presidential policy directives, or such successor memoranda and directives.

“(b) Requirement.—Not later than 7 days after the date on which the President issues or amends a covered document, the President, acting through the Director of National Intelligence, shall submit to the congressional intelligence committees, the Subcommittee on Defense of the Committee on Appropriations of the Senate, and the Subcommittee on Defense of the Committee on Appropriations of the House of Representatives the covered document and any classified annex accompanying that document if such covered document or annex contains a direction to, establishes a requirement for, or includes a restriction on any element of the intelligence community.”

“SEC. 1102A. MEASURES TO MITIGATE COUNTERINTELLIGENCE THREATS FROM PROLIFERATION AND USE OF FOREIGN COMMERCIAL SPYWARE.

“(a) Definitions.—In this section:

“(1) Appropriate congressional committees.—The term ‘appropriate congressional committees’ means—

“(A) the Select Committee on Intelligence, the Committee on Foreign Relations, the Committee on Armed Services, the Committee on Banking, Housing, and Urban Affairs, the Committee on the Judiciary, the Committee on Appropriations, and the Committee on Homeland Security and Governmental Affairs of the Senate; and

“(B) the Permanent Select Committee on Intelligence, the Committee on Foreign Affairs, the Committee on Armed Services, the Committee on Financial Services, the Committee on the Judiciary, the Committee on Appropriations, the Committee on Homeland Security, and the Committee on Oversight and Reform of the House of Representatives.

“(2) Covered entity.—The term ‘covered entity’ means any foreign company that either directly or indirectly develops, maintains, owns, operates, brokers, markets, sells, leases, licenses, or otherwise makes available spyware.

“(3) Foreign commercial spyware.—The term ‘foreign commercial spyware’ means spyware that is developed (solely or in partnership with a foreign company), maintained, sold, leased, licensed, marketed, sourced (in whole or in part), or otherwise provided, either directly or indirectly, by a foreign company.

“(4) Foreign company.—The term ‘foreign company’ means a company that is incorporated or domiciled outside of the United States, including any subsidiaries or affiliates wherever such subsidiaries or affiliates are domiciled or incorporated.

“(5) Spyware.—The term ‘spyware’ means a tool or set of tools that operate as an end-to-end system of software to provide an unauthorized user remote access to information stored on or transiting through an electronic device connected to the Internet and not owned or operated by the unauthorized user, including end-to-end systems that—

“(A) allow an unauthorized user to remotely infect electronic devices with malicious software, including without any action required by the user of the device;

“(B) can record telecommunications or other audio captured on a device not owned by the unauthorized user;

“(C) undertake geolocation, collect cell site location information, or otherwise track the location of a device or person using the internal sensors of an electronic device not owned by the unauthorized user;

“(D) allow an unauthorized user access to and the ability to retrieve information on the electronic device, including text messages, files, e-mails, transcripts of chats, contacts, photos, and browsing history; or

“(E) any additional criteria described in publicly available documents published by the Director of National Intelligence, such as whether the end-to-end system is used outside the context of a codified lawful intercept system.

“(b) Annual Assessments of Counterintelligence Threats.—

“(1) Requirement.—Not later than 90 days after the enactment of the Intelligence Authorization Act for Fiscal Year 2023, and annually thereafter, the Director of National Intelligence, in coordination with the Director of the Central Intelligence Agency, the Director of the National Security Agency, and the Director of the Federal Bureau of Investigation, shall submit to the appropriate congressional committees a report with an accompanying classified annex containing an assessment of the counterintelligence threats and other risks to the national security of the United States posed by the proliferation of foreign commercial spyware. The assessment shall incorporate all credible data, including open-source information.

“(2) Elements.—Each report under paragraph (1) shall include the following, if known:

“(A) A list of the most significant covered entities.

“(B) A description of the foreign commercial spyware marketed by the covered entities identified under subparagraph (A) and an assessment by the intelligence community of the foreign commercial spyware.

“(C) An assessment of the counterintelligence risk to the intelligence community or personnel of the intelligence community posed by foreign commercial spyware.

“(D) For each covered entity identified in subparagraph (A), details of any subsidiaries, resellers, or other agents acting on behalf of the covered entity.

“(E) Details of where each covered entity identified under subparagraphs (A) and (D) is domiciled.

“(F) A description of how each covered entity identified under subparagraphs (A) and (D) is financed, where the covered entity acquired its capital, and the organizations and individuals having substantial investments or other equities in the covered entity.

“(G) An assessment by the intelligence community of any relationship between each covered entity identified in subparagraphs (A) and (D) and any foreign government, including any export controls and processes to which the covered entity is subject.

“(H) A list of the foreign customers of each covered entity identified in subparagraphs (A) and (D), including the understanding by the intelligence community of the organizations and end-users within any foreign government.

“(I) With respect to each foreign customer identified under subparagraph (H), an assessment by the intelligence community regarding how the foreign customer is using the spyware, including whether the foreign customer has targeted personnel of the intelligence community.

“(J) With respect to the first report required under paragraph (1), a mitigation plan to reduce the exposure of personnel of the intelligence community to foreign commercial spyware.

“(K) With respect to each report following the first report required under paragraph (1), details of steps taken by the intelligence community since the previous report to implement measures to reduce the exposure of personnel of the intelligence community to foreign commercial spyware.

“(3) Classified annex.—In submitting the report under subsection (2), the Director shall also include an accompanying but separate classified annex, providing a watchlist of companies selling, leasing, or otherwise providing foreign commercial spyware that the Director determines are engaged in activities that pose a counterintelligence risk to personnel of the intelligence community.

“(4) Form.—Each report under paragraph (1) shall be submitted in classified form.

“(5) Dissemination.—The Director of National Intelligence shall separately distribute each report under paragraph (1) and each annex under paragraph (3) to the President, the heads of all elements of the intelligence community, the Secretary of State, the Attorney General, the Secretary of Commerce, the Secretary of Homeland Security, the National Cyber Director, and the heads of any other departments or agencies the Director of National Intelligence determines appropriate.

“(c) Authority to Prohibit Purchase or Use by Intelligence Community.—

“(1) Foreign commercial spyware.—

“(A) In general.—The Director of National Intelligence may prohibit any element of the intelligence community from procuring, leasing, or otherwise acquiring on the commercial market, or extending or renewing a contract to procure, lease, or otherwise acquire, foreign commercial spyware.

“(B) Considerations.—In determining whether and how to exercise the authority under subparagraph (A), the Director of National Intelligence shall consider—

“(i) the assessment of the intelligence community of the counterintelligence threats or other risks to the United States posed by foreign commercial spyware;

“(ii) the assessment of the intelligence community of whether the foreign commercial spyware has been used to target United States Government personnel.

“(iii) whether the original owner or developer retains any of the physical property or intellectual property associated with the foreign commercial spyware;

“(iv) whether the original owner or developer has verifiably destroyed all copies of the data collected by or associated with the foreign commercial spyware;

“(v) whether the personnel of the original owner or developer retain any access to data collected by or associated with the foreign commercial spyware;

“(vi) whether the use of the foreign commercial spyware requires the user to connect to an information system of the original owner or developer or information system of a foreign government; and

“(vii) whether the foreign commercial spyware poses a counterintelligence risk to the United States or any other threat to the national security of the United States.

“(2) Company that has acquired foreign commercial spyware.—

“(A) Authority.—The Director of National Intelligence may prohibit any element of the intelligence community from entering into any contract or other agreement for any purpose with a company that has acquired, in whole or in part, any foreign commercial spyware.

“(B) Considerations.—In considering whether and how to exercise the authority under subparagraph (A), the Director of National Intelligence shall consider—

“(i) whether the original owner or developer of the foreign commercial spyware retains any of the physical property or intellectual property associated with the spyware;

“(ii) whether the original owner or developer of the foreign commercial spyware has verifiably destroyed all data, and any copies thereof, collected by or associated with the spyware;

“(iii) whether the personnel of the original owner or developer of the foreign commercial spyware retain any access to data collected by or associated with the foreign commercial spyware;

“(iv) whether the use of the foreign commercial spyware requires the user to connect to an information system of the original owner or developer or information system of a foreign government; and

“(v) whether the foreign commercial spyware poses a counterintelligence risk to the United States or any other threat to the national security of the United States.

“(3) Notifications of prohibition.—Not later than 30 days after the date on which the Director of National Intelligence exercises the authority to issue a prohibition under subsection (c), the Director of National Intelligence shall notify the congressional intelligence committees of such exercise of authority. Such notice shall include—

“(A) a description of the circumstances under which the prohibition was issued;

“(B) an identification of the company or product covered by the prohibition;

“(C) any information that contributed to the decision of the Director of National Intelligence to exercise the authority, including any information relating to counterintelligence or other risks to the national security of the United States posed by the company or product, as assessed by the intelligence community; and

“(D) an identification of each element of the intelligence community to which the prohibition has been applied.

“(4) Waiver authority.—

“(A) In general.—The head of an element of the intelligence community may request from the Director of National Intelligence the waiver of a prohibition made under paragraph (1) or (2).

“(B) Director of national intelligence determination.—The Director of National Intelligence, upon receiving the waiver request in subparagraph (A), may issue a waiver for a period not to exceed one year in response to the request from the head of an element of the intelligence community if such waiver is in the national security interest of the United States.

“(C) Notice.—Not later than 30 days after approving a waiver request pursuant to subparagraph (B), the Director of National Intelligence shall submit to the congressional intelligence committees, the Subcommittee on Defense of the Committee on Appropriations of the Senate, and the Subcommittee on Defense of the Committee on Appropriations of the House of Representatives a written notification. The notification shall include—

“(i) an identification of the head of the element of the intelligence community that requested the waiver;

“(ii) the details of the waiver request, including the national security interests of the United States;

“(iii) the rationale and basis for the determination that the waiver is in the national security interests of the United States;

“(iv) the considerations that informed the ultimate determination of the Director of National Intelligence to issue the wavier; and

“(v) and any other considerations contributing to the determination, made by the Director of National Intelligence.

“(D) Waiver termination.—The Director of National Intelligence may revoke a previously granted waiver at any time. Upon revocation of a waiver, the Director of National Intelligence shall submit a written notification to the congressional intelligence committees, the Subcommittee on Defense of the Committee on Appropriations of the Senate, and the Subcommittee on Defense of the Committee on Appropriations of the House of Representatives not later than 30 days after making a revocation determination.

“(5) Termination of prohibition.—The Director of National Intelligence may terminate a prohibition made under paragraph (1) or (2) at any time. Upon termination of a prohibition, the Director of National Intelligence shall submit a notification of the termination to the congressional intelligence committees, the Subcommittee on Defense of the Committee on Appropriations of the Senate, and the Subcommittee on Defense of the Committee on Appropriations of the House of Representatives not later than 30 days after terminating a prohibition, detailing the basis for the termination, including any United States national security interests that may be affected by such termination.”

“(aa) a matter of national security; and

“(bb) not a difference of opinion concerning public policy matters.”

“(I) a matter of national security; and

“(II) not a difference of opinion concerning public policy matters.”

“(AA) a matter of national security; and

“(BB) not a difference of opinion concerning public policy matters.”