Independent board would review cyber incidents and share findings

An independent federal board would review cyber incidents and publish reports. At selection, the board would need to believe all evidence, findings, and recommendations for an incident were unclassified or declassified. The board would work separately from regulatory enforcement and would not assign legal fault or liability. The board would be established 90 days after enactment.

The board could issue subpoenas, which are legal demands for relevant records or testimony. Government bodies and their employees handling matters tied to official duties would be exempt from this subpoena power. An inadequate response to an information request and approval by a board majority would be required. Subpoenaed material would lack the automatic protections for voluntary submissions, though the board could protect it from public disclosure where the law allows.

The board would offer a voluntary, anonymous reporting system for narrowly avoided cyber incidents. People and organizations could report near-misses involving essential services, including events that could have disrupted communications or exposed private data. The system would protect the identity of each person or organization reporting. Reports would help identify shared security weaknesses without assigning fault or liability.

Voluntary records and testimony would be shielded from public-records requests and most use in legal proceedings. Limits on use in legal proceedings would also cover records made solely to prepare a voluntary submission. Investigators could use information against suspected participants in the reported incident without revealing the submission itself. The protection would not block legal requests for records made for other purposes.