S3505-118

1. Short title This Act may be cited as the Defense Support for Cyber Emergencies Response Act of 2023.

2. Selected Reserve order to active duty to respond to a significant cyber incident Section 12304 of title 10, United States Code, is amended— in subsection (a), by striking for any named operational mission; by redesignating subsections (c) through (j) as subsections (d) through (k), respectively; by inserting after subsection (b) the following new subsection: When the Secretary of Defense or the Secretary of the department in which the Coast Guard is operating determines that it is necessary to augment the active armed forces for the response of the Department of Defense or other department under which the Coast Guard is operating, respectively, to a covered incident, such Secretary may, without the consent of the member affected, order any unit, and any member not assigned to a unit organized to serve as a unit of the Selected Reserve (as defined in section 10143(a) of this title), under the respective jurisdiction of such Secretary, to active duty for not more than 365 consecutive days. in paragraph (1) of subsection (d), as redesignated by paragraph (2), by inserting or subsection (c) after subsection (b); in subsection (g), as redesignated by paragraph (2), by inserting or subsection (c) after subsection (a); by amending subsection (h), as redesignated by paragraph (2), to read as follows: Whenever any unit of the Selected Reserve or any member of the Selected Reserve not assigned to a unit organized to serve as a unit, or any member of the Individual Ready Reserve, is ordered to active duty under authority of subsection (a), the service of all units or members so ordered to active duty may be terminated by— order of the President; or law. Whenever any unit of the Selected Reserve or any member of the Selected Reserve not assigned to a unit organized to serve as a unit is ordered to active duty under authority of subsection (c), the service of all units or members so ordered to active duty may be terminated by— order of the Secretary of Defense or, with respect to the Coast Guard, the Secretary of the Department in which the Coast Guard is operating; or law. in subsection (k), as redesignated by paragraph (2)— by redesignating paragraphs (1) and (2) as paragraphs (2) and (3), respectively; and by inserting after the matter preceding paragraph (2), as so redesignated, the following new paragraph: The term covered incident means— a cyber incident involving a Department of Defense information system, or a breach of a Department of Defense system that involves personally identifiable information, that the Secretary of Defense determines is likely to result in demonstrable harm to the national security interests, foreign relations, or the economy of the United States, or to the public confidence, civil liberties, or public health and safety of the people of the United States; a cyber incident involving a Department of Homeland Security information system, or a breach of a Department of Homeland Security system that involves personally identifiable information, that the Secretary of Homeland Security determines is likely to result in demonstrable harm to the national security interests, foreign relations, or the economy of the United States or to the public confidence, civil liberties, or public health and safety of the people of the United States; a cyber incident, or collection of related cyber incidents, that the President determines is likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the people of the United States; or a significant incident declared pursuant to section 2233 of the Homeland Security Act of 2002 (6 U.S.C. 677b). (c)Authority relating to significant cyber incidentsWhen the Secretary of Defense or the Secretary of the department in which the Coast Guard is operating determines that it is necessary to augment the active armed forces for the response of the Department of Defense or other department under which the Coast Guard is operating, respectively, to a covered incident, such Secretary may, without the consent of the member affected, order any unit, and any member not assigned to a unit organized to serve as a unit of the Selected Reserve (as defined in section 10143(a) of this title), under the respective jurisdiction of such Secretary, to active duty for not more than 365 consecutive days. ; (h)Termination of duty(1)Whenever any unit of the Selected Reserve or any member of the Selected Reserve not assigned to a unit organized to serve as a unit, or any member of the Individual Ready Reserve, is ordered to active duty under authority of subsection (a), the service of all units or members so ordered to active duty may be terminated by—(A)order of the President; or(B)law.(2)Whenever any unit of the Selected Reserve or any member of the Selected Reserve not assigned to a unit organized to serve as a unit is ordered to active duty under authority of subsection (c), the service of all units or members so ordered to active duty may be terminated by—(A)order of the Secretary of Defense or, with respect to the Coast Guard, the Secretary of the Department in which the Coast Guard is operating; or(B)law.; and (1)The term covered incident means—(A)a cyber incident involving a Department of Defense information system, or a breach of a Department of Defense system that involves personally identifiable information, that the Secretary of Defense determines is likely to result in demonstrable harm to the national security interests, foreign relations, or the economy of the United States, or to the public confidence, civil liberties, or public health and safety of the people of the United States;(B)a cyber incident involving a Department of Homeland Security information system, or a breach of a Department of Homeland Security system that involves personally identifiable information, that the Secretary of Homeland Security determines is likely to result in demonstrable harm to the national security interests, foreign relations, or the economy of the United States or to the public confidence, civil liberties, or public health and safety of the people of the United States; (C)a cyber incident, or collection of related cyber incidents, that the President determines is likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the people of the United States; or(D)a significant incident declared pursuant to section 2233 of the Homeland Security Act of 2002 (6 U.S.C. 677b)..