Cybersecurity cooperation with the Government of Panama and the Panama Canal Authority

(a) Cybersecurity integration (1) In general The Secretary of Defense, using existing authorities of the Secretary, may establish a pilot program in Panama— (A) to enhance the cybersecurity capabilities of the Panama Canal Authority and the national security forces of Panama; and (B) to increase cybersecurity cooperation measures between the United States and Panama in current and future joint military training exercises. (2) Purposes The purposes of the cybersecurity cooperation under paragraph (1) are— (A) to assist in implementing the Cyber Cooperation Arrangement; (B) to provide training and technical assistance to, and enhance joint cooperation with, the national security forces of Panama so as to improve mitigation, deterrence, and detection of ransomware attacks on, and vulnerabilities of, critical infrastructure in and around the Panama Canal; and (C) to incorporate cybersecurity cooperation measures into current and potential United States-Panama joint military training exercises so as to improve the security of the Panama Canal. (3) Activities Activities of the Department of Defense to further the purposes described in paragraph (2) may include the following: (A) Provision of education and training to, and information sharing with, the Panama Canal Authority and the national security forces of Panama. (B) Collaboration on cyber incident response best practices with the Panama Canal Authority and the national security forces of Panama. (C) Provision of technical assistance to the Panama Canal Authority and the national security forces of Panama to detect and mitigate cybersecurity attacks. (D) Development of supply chain security best practices and building a trusted vendor network with the Panama Canal Authority and the national security forces of Panama. (E) Engagement with the national security forces of Panama on joint cybersecurity training exercises and other information-sharing and domain awareness activities relating to cybersecurity, including by— (i) encouraging the participation of the Government of Panama in existing cybersecurity training facilitated or managed by the Department and approved by the Secretary; (ii) incorporating cybersecurity into existing joint training exercises, such as PANAMAX; and (iii) conducting an annual joint tabletop cybersecurity exercise. (4) Report Not later than one year after the date of the enactment of this Act, and annually thereafter through 2030, the Secretary shall— (A) submit to the congressional defense committees a report on— (i) the implementation of this section and any challenges relating to such implementation; (ii) any known cyber threats relating to Panama, such as incidents of ransomware attacks on critical infrastructure in and around the Panama Canal; and (iii) actions taken to address and mitigate such threats; and (B) provide the congressional defense committees with a briefing on such report. (5) Protection of sensitive information Any activity carried out under this section shall be conducted in a manner that appropriately protects sensitive information and the national security interests of the United States. (b) Definitions In this section: (1) Critical infrastructure The term critical infrastructure has the meaning given such term in section 1016(e) of the Critical Infrastructure Protection Act of 2001 (42 U.S.C. 5195c(e)). (2) Panama Canal Authority The term Panama Canal Authority has the meaning given such term in section 3(d) of the Panama Canal Act of 1979 (22 U.S.C. 3602(d)). (3) PANAMAX The term PANAMAX refers to— (A) an annual bilateral and multinational military exercise and training series relating to the security of the Panama Canal carried out in coordination with United States Southern Command and the military or security forces of— (i) the governments of countries in Latin America and the Caribbean; and (ii) certain European countries; and (B) any related exercises conducted in Panama. (4) Ransomware attack The term ransomware attack has the meaning given such term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).

(a) Cybersecurity integration (1) In general The Secretary of Defense, using existing authorities of the Secretary, may establish a pilot program in Panama— (A) to enhance the cybersecurity capabilities of the Panama Canal Authority and the national security forces of Panama; and (B) to increase cybersecurity cooperation measures between the United States and Panama in current and future joint military training exercises. (2) Purposes The purposes of the cybersecurity cooperation under paragraph (1) are— (A) to assist in implementing the Cyber Cooperation Arrangement; (B) to provide training and technical assistance to, and enhance joint cooperation with, the national security forces of Panama so as to improve mitigation, deterrence, and detection of ransomware attacks on, and vulnerabilities of, critical infrastructure in and around the Panama Canal; and (C) to incorporate cybersecurity cooperation measures into current and potential United States-Panama joint military training exercises so as to improve the security of the Panama Canal. (3) Activities Activities of the Department of Defense to further the purposes described in paragraph (2) may include the following: (A) Provision of education and training to, and information sharing with, the Panama Canal Authority and the national security forces of Panama. (B) Collaboration on cyber incident response best practices with the Panama Canal Authority and the national security forces of Panama. (C) Provision of technical assistance to the Panama Canal Authority and the national security forces of Panama to detect and mitigate cybersecurity attacks. (D) Development of supply chain security best practices and building a trusted vendor network with the Panama Canal Authority and the national security forces of Panama. (E) Engagement with the national security forces of Panama on joint cybersecurity training exercises and other information-sharing and domain awareness activities relating to cybersecurity, including by— (i) encouraging the participation of the Government of Panama in existing cybersecurity training facilitated or managed by the Department and approved by the Secretary; (ii) incorporating cybersecurity into existing joint training exercises, such as PANAMAX; and (iii) conducting an annual joint tabletop cybersecurity exercise. (4) Report Not later than one year after the date of the enactment of this Act, and annually thereafter through 2030, the Secretary shall— (A) submit to the congressional defense committees a report on— (i) the implementation of this section and any challenges relating to such implementation; (ii) any known cyber threats relating to Panama, such as incidents of ransomware attacks on critical infrastructure in and around the Panama Canal; and (iii) actions taken to address and mitigate such threats; and (B) provide the congressional defense committees with a briefing on such report. (5) Protection of sensitive information Any activity carried out under this section shall be conducted in a manner that appropriately protects sensitive information and the national security interests of the United States. (b) Definitions In this section: (1) Critical infrastructure The term critical infrastructure has the meaning given such term in section 1016(e) of the Critical Infrastructure Protection Act of 2001 (42 U.S.C. 5195c(e)). (2) Panama Canal Authority The term Panama Canal Authority has the meaning given such term in section 3(d) of the Panama Canal Act of 1979 (22 U.S.C. 3602(d)). (3) PANAMAX The term PANAMAX refers to— (A) an annual bilateral and multinational military exercise and training series relating to the security of the Panama Canal carried out in coordination with United States Southern Command and the military or security forces of— (i) the governments of countries in Latin America and the Caribbean; and (ii) certain European countries; and (B) any related exercises conducted in Panama. (4) Ransomware attack The term ransomware attack has the meaning given such term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).