Security of artificial intelligence systems and laboratories

(a) Definitions In this section: (1) Center The term Center means the Artificial Intelligence Security Center of the National Security Agency. (2) Classified information The term classified information has the meaning given such term in section 805 of the National Security Act of 1947 (50 U.S.C. 3164). (3) Cleared industry personnel The term cleared industry personnel means employees or representatives of a covered person who hold an appropriate security clearance and have a demonstrated need to know. (4) Congressional intelligence committees The term congressional intelligence committees has the meaning given such term in section 3 of the National Security Act of 1947 (50 U.S.C. 3003). (5) Covered person The term covered person means a non-Federal person who— (A) is a United States person; (B) develops, deploys, or operates artificial intelligence models or critical enabling infrastructure; and (C) provides the services described in subparagraph (B) to a Federal department or agency. (6) Director The term Director means the Director of the National Security Agency. (7) Foreign adversary country The term foreign adversary country has the meaning given such term in section 2(c) of the Protecting Americans' Data from Foreign Adversaries Act of 2024 (15 U.S.C. 9901(c)). (8) Foreign entity of concern The term foreign entity of concern means— (A) a foreign adversary country; or (B) any entity that is controlled or acting under the direction of a foreign adversary country. (9) Intelligence The term intelligence has the meaning given such term in section 3 of the National Security Act of 1947 (50 U.S.C. 3003). (10) Intelligence community The term intelligence community has the meaning given such term in section 3 of the National Security Act of 1947 (50 U.S.C. 3003). (11) Security clearance The term security clearance means an authorization to access classified information. (12) Threat information The term threat information means information on— (A) efforts by foreign adversary countries to use products or research of covered persons or other entities or individuals to generate synthetic media for foreign-directed influence campaigns, develop and manage computer network exploitation campaigns, design or develop weapons systems, or enhance surveillance capabilities in ways that undermine the privacy or threaten the security of citizens of the United States; (B) threats posed by foreign entities of concern, including indications of compromise to networks associated with covered persons or other technical indicators, indicating a compromise to the confidentiality, integrity, or availability of an artificial intelligence system, or to the supply chain of an artificial intelligence system, including training or test data, frameworks or software libraries, training or inference computing environments, or other components necessary for the training, management, deployment, or maintenance of an artificial intelligence system; (C) activity of foreign entities of concern to clandestinely, fraudulently, or otherwise maliciously access the systems of covered persons for purposes of illicit technology transfer or otherwise gaining unfair economic advantage, including through techniques to extract a model’s technical capabilities to replicate, develop, or improve a foreign artificial intelligence model without authorization by the covered person; (D) activity of foreign entities of concern to sabotage or otherwise clandestinely degrade artificial intelligence systems or the supply chain of an artificial intelligence system, including training or test data, frameworks or software libraries, training or inference computing environments, or other components necessary for the training, management, or maintenance of an artificial intelligence system; (E) observations, emerging concerns, or other inputs from vendors or researchers regarding relevant malicious or clandestine activity of foreign entities of concern toward an artificial intelligence system, its supply chain, or other necessary components; (F) efforts by foreign adversaries or foreign entities to evade detection of malicious activity described in subparagraphs (A), (B), (C) and (D); and (G) any other relevant information the Director of the National Counterintelligence and Security Center and the Assistant Director of the Federal Bureau of Investigation for the Counterintelligence Division deem appropriate. (b) Best practices Not later than 90 days after the date of the enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall, in collaboration with the Director and the Director of the National Institute of Standards and Technology and by leveraging efforts of the Information Communications Technology Supply Chain Risk Management Task Force to the greatest extent practicable, convene a multi-stakeholder process to encourage the development and adoption of best practices relating to addressing supply chain risks associated with training and maintaining artificial intelligence models, which shall ensure consideration of supply chain risks associated with— (1) activity of foreign entities of concern to clandestinely, fraudulently, or otherwise maliciously access the systems of covered persons for purposes of illicit technology transfer or otherwise gaining unfair economic advantage, including through techniques to extract a model’s technical capabilities to replicate, develop, or improve a foreign artificial intelligence model without authorization by the covered person; (2) activity of foreign entities of concern to sabotage or otherwise clandestinely degrade artificial intelligence systems or the supply chain of an artificial intelligence system, including training or test data, frameworks or software libraries, training or inference computing environments, or other components necessary for the training, management, or maintenance of an artificial intelligence system; and (3) threat information, usage trends, or other input from vendors or researchers regarding observed malicious or clandestine activity of foreign entities of concern toward an artificial intelligence system, its supply chain, or other necessary components. (c) Establishment of pilot program on sharing of intelligence and threat information with covered persons (1) In general Not later than 180 days after the date of the enactment of this Act, the Director shall, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, establish a pilot program to assess the feasibility and advisability of facilitating the secure sharing with covered persons of intelligence and threat information germane to the securing of the supply chain risks associated with training and maintaining artificial intelligence models procured by the Federal Government. (2) Participation The Director may not select or exclude covered persons to participate in the pilot program in a manner that provides a competitive advantage or procurement preference to any covered person, to the detriment of another covered person. (3) Duration The Director shall carry out the pilot program established pursuant to paragraph (1) for not less than a 3-year period beginning on the date of the establishment of the pilot program. (d) Participation requirements (1) Criteria The Director shall establish criteria governing engagement with covered persons under the pilot program required by subsection (c), which may include criteria relating to the following: (A) Relevance to national security. (B) The ability to protect classified or sensitive intelligence information. (C) Cybersecurity and information security maturity. (D) Agreement to comply with intelligence handling, use, and nondisclosure requirements. (E) The availability of cleared personnel of covered persons or willingness of covered persons to increase the number of cleared personnel. (2) Nature of participation Participation in the pilot program required by subsection (c) shall not be construed as a certification, endorsement, or regulatory approval by the United States Government of any artificial intelligence system or commercial activity and the Director may not exclude a covered person from participating on the basis of political or ideological viewpoints of the covered person or its employees. (e) Intelligence sharing structure (1) Authorized modes Under the pilot program required by subsection (c), the Director may authorize the sharing of intelligence and threat information as described in paragraph (1) of such subsection through— (A) bilateral exchanges between elements of the intelligence community and a covered person; (B) multilateral exchanges among covered persons, as determined appropriate by the Director; or (C) another designated intelligence-sharing mechanism operated or overseen by the Director. (2) Limitation Any mechanism established under this section shall be limited to the dissemination of intelligence and threat information and shall not establish standards, requirements, or best practices governing artificial intelligence development or deployment. (f) Tailoring, handling, and protection of intelligence (1) Procedures required The Director shall codify procedures to tailor, sanitize, or downgrade the classification level of intelligence shared under the pilot program required by subsection (c) to ensure usability while protecting intelligence sources and methods. (2) Examples of procedures The procedures developed under paragraph (1) may include the following: (A) The use of tear lines and segregable summaries. (B) The preparation of classified annexes where necessary. (C) Criteria governing the classification level of shared intelligence. (D) The appropriate use of cleared industry personnel. (3) Handling requirements The Director shall, acting through the Center, codify policies governing the handling, storage, and dissemination of intelligence shared under the pilot program required by subsection (c), including audit and compliance mechanisms. (g) Permissible use and nondisclosure (1) Permissible use Intelligence shared under the pilot program required by subsection (c) may be used solely for detecting, preventing, or mitigating malicious foreign activity targeting the supply chains associated with training and maintaining artificial intelligence models procured by the Federal Government for intelligence collection, intellectual property theft, and other malicious activities. (2) Nondisclosure A covered person participating in the pilot program may not disclose any intelligence shared under the pilot program required by subsection (c), except as expressly authorized by the Director acting through the Center. (h) Privacy and civil liberties In planning and coordinating the pilot program required by subsection (c), the Director shall, acting through the Center, consult with the Civil Liberties Protection Officer of the Office of the Director of National Intelligence. (i) Evaluation and reporting (1) Evaluation The Director shall continuously evaluate the effectiveness and risks of the pilot program established under subsection (c). (2) Report (A) In general Not later than 90 days before the date on which the pilot program required by paragraph (1) of subsection (c) terminates pursuant to paragraph (3) of such subsection, the Directors shall submit to the congressional intelligence committees (as defined in section 3 of the National Security Act of 1947 (50 U.S.C. 30003)) a report assessing— (i) the effectiveness of intelligence sharing under the pilot program; (ii) the adequacy of safeguards for sources, methods, and privacy; (iii) the scope of participation and list of covered persons participating in the pilot program; and (iv) whether the program should be modified, extended, or terminated. (B) Form The report submitted pursuant to subparagraph (A) shall be submitted in unclassified form, but may include a classified annex. (j) Rule of construction Nothing in this section shall be construed— (1) to authorize the collection of intelligence on United States persons not authorized by another provision of law; (2) to require the disclosure of classified information to unauthorized persons; or (3) to establish commercial, competition, or technology policy outside the purview of the intelligence community. (k) Exemption from disclosure; protection Any information shared by a covered person or other entity or individual with the United States Government pursuant to this section— (1) shall be exempt from disclosure and withheld, without discretion, from the public, pursuant to section 552(b)(3)(B) of title 5, United States Code, and any other provision of United States law or law of any State, political subdivision or agency thereof, or Tribe requiring disclosure of information or records; and (2) shall not be deemed a waiver of any applicable privilege or protection, including trade secret protection. (l) Protection from liability No cause of action shall lie or be maintained in any court against any covered person for sharing information with the United States Government or another covered person pursuant to this section.