Us Code § 395 - Notification requirements for sensitive military cyber operations
Full text of Us Code United States Code § 395 — Notification requirements for sensitive military cyber operations, with citation guidance and answers to common questions.
§ 395. Notification requirements for sensitive military cyber operations
(a)
(b)
(2) The congressional defense committees shall ensure that committee procedures designed to protect from unauthorized disclosure classified information relating to national security of the United States are sufficient to protect the information that is submitted to the committees pursuant to this section.
(3) In the event of an unauthorized disclosure of a sensitive military cyber operation covered by this section, the Secretary shall ensure, to the maximum extent practicable, that the congressional defense committees are notified immediately of the sensitive military cyber operation concerned. The notification under this paragraph may be verbal or written, but in the event of a verbal notification a written notification, signed by the Secretary, or the Secretary's designee, shall be provided by not later than 48 hours after the provision of the verbal notification.
(c)
(A) is carried out by the armed forces of the United States;
(B) is intended to achieve a cyber effect against a foreign terrorist organization or a country, including its armed forces and the proxy forces of that country located elsewhere—
(i) with which the armed forces of the United States are not involved in hostilities (as that term is used in section 4 of the War Powers Resolution (50 U.S.C. 1543)); or
(ii) with respect to which the involvement of the armed forces of the United States in hostilities has not been acknowledged publicly by the United States; and
(C)(i) is determined to—
(I) have a medium or high collateral effects estimate;
(II) have a medium or high intelligence gain or loss;
(III) have a medium or high probability of political retaliation, as determined by the political military assessment contained within the associated concept of operations;
(IV) have a medium or high probability of detection when detection is not intended; or
(V) result in medium or high collateral effects; or
(ii) is a matter the Secretary determines to be appropriate.
(2) The actions described in this paragraph are the following:
(A) An offensive cyber operation.
(B) A defensive cyber operation.
(d)
(1) to a training exercise conducted with the consent of all nations where the intended effects of the exercise will occur; or
(2) to a covert action (as that term is defined in section 503 of the National Security Act of 1947 (50 U.S.C. 3093)).
(e)
(Added Pub. L. 115–91, div. A, title XVI, §1631(a), Dec. 12, 2017, 131 Stat. 1736, §130j; renumbered §395 and amended Pub. L. 115–232, div. A, title X, §1081(a)(1), title XVI, §1631(a), Aug. 13, 2018, 132 Stat. 1983, 2123; Pub. L. 116–92, div. A, title XVI, §1632, Dec. 20, 2019, 133 Stat. 1745; Pub. L. 116–283, div. A, title XVII, §1702, Jan. 1, 2021, 134 Stat. 4080.)
Editorial Notes
References in Text
The War Powers Resolution, referred to in subsec. (e), is Pub. L. 93–148, Nov. 7, 1973, 87 Stat. 555, which is classified generally to chapter 33 (§1541 et seq.) of Title 50, War and National Defense. For complete classification of this Resolution to the Code, see Short Title note set out under section 1541 of Title 50 and Tables.
The Authorization for Use of Military Force, referred to in subsec. (e), is Pub. L. 107–40, Sept. 18, 2001, 115 Stat. 224, which is set out as a note under section 1541 of Title 50, War and National Defense.
The National Security Act of 1947, referred to in subsec. (e), is act July 26, 1947, ch. 343, 61 Stat. 495, which is classified principally to chapter 44 (§3001 et seq.) of Title 50, War and National Defense. For complete classification of this Act to the Code, see Tables.
Amendments
2021—Subsec. (c). Pub. L. 116–283 amended subsec. (c) generally. Prior to amendment, subsec. (c) defined "sensitive military cyber operation" as used in this section.
2019—Subsec. (b)(3). Pub. L. 116–92, §1632(1), inserted ", signed by the Secretary, or the Secretary's designee," after "written notification".
Subsec. (c)(1)(B), (C). Pub. L. 116–92, §1632(2)(A), added subpar. (B) and redesignated former subpar. (B) as (C).
Subsec. (c)(2)(B). Pub. L. 116–92, §1632(2)(B), struck out "outside the Department of Defense Information Networks to defeat an ongoing or imminent threat" after "A defensive cyber operation".
2018—Pub. L. 115–232, §1631(a), renumbered section 130j of this title as this section.
Subsec. (d)(2). Pub. L. 115–232, §1081(a)(1), substituted "section 503 of the National Security Act of 1947 (50 U.S.C. 3093)" for "section 3093 of title 50, United States Code".
About This Section
10 U.S.C. § 395 is part of Title 10 of the United States Code. The United States Code is the official codification of federal statutes maintained by the Office of the Law Revision Counsel of the U.S. House of Representatives. Congress amends the Code through new public laws, which are eventually incorporated into the relevant title.
This section may be cited in legal writing as 10 U.S.C. § 395. For the most current official text, including any recent amendments, use the official source links below. Do not rely on this page as the sole authority for legal citation or litigation.
How to Read This Statute
Statutes are organized by title, chapter, section, and subsection. Pay attention to words like "shall," "may," "and," and "or," because they determine whether a requirement is mandatory or permissive and whether multiple conditions must all be met. Historical notes and amendments often appear at the end of a section.
Using This Page
This page is intended for research and educational use. Lawyers, students, journalists, and compliance professionals can use it as a starting point, but should always verify the current text through an official government source before relying on it for legal advice, filings, or compliance decisions.