REPORT ON RANSOMWARE AND OTHER CYBER-RELATED ATTACKS BY CERTAIN FOREIGN INDIVIDUALS, COMPANIES, AND GOVERNMENTS.

SEC. 503. REPORT ON RANSOMWARE AND OTHER CYBER-RELATED ATTACKS BY CERTAIN FOREIGN INDIVIDUALS, COMPANIES, AND GOVERNMENTS.(a) In General.—With the transmission of the report required by section 2 of Public Law 116–173, and separately in 2025 and 2027, the Federal Trade Commission shall transmit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report, which may include a classified annex for information that is nonpublic or related to Commission investigations or interagency deliberations, and that shall include the following:(1) The number and details of cross-border complaints received by the Commission (including which such complaints were acted upon and which such complaints were not acted upon) that relate to incidents that were reported to the Commission as committed by individuals, companies, or governments, including those described in subsection (b), broken down by each type of individual, type of company, or government described in a paragraph of such subsection. (2) The number and details of cross-border complaints received by the Commission (including which such complaints were acted upon and which such complaints were not acted upon) that involve ransomware or other cyber-related attacks that were reported to the Commission as committed by individuals, companies, or governments, including those described in subsection (b), broken down by each type of individual, type of company, or government described in a paragraph of such subsection. (3) A description of trends in the number of cross-border complaints received by the Commission and reported to the Commission as incidents that were committed by individuals, 136 STAT. 5565 companies, or governments, including those described in subsection (b), broken down by each type of individual, type of company, or government described in a paragraph of such subsection. (4) Identification and details of foreign agencies (including foreign law enforcement agencies (as defined in section 4 of the Federal Trade Commission Act (15 U.S.C. 44))) located in Russia, China, North Korea, or Iran with which the Commission has cooperated and the results of such cooperation, including any foreign agency enforcement action or lack thereof. (5) A description of Commission litigation, in relation to cross-border complaints described in paragraphs (1) and (2), brought in foreign courts and the results of such litigation. (6) Any recommendations for legislation that may advance the mission of the Commission in carrying out the U.S. SAFE WEB Act of 2006 and the amendments made by such Act. (7) Any recommendations for legislation that may advance the security of the United States and United States companies against ransomware and other cyber-related attacks. (8) Any recommendations for United States citizens and United States businesses to implement best practices on mitigating ransomware and other cyber-related attacks. (b) Individuals, Companies, and Governments Described.—The individuals, companies, and governments described in this subsection are the following:(1) An individual located within Russia or with direct or indirect ties to the Government of the Russian Federation. (2) A company located within Russia or with direct or indirect ties to the Government of the Russian Federation. (3) The Government of the Russian Federation. (4) An individual located within China or with direct or indirect ties to the Government of the People’s Republic of China. (5) A company located within China or with direct or indirect ties to the Government of the People’s Republic of China. (6) The Government of the People’s Republic of China. (7) An individual located within North Korea or with direct or indirect ties to the Government of the Democratic People’s Republic of Korea. (8) A company located within North Korea or with direct or indirect ties to the Government of the Democratic People’s Republic of Korea. (9) The Government of the Democratic People’s Republic of Korea. (10) An individual located within Iran or with direct or indirect ties to the Government of the Islamic Republic of Iran. (11) A company located within Iran or with direct or indirect ties to the Government of the Islamic Republic of Iran. (12) The Government of the Islamic Republic of Iran.136 STAT. 5566