; if— (A) the program, code, or command originated on the computer of the defender but is copied or removed by an unauthorized user; and (B) the program, code or command does not result in the destruction of data or result in an impairment of the essential operating functionality of the attacker’s computer system, or intentionally create a backdoor enabling intrusive access into the attacker’s computer system. (2) Definition The term attributional data means any digital information such as log files, text strings, time stamps, malware samples, identifiers such as user names and Internet Protocol addresses and metadata or other digital artifacts gathered through forensic analysis. . 4. Exclusion from prosecution for certain computer crimes for those taking active cyber defense measures Section 1030 of title 18, United States Code, is amended by adding at the end the following: (l) Active cyber defense measures not a violation (1) Generally It is a defense to a criminal prosecution under this section that the conduct constituting the offense was an active cyber defense measure. (2) Inapplicability to civil action the defense against prosecution created by this section does not prevent a United States person or entity who is targeted by an active defense measure from seeking a civil remedy, including compensatory damages or injunctive relief pursuant to subsection (g). (3) Definitions In this subsection— (A) the term defender means a person or an entity that is a victim of a persistent unauthorized intrusion of the individual entity’s computer; (B) the term active cyber defense measure — (i) means any measure— (I) undertaken by, or at the direction of, a defender; and (II) consisting of accessing without authorization the computer of the attacker to the defender’s own network to gather information in order to— (aa) establish attribution of criminal activity to share with law enforcement and other United States Government agencies responsible for cybersecurity