; and ; and (D) by adding at the end the following new paragraph: (12) detecting, identifying, and receiving information about security vulnerabilities relating to information systems for a cybersecurity purpose. ; and (3) by adding at the end the following new subsection: (n) Subpoena authority (1) In general If the Director identifies an information system connected to the internet with a specific security vulnerability and has reason to believe that the security vulnerability relates to critical infrastructure and affects an enterprise device or system of an entity, and the Director made reasonable efforts to identify the entity at risk but was unable to do so, the Director may issue a subpoena for the production of information necessary to identify and notify the entity at risk, in order to carry out a cybersecurity purpose. (2) Limit on information A subpoena issued under this subsection may only seek information in the categories set forth in subparagraphs (A), (B), (D), and (E) of section 2703(c)(2) of title 18, United States Code. (3) Liability protections for disclosing providers The provisions of section 2703(e) of title 18, United States Code, shall apply to any subpoena issued under this subsection. (4) Coordination (A) In general Not later than 60 days after the date of the enactment of this subsection, the Director, in coordination with the Attorney General, shall develop inter-agency procedures regarding the issuance of subpoenas under this subsection in order to avoid interference with ongoing law enforcement investigations. To the extent practicable, the Director shall coordinate such issuances with the Department of Justice, including the Federal Bureau of Investigation, pursuant to such procedures. (B) Contents The inter-agency procedures developed under this paragraph shall provide that a subpoena issued by the Director under this subsection shall be— (i) issued solely in order to carry out a cybersecurity purpose