To amend the Homeland Security Act of 2002 to enhance cybersecurity, and for other purposes.

Summary: Department of Homeland Security Cybersecurity Enhancement Act of 2004 - Amends the Homeland Security Act of 2002 to establish in the Department of Homeland Security's (DHS) Directorate for Information Analysis and Infrastructure Protection a National Cybersecurity Office, headed by an Assistant Secretary for Cybersecurity, who shall assist the Secretary in promoting cybersecurity for the Nation. Grants the Assistant Secretary primary authority within DHS for all cybersecurity-related critical infrastructure programs of DHS.

Includes among the responsibilities of the Assistant Secretary to: (1) establish and manage a national cybersecurity response system, a national cybersecurity threat and vulnerability reduction program, a national cybersecurity awareness and training program, a government cybersecurity program, and a national security and international cybersecurity cooperation program; (2) coordinate specified activities with the private sector, with other directorates and offices within DHS (including with the Chief Information Officer), and with the Under Secretary for Emergency Preparedness and Response; (3) develop processes for information sharing with the private sector; (4) consult with the Secret Service's Electronic Crimes Task Force on private sector outreach and information activities and with the Office for Domestic Preparedness to ensure that realistic cybersecurity scenarios are incorporated into tabletop and recovery exercises; and (5) consult and coordinate with other Federal agencies on cybersecurity-related programs, policies, and operations and with other relevant Federal agencies and within DHS on security of digital control systems.

Grants the Assistant Secretary primary authority within DHS over the National Communications System.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Department of Homeland Security 
Cybersecurity Enhancement Act of 2004''.

SEC. 2. ASSISTANT SECRETARY FOR CYBERSECURITY.

    (a) In General.--Subtitle A of title II of the Homeland Security 
Act of 2002 (6 U.S.C. 121 et seq.) is amended by adding at the end the 
following:

``SEC. 203. ASSISTANT SECRETARY FOR CYBERSECURITY.

    ``(a) In General.--There shall be in the Directorate for 
Information Analysis and Infrastructure Protection a National 
Cybersecurity Office headed by an Assistant Secretary for Cybersecurity 
(in this section referred to as the `Assistant Secretary'), who shall 
assist the Secretary in promoting cybersecurity for the Nation.
    ``(b) General Authority.--The Assistant Secretary, subject to the 
direction and control of the Secretary, shall have primary authority 
within the Department for all cybersecurity-related critical 
infrastructure protection programs of the Department, including with 
respect to policy formulation and program management.
    ``(c) Responsibilities.--The responsibilities of the Assistant 
Secretary shall include the following:
            ``(1) To establish and manage--
                    ``(A) a national cybersecurity response system that 
                includes the ability to--
                            ``(i) analyze the effect of cybersecurity 
                        threat information on national critical 
                        infrastructure; and
                            ``(ii) aid in the detection and warning of 
                        attacks on, and in the restoration of, 
                        cybersecurity infrastructure in the aftermath 
                        of such attacks;
                    ``(B) a national cybersecurity threat and 
                vulnerability reduction program that identifies 
                cybersecurity vulnerabilities that would have a 
                national effect on critical infrastructure, performs 
                vulnerability assessments on information technologies, 
                and coordinates the mitigation of such vulnerabilities;
                    ``(C) a national cybersecurity awareness and 
                training program that promotes cybersecurity awareness 
                among the public and the private sectors and promotes 
                cybersecurity training and education programs;
                    ``(D) a government cybersecurity program to 
                coordinate and consult with Federal, State, and local 
                governments to enhance their cybersecurity programs; 
                and
                    ``(E) a national security and international 
                cybersecurity cooperation program to help foster 
                Federal efforts to enhance international cybersecurity 
                awareness and cooperation.
            ``(2) To coordinate with the private sector on the program 
        under paragraph (1) as appropriate, and to promote 
        cybersecurity information sharing, vulnerability assessment, 
        and threat warning regarding critical infrastructure.
            ``(3) To coordinate with other directorates and offices 
        within the Department on the cybersecurity aspects of their 
        missions.
            ``(4) To coordinate with the Under Secretary for Emergency 
        Preparedness and Response to ensure that the National Response 
        Plan developed pursuant to section 502(6) of the Homeland 
        Security Act of 2002 (6 U.S.C. 312(6)) includes appropriate 
        measures for the recovery of the cybersecurity elements of 
        critical infrastructure.
            ``(5) To develop processes for information sharing with the 
        private sector, consistent with section 214, that--
                    ``(A) promote voluntary cybersecurity best 
                practices, standards, and benchmarks that are 
                responsive to rapid technology changes and to the 
                security needs of critical infrastructure; and
                    ``(B) consider roles of Federal, State, local, and 
                foreign governments and the private sector, including 
                the insurance industry and auditors.
            ``(6) To coordinate with the Chief Information Officer of 
        the Department in establishing a secure information sharing 
        architecture and information sharing processes, including with 
        respect to the Department's operation centers.
            ``(7) To consult with the Electronic Crimes Task Force of 
        the United States Secret Service on private sector outreach and 
        information activities.
            ``(8) To consult with the Office for Domestic Preparedness 
        to ensure that realistic cybersecurity scenarios are 
        incorporated into tabletop and recovery exercises.
            ``(9) To consult and coordinate, as appropriate, with other 
        Federal agencies on cybersecurity-related programs, policies, 
        and operations.
            ``(10) To consult and coordinate within the Department and, 
        where appropriate, with other relevant Federal agencies, on 
        security of digital control systems, such as Supervisory 
        Control and Data Acquisition (SCADA) systems.
    ``(d) Authority Over the National Communications System.--The 
Assistant Secretary shall have primary authority within the Department 
over the National Communications System.''.
    (b) Clerical Amendment.--The table of contents in section 1(b) of 
such Act is amended by adding at the end of the items relating to 
subtitle A of title II the following:

``203. Assistant Secretary for Cybersecurity.''.

SEC. 3. CYBERSECURITY DEFINED.

    Section 2 of the Homeland Security Act of 2002 (6 U.S.C. 101) is 
amended by adding at the end the following:
            ``(17)(A) The term `cybersecurity' means the prevention of 
        damage to, the protection of, and the restoration of computers, 
        electronic communications systems, electronic communication 
        services, wire communication, and electronic communication, 
        including information contained therein, to ensure its 
        availability, integrity, authentication, confidentiality, and 
        nonrepudiation.
            ``(B) In this paragraph--
                    ``(i) each of the terms `damage' and `computer' has 
                the meaning that term has in section 1030 of title 18, 
                United States Code; and
                    ``(ii) each of the terms `electronic communications 
                system', `electronic communication service', `wire 
                communication', and `electronic communication' has the 
                meaning that term has in section 2510 of title 18, 
                United States Code.''.