```

[House Report 107-355]
[From the U.S. Government Publishing Office]

107th Congress                                            Rept. 107-355
                        HOUSE OF REPRESENTATIVES
 2d Session                                                      Part I

======================================================================

 
              CYBER SECURITY RESEARCH AND DEVELOPMENT ACT

                                _______
                                

February 4, 2002.--Committed to the Committee of the Whole House on the 
              State of the Union and ordered to be printed

                                _______
                                

  Mr. Boehlert, from the Committee on Science, submitted the following

                              R E P O R T

                        [To accompany H.R. 3394]

      [Including cost estimate of the Congressional Budget Office]

  The Committee on Science, to whom was referred the bill (H.R. 
3394) to authorize funding for computer and network security 
research and development and research fellowship programs, and 
for other purposes, having considered the same, report 
favorably thereon without amendment and recommend that the bill 
do pass.

                                CONTENTS

                                                                   Page
   I. Purpose of the Bill.............................................2
  II. Background and Need for the Legislation.........................2
 III. Summary of Hearings.............................................5
  IV. Committee Action................................................6
   V. Summary of Major Provisions of the Bill.........................6
  VI. Section-By-Section Analysis (By Section)........................8
 VII. Committee Views................................................11
VIII. Cost Estimate..................................................17
  IX. Congressional Budget Office Cost Estimate......................17
   X. Compliance with Public Law 104-4 (Unfunded Mandates)...........19
  XI. Committee Oversight Findings and Recommendations...............19
 XII. Constitutional Authority Statement.............................19
XIII. Federal Advisory Committee Statement...........................19
 XIV. Congressional Accountability Act...............................19
  XV. Statement on Preemption of State, Local or Tribal Law..........19
 XVI. Changes in Existing Law Made by the Bill, as Reported..........19
XVII. Committee Recommendations......................................23
XVIII.Statement on General Performance Goals and Objectives..........23

 XIX. Exchange of Committee Correspondence...........................23
  XX. Proceedings of Full Committee Markup...........................25

                         I. Purpose of the Bill

    The purpose of the bill is to authorize funding for 
computer and network security education, research and 
development.

                II. Background and Need For Legislation

    The terrorist attacks of September 11, 2001 brought into 
stark relief the Nation's physical and economic vulnerability 
to an attack within our borders. The relative case with which 
terrorists were able to implement their plans serves as a 
pointed reminder of the need to identify critical ``soft 
sports'' in the nation's defenses. Among the Nation's 
vulnerabilities are our computer and communications networks, 
on which the country's finance, transportation, energy and 
water distribution systems, and health and emergency services 
depend. These vulnerabilities have called into question whether 
the Nation's technological research programs, educational 
system, and interconnected operations are prepared to meet the 
challenge of cyber warfare in the 21st century. The Los Angeles 
Times in a recent editorial emphasized the importance of 
meeting this challenge: ``A cyberterrorist attack would not 
carry the same shock and carnage of September 11. But in this 
information age . . . [a cyberterrorist attack] could be more 
widespread and just as economically destructive.''
    We will not be able to address these vulnerabilities 
without conducting more research on cybersecurity. H.R. 3394 is 
designed to address four inadequacies with current research 
efforts:
          (1) The Federal Government has chronically 
        underinvested in cybersecurity, an area in which the 
        private sector has little incentive to invest.
          (2) This is true, in part, because no Federal agency 
        has the responsibility of ensuring that the Nation has 
        a robust cybersecurity research enterprise;
          (3) As a result, what little research has been done 
        on cybersecurity has been incremental, leaving the 
        basic approaches to cybersecurity unchanged for 
        decades; and
          (4) As a field with relatively little money, few 
        researchers and minimal attention, cybersecurity fails 
        to attract the interest of students, perpetuating the 
        problems in the field.

       Vulnerabilities of the National Information Infrastructure

    The Internet has been a tremendous success--connecting more 
than 100 million computers and growing--far outstripping its 
designers' wildest expectations. Yet the Internet was not 
originally designed to control power systems, connect massive 
databases of medical records or connect millions of home 
appliances or automobiles, yet today it serves these functions. 
It was not designed to run critical safety systems but it now 
does that as well. We now heavily rely on an open network of 
networks, so complex that no one person, group or entity can 
describe it, model its behavior or predict its reaction to 
adverse events.
    The porous fabric of the U.S.'s network infrastructure 
leaves the Nation open to the constant possibility of cyber 
attack. Attacks can take several forms, including: defacement 
of web sites and other electronically stored information in the 
United States and other countries to spread disinformation and 
propaganda; distributed denial of service attacks that 
overwhelm a server with access requests; use of unprotected 
``zombie'' computers (located anywhere) as conduits for wide-
scale distribution of destructive worms and viruses throughout 
the computer network; and unauthorized intrusions and sabotage 
of systems and networks belonging to the U.S. and allied 
countries, potentially resulting in critical infrastructure 
outages and corruption of vital data.
    The wide-scale attack by the so-called ``Nimda'' worm is 
one example of these techniques; the virus modified web 
documents and certain executable files found on the systems it 
infected, and then created numerous copies of itself under 
various file names. This followed the ``Code Red,'' ``Code Red 
II'' and ``SirCam'' attacks which affected millions of 
personal, commercial and government computers, shut down web 
sites, slowed Internet service, and disrupted business and 
government operations, causing billions of dollars of damage.
    These attacks no longer represent isolated or infrequent 
events. Carnegie Mellon University's CERT' 
Coordination Center, which serves as a reporting center for 
Internet security problems, received 2,437 vulnerability 
reports in calendar year 2001, almost 6 times the number in 
1999. Similarly, the number of specific incidents reported to 
CERT grew enormously--from 9,859 in 1999 to 52,658 in 2001. yet 
CERT estimates that this may represent only about 20 percent of 
the incidents that actually have occurred.

              Interdependence of Critical Infrastructures

    To better understand our vulnerabilities to cyber terrorism 
and the potential consequences of cyber attacks, the Internet 
must no longer be studied solely as a separate system but also 
as a network of interdependent critical infrastructures. It 
also has links to many ostensibly private networks, such as 
those used by the financial services industry. While some 
research is being done to better understand the threats to the 
Internet itself, little has been done to assess and project the 
dramatic or subtle impact that these threats may have on other 
critical infrastructures. These problems are not hypothetical. 
While not the result of a cyber attack, the 1998 failure of the 
Galaxy 4 communications satellite disrupted the use of 90 
percent of the Nation's pagers and disrupted credit card 
purchases and ATM transactions. The failure also disrupted the 
communications of health care providers and emergency workers.

         Information Warfare Simulations--``Eligible Receiver''

    In 1997, the Pentagon conducted an information warfare 
exercise that illustrated some of the implications of 
infrastructure interdependence. Known as Eligible Receiver, the 
exercise simulated a rogue state attempting to attack 
vulnerable U.S. information systems. A ``Red Team'' comprising 
35 National Security Agency computer specialists used off-the-
self technology and software to simulate attacks against power 
and communications networks in Oahu, Los Angeles, Colorado 
Springs, St. Louis, Chicago, Detroit, Washington, D.C., 
Fayetteville, and Tampa. According to the Congressional 
Research Service, it is generally believed that government 
(including unclassified military computer networks) and 
commercial sites were easily attacked and penetrated. Air Force 
Major General John H. Campbell, commander of the DoD Joint Task 
Force--Computer Network Defense, wrote that the exercise 
``clearly demonstrated our lack ofpreparation for a coordinated 
cyber and physical attack on our critical military and civilian 
infrastructure.'' Officials familiar with the exercise later said that 
Eligible Receiver showed in ``real terms how vulnerable the 
transportation grid, the electricity grid, and others are to an attack 
by people using conventional equipment.'' The National Security Agency 
subsequently recommended that all Federal Internet accessible computer 
networks that process or provide access to classified, confidential, or 
sensitive data should have mandatory access controls.

    Underlying Causes of the Nation's Vulnerability to Cyber Attack

    Weaknesses in research and development in the cyber 
security arena contribute significantly to the vulnerability of 
the Nation's information infrastructure. While a number of 
information technology companies support R&D on network 
security, security inadequacies cannot be addressed solely 
through short-term industry-based applied research, which is 
underfunded in any event. Industry relies on the fundamental 
research supported by the Federal Government and on the 
training of future researchers--computer scientists, 
mathematicians, and many others--that these federally funded 
research programs support.
    Unfortunately, with the possible exception of encryption 
related research, cyber security research has been chronically 
underfunded, and basis research into fundamental cyber security 
challenges is not robust enough to meet the Nation's needs. 
Simply put, when it comes to computer security, too few people 
are paying too little attention and coming up with too few 
ideas.
    Cyber security has been a neglected field. Although numbers 
are difficult to come by, federally funded cyber security 
research may amount to less than $60 million per year. Experts 
believe that fewer than 100 U.S. researchers have the 
experience and expertise to conduct cutting edge research in 
cyber security. This is true even though a computer science 
department at a single research university may have 60 or more 
faculty members.
    This chronic under-investment does not merely pose problems 
for the academic and research community. Federal agencies are 
finding it increasingly difficult to recruit and hire 
professional staff to manage and secure their own computer 
networks. The National Science Foundation (NSF), in 
consultation with the National Security Council, the National 
Security Agency, the Critical Infrastructure Assurance Office, 
and the Office of Personnel Management established in July 2000 
a scholarship-for-service program designed to train students 
who would then help ensure the security of the Federal 
information infrastructure. This program was funded at the 
level of $1.2 million for FY 2001 and was expected to provide 
scholarship funds for approximately 180 undergraduate and 
graduate students. The National Aeronautics and Space 
Administration has requested similar scholarship-for-service 
authority to recruit students with expertise in computer 
science and other technical fields. Other agencies are likely 
to follow. NSF has also recently established another program 
designed to enhance research in information assurance and build 
a well-trained cyber security workforce. NSF's Trusted 
Computing program, established in FY 2001, will award between 
$4 million and $6 million in FY 2002 to support research on 
computer and network security.
    In addition, The National Institute of Standards and 
Technology (NIST) within the Department of Commerce provides 
grants for research to develop commercial solutions to IT 
security problems central to critical infrastructure 
protection. NIST recently announced the award of grants under 
its Critical Infrastructure Protection Grants Program aimed at 
improving the security of the computer and telecommunications 
systems that support essential services.
    While private industry has rapidly advanced many aspects of 
information technology, it has had little incentive to focus on 
the development of cyber security. The market demands faster, 
cheaper, more powerful products, not more secure ones. In the 
wake of the September 11th attacks, security has a slightly 
higher profile in the private sector, but real advances in 
information assurance will still rely on efforts by the Federal 
Government.
    Two studies conducted by the firm Metricnet suggest that 80 
percent of companies spent less than 5 percent of their 
information technology budget on information security prior to 
September 11th. In November that was still true of two-thirds 
of the companies.
    Yet the Federal Government has not been filling the 
research gap left by the private sector. The Federal Government 
has chronically under-invested in this area. As a result, too 
little cyber security research is being conducted and too few 
researchers are prepared to meet our current and projected 
cyber security research needs. In addition, the research that 
is funded is incremental and unlikely to lead to the 
development of breakthrough approaches to cyber security.
    This lack of Federal focus has also limited the number of 
undergraduate and graduate students pursuing studies in cyber 
security. Despite these problems and the inadequate 
coordination between government, academia, and industry, no 
Federal agency has stepped forward to take the lead in 
supporting cyber security research. The Cyber Security Research 
and Development Act responds to these challenges by authorizing 
a focused, long-term Federal investment in cyber security 
research, designed to increase the cadre of researchers in this 
field over the long-term and to yield innovative new approaches 
to cyber security.

                        III. Summary of Hearings

    On Tuesday, July 31, 2001, the House Science Committee's 
Subcommittee on Research held a hearing to examine the impact 
Federal investment has had on promoting innovation in 
information technology and fostering a variety of sophisticated 
applications that infuse information technology into areas such 
as education, scientific research, and the delivery of public 
services. Witnesses described the increasing reliance 
oninformation technology by all sectors of the research community and 
the general public, and specifically discussed applications of 
information technology to pharmaceutical research, biotechnology, 
education, emergency management, air and ground traffic coordination, 
and predictive weather and climate modeling. Witnesses discussed the 
need for new information tools and technologies to be available to all 
sectors of the community and emphasized the increasing need for system 
reliability and security given the increasing dependence on information 
technology for even the most basic human services. Witnesses agreed, 
however, that there has been a lack of focus and effort in the areas of 
computer and network security, privacy, and information assurance, and 
that the ability to protect key infrastructures lags behind their 
development and implementation.
    On Wednesday, October 10, 2001, the House Committee on 
Science held a hearing to examine the vulnerability of our 
Nation's computer infrastructure and related research needs. 
Witnesses described the vulnerability of our Nation's critical 
infrastructure to cyber attacks, the lack of market incentives 
for the development and inclusion of robust information 
assurance software in commercial applications, and the 
consequences of chronic underfunding of cyber security research 
by the Federal Government. Witnesses called for: the 
designation of a lead Federal research agency that would take 
primary responsibility for supporting cyber security research 
and development; the development of innovative new approaches 
to cyber security and cyber security research; and for 
significant increases in the number of researchers capable of 
doing world-class cyber security research.
    On Wednesday, October 17, 2001, the House Committee on 
Science held a second hearing to examine the vulnerability of 
our Nation's computer infrastructure. In this hearing the 
Honorable James S. Gilmore, III, Governor of the Commonwealth 
of Virginia and Chairman of the Advisory Panel to Assess 
Domestic Response Capabilities for Terrorism Involving Weapons 
of Mass destruction, stated that, ``Critical information and 
communication infrastructures are targets for terrorists 
because of the broad economic and operational consequences a 
shutdown can inflict.'' Governor Gilmore called for ``a 
comprehensive plan for research, development, test and 
evaluation of processes to enhance cyber security in the same 
manner as we must do for other potential terrorist attacks.''

                          IV. Committee Action

    On December 4, 2001, Science Committee Chairman Sherwood 
Boehlert and Ranking Minority Member Ralph Hall introduced H.R. 
3394, the Cyber Security Research and Development Act, a bill 
to authorize appropriations for computer and network security 
education, research and development for Fiscal years 2003 
through 2007. The bill incorporates major provisions of H.R. 
3316, the Computer Security Enhancement and Research Act, 
introduced by Rep. Brian Baird.
    The House Committee on Science met on December 6, 2001, to 
consider the bill. With a quorum present, Mr. Hall moved that 
the Committee favorably report the bill to the House with the 
recommendation that it pass, and that the staff be instructed 
to make technical and conforming changes to the bill and 
prepare the legislative report, and that the Chairman take all 
necessary steps to bring the bill before the House for 
consideration. The motion was agreed to by a voice vote.

               V. Summary of Major Provisions of the Bill

     Authorizes the NSF to award grants to institutions 
of higher education for basic research on innovative approaches 
to enhancing computer and network security through hardware and 
software solutions. Includes research in a variety of areas 
including authentication and cryptography, computer forensics 
and intrusion detection, reliability of computer and network 
applications, middleware, operating systems and communications 
infrastructure, and privacy and confidentiality. This program 
is authorized at $35 million for FY 2003, $40 million for FY 
2004, $46 million for FY 2005, $52 million for FY 2006, and $60 
million for FY 2007.
     Authorizes NSF to award grants to institutions of 
higher education to establish multidisciplinary Centers for 
Computer and Network Security Research. Applicants may partner 
with government laboratories and/or for-profit institutions. 
These centers are designed to advance the research agenda and 
to train additional qualified computer and network security 
researchers and professionals. Instructs NSF to convene an 
annual meeting of Center investigators to facilitate 
information exchange. This program is authorized at $12 million 
for FY 2003, $24 million for FY 2004, $36 million for each of 
fiscal years 2005 through 2007.
     Authorizes NSF to establish a program to award 
grants to institutions of higher education to establish or 
improve undergraduate and master's degree programs in computer 
and network security, to increase the number of students who 
pursue undergraduate or master's degrees in fields related to 
computer and network security, and to provide students with 
experience in government or industry related to their computer 
and network security studies. Funds may be used for curriculum 
development, faculty development, equipment acquisition, 
student recruitment and/or the establishment of bridge programs 
with two-year colleges and industry internship programs for 
students. This program is authorized at $15 million for FY 2003 
and $20 million for each year from FY 2004 through FY 2007.
     Authorizes NSF to expand the activities of the 
Advanced Technological Education Program, established under the 
Scientific and Advanced Technology Act of 1992, to support 
improved education and technical training in fields related to 
computer and network security. This program is authorized at $1 
million for FY 2003, and $1.25 million for each of fiscal years 
2003 through FY 2007.
     Authorizes NSF to establish a program to support 
graduate traineeships in computer and network security at 
institutions of higher education. Grant awards can be used to 
provide student fellowship support, to pay tuition and fees for 
students who are fellowship recipients, to establish internship 
programs for students in computer and network security at for-
profit institutions or government laboratories, and 
toadminister the program. This program is authorized at $10 million for 
FY 2003, and $20 million for each of fiscal years 2005 through FY 2007.
     Authorizes NSF to list computer and network 
security as a field of specialization under the NSF Graduate 
Research Fellowships program established by the National 
Science Foundation Act of 1950.
     Amends the National Science Foundation Act of 1950 
to charge NSF with taking a lead role in fostering and 
supporting research and education activities to improve the 
security of networked information systems.
     Authorizes NIST to establish a program of 
assistance for institutions of higher education that enter into 
partnerships with for-profit entities (which may also include 
government laboratories), to support long-term, high-risk 
research to improve the security of computer systems. Instructs 
NIST to include research directed toward addressing needs 
identified through the activities of the Computer System 
Security and Privacy Advisory Board. This program is authorized 
at $25 million for FY 2003, $40 million for FY 2004, $55 
million for FY 2005, $70 million for FY 2006, and $85 million 
for FY 2007.
     Authorizes NIST to establish a program to award 
post-doctoral research fellowships to citizens, nationals, or 
lawfully admitted permanent resident aliens of the U.S. who are 
seeking research positions at an institution, including the 
Institute, engaged in cyber security research. Also authorizes 
NIST to establish a similar program to provide research 
fellowships to senior researchers who wish to change research 
fields and pursue studies related to the security of computer 
systems. Authorizes $6 million for FY 2003, $6.2 million for FY 
2004, $6.4 million for FY 2005, $6.6 for FY 2006, and $6.8 for 
FY 2007.
     Authorizes NIST to recruit existing NIST employees 
or identify additional individuals who will serve as program 
managers to administer the activities established under this 
Act.
     Instructs NIST to periodically review the 
portfolio of research awards funded under this Act, in 
consultation with the Computer System Security and Privacy 
Advisory Board, to ensure that appropriateness of the research 
goals and the quality and utility of the research projects 
funded under this Act.
     Directs NIST to enter an arrangement with the 
National Research Council for a comprehensive review of the 
research program established by this Act. This review shall 
occur during the fifth year of the program, the results of 
which shall be reported to Congress no later than six years 
after the initiation of the program.
     Authorizes the Computer System Security and 
Privacy Advisory Board to identify emerging issues, including 
research needs, related to computer security, privacy, and 
cryptography and to convene public meetings and distribute 
reports on those subjects. Authorizes $1.06 million for FY 2003 
and $1.09 million for FY 2004 for these purposes.
     Amends the National Institute of Standards and 
Technology Act to explicitly allow intramural research on the 
security of networked computer systems, including those systems 
integral to process control and essential infrastructure.
     Directs NIST to enter into an arrangement with the 
National Research Council of the National Academy of Sciences 
to conduct a study of the vulnerabilities of the Nation's 
network infrastructure and make recommendations for appropriate 
improvements, and to transmit a report of the findings to 
Congress within 21 months of the enactment of this Act. 
Prohibits the Director from including classified or sensitive 
information regarding vulnerabilities in any publicly released 
version of this report. Authorizes appropriations of $700,000 
for this study and report.

              VI. Section-by-Section Analysis (by Section)

                          SEC. 1. SHORT TITLE

    ``Cyber Security Research and Development Act''.

                            SEC. 2. FINDINGS

    Discuss the interdependent nature of critical 
infrastructures brought about by advancements in computing and 
communications technology; the increased consequences of 
failure of communications and other critical services caused by 
exponential increases in interconnectivity; the Nation's lack 
of preparedness for a coordinated cyber and physical attack; 
the lack of sufficient long-term research funding and the 
shortage of outstanding researchers in the field of cyber 
security; and the lack of coordination among government, 
academia, and industry for computer security; and the need to 
significantly increase the Federal investment in computer and 
network security research and development.

                          SEC. 3. DEFINITIONS

    Defines the term ``Director'' as the Director of the 
National Science Foundation (Note that where the term 
`Director' is used in section 8 it refers to the Director of 
the National Institute for Standards and Technology). Uses the 
definition for `institution of higher education' found in the 
Higher Education Act of 1965.

              SEC. 4. NATIONAL SCIENCE FOUNDATION RESEARCH

    (a) Establishes an NSF program to award merit-based grants 
for basic research on innovative approaches to enhance computer 
security. Research areas for which grants can be used include 
authentication and cryptography, computer forensics and 
intrusion detection, reliability of computer and network 
applications, and privacy. Authorizesappropriations of $35 
million for FY 2003, $40 million for FY 2004, $46 million for 2005, $52 
million for FY 2006, and $60 million for FY 2007.
    (b) Establishes an NSF program to award multi-year grants 
to institutions of higher education (or consortia thereof) to 
establish multidisciplinary Centers for Computer and Network 
Security Research. Consortia applying for grants may include 
one or more government laboratories or for-profit institutions. 
Applications for Center grants are to be reviewed on the basis 
of criteria that include: the ability of the institution (or 
consortium) to generate innovative approaches to computer and 
network security research; the applicant's support for students 
pursuing research in computer and network security; and the 
extent to which government laboratories or industry partners 
will participate in the Center's research activities. Requires 
the Director to convene an annual meeting of Centers to foster 
greater collaboration and communication. Authorizes 
appropriations of $12 million for FY 2003, $24 million for FY 
2004, and $36 million for each of fiscal years 2005 through 
2007.

   SEC. 5. NATIONAL SCIENCE FOUNDATION COMPUTER AND NETWORK SECURITY 
                                PROGRAMS

    (a) Establishes a competitive, merit-based NSF program to 
award grants to institutions of higher education (or consortia 
thereof) to create or improve undergraduate and master's degree 
programs in computer security. Allowable uses of grants include 
curriculum development, equipment acquisition, faculty 
enhancement, and student internship programs in government or 
industry. Requires applicants to describe the plan for building 
increased capacity in computer and network security, to specify 
the roles and responsibilities of each partnering institution 
or collaborative group, and to provide evidence of high 
potential for success in educating and placing students in 
relevant jobs or graduate programs. Instructs the Director to 
evaluate the impact of the program on increasing the quality 
and quantity of computer and network security professionals. 
Authorizes $15 million for FY 2003 and $20 million for each of 
fiscal years 2004 through 2007.
    (b) Expands NSF's existing program for community colleges 
(established by the Scientific and Advanced Technology Act of 
1992) to include grants to improve education in fields related 
to computer and network security. Authorizes $1 million for FY 
2003 and $1.25 million for each of fiscal years 2004 through 
2007.
    (c) Establishes a competitive, merit-based NSF program to 
award grants to institutions of higher education to establish 
programs for students pursuing studies in computer and network 
security research leading to a doctorate degree. Grant funds 
are to be used to support student fellowships of at least 
$25,000 per year, to pay student tuition and fees, and to 
support students in scientific internship programs. Authorizes 
appropriations of $10 million for FY 2003, and $20 million for 
of each fiscal years 2004 through 2007.
    (d) Directs NSF to include computer and network security as 
an approved field of specialization under its current Graduate 
Research Fellowships program.

                          SEC. 6. CONSULTATION

    Requires the NSF Director to consult with other Federal 
agencies in carrying out the programs described in Sections 4 
and 5.

   SEC. 7. FOSTERING RESEARCH AND EDUCATION IN COMPUTER AND NETWORK 
                                SECURITY

    Amends the National Science Foundation Act of 1950 to 
require NSF to take a lead role in fostering and supporting 
research and education in computer and network security.

SEC. 8. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY RESEARCH PROGRAM

    Amends the National Institute of Standards and Technology 
Act to establish a program of assistance to institutions of 
higher education that partner with for-profit entities to 
support multidisciplinary, long-term, high-risk research to 
improve the security of computer systems. Partnerships may also 
include government laboratories. Authorizes the Director to 
award research fellowships to post-doctoral researchers engaged 
in computer security research and to senior researchers who 
wish to move from other research fields to computer security 
research. Instructs the NIST Director to select Program 
Managers who are responsible for establishing the research 
goals for the program, soliciting applications for specific 
research projects to address these goals, and selecting 
research projects for funding. Calls for the NIST Director to 
periodically review the portfolio of research awards in 
consultation with NIST's existing Computer System Security and 
Privacy Advisory Board. Also instructs the Director to enter 
into an arrangement with the National Research Council to 
conduct a formal review of the program and to submit a report 
of this review to Congress.

   SEC. 9. COMPUTER SECURITY REVIEW, PUBLIC MEETINGS, AND INFORMATION

    Authorizes $1,060,000 for FY 2003 and $1,090,000 for FY 
2004 to enable NIST's Computer System Security and Privacy 
Advisory Board to identify emerging issues, including research 
needs related to computer security, privacy, and cryptography 
and, as appropriate, to convene public meetings on those 
subjects, receive presentations, and generate reports for 
public distribution.

                 SEC. 10. INTRAMURAL SECURITY RESEARCH

    Amends the National Institute of Standards and Technology 
Act to authorize NIST to pursue, as part of the agency's in-
house research program, research related to computer security, 
including the development of emerging technologies to ensure 
security of networked systems assembled from components, 
improved security of real-timecomputing and communications 
systems used in industrial and critical infrastructure operations, and 
improved security of computer systems.

                SEC. 11 AUTHORIZATION OF APPROPRIATIONS

    Authorizes appropriations for sections 8 and 10 of the 
bill. For the research programs in section 8, provides $25 
million for FY 2003, $40 million for FY 2004, $55 million for 
FY 2005, $70 million for FY 2006, $85 million for FY 2007, and 
such sums as may be necessary for fiscal years 2008 through 
2012. Authorizes appropriations for section 10 at $6 million 
for FY 2003, $6.2 million for FY 2004, $6.4 million for FY 
2005, $6.6 million for FY 2006, and $6.8 million for FY 2007.

  SEC. 12. NATIONAL ACADEMY OF SCIENCES STUDY ON COMPUTER AND NETWORK 
                  SECURITY IN CRITICAL INFRASTRUCTURES

    Directs the Director of NIST to enter into an agreement 
with the National Research Council to conduct a study of the 
vulnerabilities of the Nation's critical infrastructure 
networks and make recommendations for appropriate improvements. 
The study requires the NRC to review existing data to identify 
gaps in the security of critical infrastructure networks, make 
recommendations for research priorities to address these gaps, 
and review the security of network-related infrastructure 
including industrial process controls. A report of the study 
results is to be submitted to Congress. Authorizes $700,000 for 
the purpose of carrying out the study.

                          VII. Committee Views

    The Committee on Science believes that the Nation's cyber 
security research and development enterprise clearly needs 
strengthening. Not only is too little research in this 
important area being conducted, but the research that this 
being performed is too incremental to lead to breakthroughs. In 
addition, too few students are being trained in this field, 
perpetuating its current failings. The Cyber Security Research 
and Development Act raises the level of Federal funding for 
cyber security research significantly, investing in two of the 
Federal Government's key scientific research agencies: NSF and 
NIST.
    Building on NSF's proven capacity to mobilize the academic 
research community, the Act authorizes NSF to fund new academic 
centers and instructs NSF to fund research that is particularly 
innovative. Awardees selected under this program are to be 
selected through NSF's standard merit-review procedure. The 
merit-review system has been a key to NSF's success. The 
Committee recognizes, however, that review by outside panels 
has limitations, especially in underfunded fields, as the 
shortage of funds can lead review panels to reject research 
that is especially risky and lies outside the boundaries of the 
current paradigms.
    In part for that reason, the Act also authorizes a grant 
program at NIST that is aimed at supporting the kind of high-
risk research that might be overlooked by a system based on 
outside review. The Act authorizes NIST to use an 
administrative model that has been successfully implemented at 
the Defense Advanced Research Projects Agency (DARPA). In that 
model, talented project managers are invested with broad 
latitude to establish research objectives and to solicit and 
fund promising research proposals. This structure shortens the 
approval time for research proposals and allows the project 
manager to move quickly to invest in promising new ideas. In 
addition, the proposals submitted to NIST are expected to be 
focused on specific questions of more immediate interest to 
industry than are those submitted to NSF.
    Recongizing that the lack of Federal leadership in the area 
of cyber security research has impeded progress, the Committee 
believes it is important that an agency assume a leadership 
role in the funding of computer and network security research. 
Thus the Act amends the NSF Organic Act--NSF's basic operating 
statute--to explicitly give NSF a leading role in cyber 
security research and education.

                  National Science Foundation Research

    The Committee recognizes NSF's important role in computer 
and information science, including the agency's important 
contributions to the development of the Internet. The Committee 
also realizes that the NSF has already acknowledged the need 
for greater research in information assurance and has 
established the Trusted Computing program to fund small-scale 
academic research projects related to information assurance. 
However, the Committee believes that the expected level of 
funding for that program--between $4 million and $6 million--is 
insufficient to address the Nation's needs.
    This Act provides significant additional funding--
approximately $570 million for FY 2003 through FY 2007--for 
cyber security research. The Committee emphasizes that the list 
of research areas in section 4 is illustrative and not 
exhaustive.
    While individual investigator research is needed to lay a 
firm foundation in information assurance, the Committee 
recognizes that large multidiciplinary efforts will be required 
to address the complex problems in this field. The Act provides 
funding to establish Computer and Network Security Research 
Centers to promote large-scale, multidisciplinary 
collaborations that exploit the collective knowledge of 
computer scientists, programmers, mathematicians, 
cryptographers, systems engineers, software engineers, social 
scientists, and network architects, among others.
    The Committee also recognizes the need for sustained 
funding over a substantial period of time to ensure that an 
institution has ample time to fully develop and implement high 
quality research programs, create technologically sophisticated 
facilities, attract or develop qualified faculty to support the 
instructional program, and recruit students. The Committee 
expects that the Computer and Network Security Research Centers 
will receive stable, long-term funding.
    The Committee recognizes that the sensitive nature of some 
cyber security research results precludes their publication. 
The Committee encourages NSF to look beyondreferred journal 
citations as proof of a particular individual's abilities and expertise 
or as evidence of a Center's accomplishments.
    The Committee also encourages NSF to support projects and 
Centers with strong connections to the computer and network 
security user community, government laboratories, Federal 
agencies, and private sector companies that depend upon 
reliable information assurance technologies.
    The Committee intends the term ``governmental 
laboratories'' to be construed in its broadest sense. It 
includes laboratories at both the state and Federal level, 
including government-owned, contractor-operated facilities.

            Computer and Network Security Capacity Building

    The Committee firmly believes that the field of computer 
and network security cannot advance unless a major effort is 
made to prepare and recruit the Nation's best and brightest 
students to pursue higher education, and ultimately careers, in 
computer and network security. For this reason, the Act 
establishes several programs at the National Science Foundation 
to provide funds to institutions of higher education to develop 
and implement high-quality undergraduate and graduate programs 
in computer and network security and to attract students to 
them.
    The Committee believes it is critical that institutional 
capacity at a number and variety of institutions have been 
designated by the National Security Agency as Centers of 
Academic Excellence in Information Assurance Education, those 
institutions alone cannot produce enough students to meet the 
projected need for 10,000 information assurance specialists by 
the year 2010. The Act authorizes NSF to provide merit-based 
Computer and Network Security Capacity Building grants to 
institutions of higher education, including two-year colleges, 
to establish or improve certificate, undergraduate and master's 
degree programs in computer and network security.
    The Committee also believes that the computer and network 
security instructional programs supported through this program 
should be informed by the needs of the research and user 
communities and that students gain practical experience in the 
applications of security technologies in authentic settings by 
participating in government or industry internships.
    And since computer and network security professionals with 
a variety of educational credentials will be required in the 
workforce, the program created under section 5 should fund a 
wide assortment of institutions, including 2-year colleges, 
comprehensive colleges, and liberal arts institutions, as well 
as research universities.
    The Committee expects that institutions applying for 
Capacity Building grants will provide an analysis of the 
potential for student enrollment as well as the potential for 
placement in computer and information security as part of their 
applications. Institutions are strongly encouraged to develop 
comprehensive recruitment, retention and placement strategies 
in partnership with K-12 schools, 2-year colleges, and local 
government and industry partners.

           Underrepresented Groups in Science and Technology

    One important goal of the research and education activities 
by the bill is to increase the size and quality of the national 
research community engaged in research related to computer and 
network security. Applications for the NSF research center 
awards under section 4(b) must describe how the center will 
help increase the number of computer and network security 
researchers and other professionals. The NSF programs 
authorized under section 5, including the capacity building 
grants and the graduate traineeship program, and the NIST 
fellowship programs authorized under section 8 are specifically 
focused on enlarging the human resource base of the Nation for 
researchers and other specialties related to computer security.
    The Committee directs NSF in managing its research and 
education activities authorized by the bill to ensure that 
active and sustained efforts are made to include the 
participation by individuals from groups traditionally 
underrepresented in science and engineering and by minority 
serving institutions. Further the Committee directs NSF to 
provide to the Committee within three years of the date of 
initiation of the activities authorized by this bill a report 
that (1) describes the actions taken by the Foundation to 
ensure participation by individuals from underrepresented 
groups and by minority serving institutions, (2) provides data 
on the numbers of individuals from underrepresented groups 
supported by fellowships, traineeships or research 
assistantships under activities authorized by the bill, and (3) 
describes the participation by minority serving institutions in 
activities authorized by the bill.

             Scientific and Advanced Technology Act of 1992

    The Committee recognizes the contributions of two-year 
colleges to meeting the rapidly evolving needs of the technical 
workforce. The Advanced Technological Education Program at NSF 
has contributed significantly to technician education through 
projects, national centers, regional centers, and articulation 
partnerships that bridge two-year and four-year colleges and 
universities. To date the NSF has funded 15 National Centers of 
Excellence that range in focus from biotechnology to 
environmental technology and information technology. The 
Committee feels that the growing demand for technical experts 
in computer and network security justifies the creation of at 
least one Center of Excellence focused on computer and network 
security. This Center should be selected through a competitive, 
merit-reviewed process and shall provide focus and resources 
for the national effort to enhance technical training in 
computer and information security in a variety of technical 
fields at two-year colleges across the U.S. The Committee also 
feels that a number of project grants in computer and network 
security should be awarded to build the technical workforce and 
to develop a national network of technical training programs in 
computer and network security.

    Graduate Traineeships in Computer and Network Security Research

    Computer security research will not be able to move forward 
now or in the future unless universities increase the number of 
doctoral students trained in computer and network security or 
related areas. To accomplish that, graduate students need to 
receive tuition and stipend support, in addition to programs 
aimed at augmenting their research training.
    The Committee believes that, in this case, the most 
effective way to provide this financial and programmatic 
support to graduate students is through traineeships. 
Traineeships, or grants to institutions of higher education for 
the purpose of providing support to graduate students, will 
enable institutions to develop focused programs that will 
complement and enhance the financial support given to students.
    Like other NSF graduate fellowships, the fellowships 
available under this section will be available only to U.S. 
citizens, U.S. nationals, and legally admitted permanent 
resident aliens. However, the Committee recognizes that some 
foreign graduate students and post-doctoral students receive 
indirect support from NSF, as they are supported by funds from 
their research advisor's grants. Given the sensitive nature of 
computer and network security research, the Committee strongly 
encourages NSF to develop policies and procedures aimed to 
protect sensitive or classified information.

             Graduate Research Fellowships Program Support

    The Committee values the Graduate Research Fellowship 
program at the National Science Foundation, which has helped 
recruit students to graduate programs in mathematics, science 
and engineering. While students pursuing graduate degrees in 
computer and network security are already eligible for 
fellowship awards under this program, the Committee believes 
that an explicit statement of this fact will enhance the 
student recruitment effort in computer and network security. 
Therefore, the Act instructs the Director to add computer and 
network security to the list of fields of specialization 
supported by the Graduate Research Fellowship program 
established under section 10 of the National Science Foundation 
Act of 1950.

   Fostering Research and Education in Computer and Network Security

    The Committee believes that the lack of a single Federal 
agency in a leadership role for research in cyber security is a 
factor that has hampered advancement of the field. Therefore, 
the Act amends the National Science Foundation Act of 1950 to 
charge NSF with a leadership role in fostering and supporting 
research and education activities to improve the security of 
networked information systems.

    National Institute of Standards and Technology Research Program

    Section 8 of the bill amends the NIST Act to establish an 
extramural research program centered on the security of 
computer systems. Awards are authorized for institutions of 
higher education that form partnerships with for-profit 
entities. The Committee expects that the research agenda of the 
program will be informed by the needs of industry and 
government.
    In managing the research program, the Committee intends 
that NIST use the model developed by DARPA for managing its 
research programs. Consistent with that model, the bill 
specifies that the research program must be managed by program 
managers who have expertise in computer security research and 
also substantial knowledge of the vulnerabilities of existing 
computer systems. Ideal candidates will have a thorough 
knowledge of the needs of the user community as well as the 
capabilities of the research community that generates the basic 
knowledge and innovations needed to fulfill these needs.
    The bill requires that program managers be given broad 
authority for defining the research goals of their programs, 
for identifying and motivating talented researchers to propose 
research projects to address the program goals, and for 
selecting specific research proposals for funding. Because of 
the large influence the program managers will have on the 
ultimate success of the research program, the Committee expects 
the NIST Director to carefully review the qualifications of 
potential program managers and to take advantage of the 
Intergovernmental Personnel Act and recruitment of new civil 
service employees, as well as current NIST employees, to ensure 
that highly qualified individuals are placed in these 
positions.

                       Attracting New Researchers

    While research funding is critical to ensuring advances in 
computer systems security research, a larger pool of talented 
researchers is also required to drive innovation at the 
necessary rate. While one way to promote the development and 
expansion of an able research community is by providing 
opportunities for junior researchers to gain post-doctoral 
training while initiating their own careers as independent 
investigators, another is to sponsor senior researchers 
interested in changing their research focus to problems of 
computer systems security. Therefore, the Act authorizes NIST 
to establish a program that would provide both post-doctoral 
research support to U.S. citizens, nationals, or permanent 
resident aliens in computer security research, and support for 
senior researchers.

                             Data Required

    The Committee directs NIST to include in the report 
required under section 22(e) of the NIST Act, as added by this 
bill, data on the numbers of individuals from underrepresented 
groups supported by fellowships or research assistantships by 
activities authorized by the bill, and a description of the 
participation by minority serving institutions in activities 
authorized by the bill.

                          VIII. Cost Estimate

    Rule XIII, clause 3(d)(2) of the House of Representatives 
requires each committee report accompanying each bill or joint 
resolution of a public character to contain: (1) an estimate, 
made by such committee, of the costs which would be incurred in 
carrying out such bill or joint resolution in the fiscal year 
in which it is reported, and in each of the five fiscal years 
following such fiscal year (or for the authorized duration of 
any program authorized by such bill or joint resolution, if 
less than five years); (2) a comparison of the estimate of 
costs described in subparagraph (1) of this paragraph made by 
such committee with an estimate of such costs made by any 
Government agency and submitted to such committee; and (3) when 
practicable, a comparison of the total estimated funding level 
for the relevant program (or programs) with the appropriate 
levels under current law. However, House Rule XIII, clause 
3(d)(B) provides that this requirement does not apply when a 
cost estimate and comparison prepared by the Director of the 
Congressional Budget Office under section 402 of the 
Congressional Budget Act of 1974 has been timely submitted 
prior to the filing of the report and included in the report 
pursuant to House Rule XIII, clause 3(c)(3). A cost estimate 
and comparison prepared by the Director of the Congressional 
Budget Office under section 402 of the Congressional Budget Act 
of 1974 has been timely submitted to the Committee on Science 
prior to the filing of this report and is included in Section 
IX of this report pursuant to House Rule XIII, clause 3(c)(3).
    Rule XIII, clause 3(c)(2) of the House of Representatives 
requires each committee report that accompanies a measure 
providing new budget authority (other than continuing 
appropriations), new spending authority, or new credit 
authority, or charges in revenues or tax expenditures to 
contain a cost estimate, as required by section 308(a)(1) of 
the Congressional Budget Act of 1974 and, when practicable with 
respect to estimate of new budget authority, a comparison of 
the total estimated funding level for the relevant program (or 
programs) to the appropriate levels under current law. H.R. 
3394 does not contain any new budget authority, credit 
authority, or changes in revenues or tax expenditures. Assuming 
that the sums authorized under the bill are appropriated, H.R. 
3394 does authorize additional discretionary spending, as 
described in the Congressional Budget Office report on the 
bill, which is contained in Section IX of this report.

             IX. Congressional Budget Office Cost Estimate

                                     U.S. Congress,
                               Congressional Budget Office,
                                 Washington, DC, December 17, 2001.
Hon. Sherwood L. Boehlert,
Chairman, Committee on Science,
House of Representatives, Washington, DC.
    Dear Mr. Chairman: The Congressional Budget Office has 
prepared the enclosed cost estimate for H.R. 3394, the Cyber 
Security Research and Development Act.
    If you wish further details on this estimate, we will be 
pleased to provide them. The CBO staff contact is Kathleen 
Gramp.
            Sincerely,
                    Barry B. Anderson, (for Dan L. Crippen,
                                                         Director).
    Enclosure.

H.R. 3394--Cyber Security Research and Development Act

    Summary: H.R. 3394 would authorize appropriations for 
several research initiatives related to computer security at 
two agencies--the National Science Foundation (NSF) and the 
National Institute of Standards and Technology (NIST). The bill 
would establish the terms and conditions for awarding grants, 
fellowships, cooperative agreements related to computer 
security, and would authorize NIST to conduct similar research 
at its laboratories. It would authorize the appropriation of 
$878 million over the 2002-2007 period for these activities, 
and any amounts necessary to continue the fellowships and 
cooperative agreements at NIST through 2012. This total would 
include funding for the ongoing activities of the Computer 
System Security and Privacy Advisory Board and a study by the 
National Academy of Sciences on the vulnerability of the 
nation's network infrastructure.
    Assuming appropriation of the specified amounts, CBO 
estimates that implementing this bill would cost $420 million 
over the 2002-2006 period. The bill would not affect direct 
spending or receipts; therefore, pay-as-you-go procedures would 
not apply.
    H.R. 3394 contains no intergovernmental or private-sector 
mandates as defined in the Unfunded Mandates Reform Act (UMRA) 
and would impose no costs on state, local, or tribal 
governments.
    Estimated cost to the Federal Government: The estimated 
budgetary impact of H.R. 3394 is shown in the following table. 
The costs of this legislation fall within budget functions 250 
(general science, space, and technology) and 376 (commerce and 
housing credit). For this estimate, CBO assumes that funds will 
be appropriated near the beginning of each fiscal year and that 
outlays will occur at rates similar to those for other research 
programs at NSF and NIST.

----------------------------------------------------------------------------------------------------------------
                                                                       By fiscal year, in million of dollars--
                                                                    --------------------------------------------
                                                                       2002     2003     2004     2005     2006
----------------------------------------------------------------------------------------------------------------
                                  CHANGES IN SPENDING SUBJECT TO APPROPRIATION
Authorization level................................................        1      105      152      184      206
Estimated outlays..................................................        1       30       85      134      170
----------------------------------------------------------------------------------------------------------------

    Pay-as-you-go considerations: None.
    Estimated impact on State, local, and tribal governments: 
H.R. 3394 contains no intergovernmental mandates as defined in 
UMRA and would impose no costs on state, local, or tribal 
governments. The bill would benefit state governments by 
authorizing the appropriation of $878 million, much would be 
for grant programs to institutions of higher education 
(including public universities) to develop programs to improve 
the security of computer networks.
    Estimated impact on the private sector: This bill contains 
no new private-sector mandates as defined in UMRA.
    Estimate prepared by: Federal costs: Kathleen Gramp 
(National Science Foundation) and Ken Johnson (NIST); impact on 
State, local, and tribal governments: Elyse Goldman; impact on 
the private sector: Jean Talarico.
    Estimate approved by: Peter H. Fontaine, Deputy Assistant 
Director for Budget Analysis.

                  X. Compliance With Public Law 104-4

    H.R. 3394 contains no unfunded mandates.

          XI. Committee Oversight Findings and Recommendations

    Rule XIII, clause 3(c)(1) of the House of Representatives 
requires each committee report to include oversight findings 
and recommendations required pursuant to clause 2(b)(1) of rule 
X. The Committee on Science's oversight findings and 
recommendations are reflected in the body of this report.

                XII. Constitutional Authority Statement

    Rule XII, clause 3(d)(1) of the House of Representatives 
requires each report of a committee on a bill or joint 
resolution of a public character to include a statement citing 
the specific powers granted to the Congress in the Constitution 
to enact the law proposed by the bill or joint resolution. 
Article I, section 8 of the Constitution of the United States 
grants Congress the authority to enact H.R. 3394.

               XIII. Federal Advisory Committee Statement

    H.R. 3394 does not establish nor authorize the 
establishment of any advisory committee.

                 XIV. Congressional Accountability Act

    The Committee finds that H.R. 3394 does not relate to the 
terms and conditions of employment or access to public services 
or accommodations within the meaning of section 102(b)(3) of 
the Congressional Accountability Act (Public Law 104-1).

       XV. Statement on Preemption of State, Local, or Tribal Law

    This bill is not intended to preempt any state, local, or 
tribal law.

       XVI. Changes in Existing Law Made by the Bill, as Reported

  In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
matter is printed in italic, existing law in which no change is 
proposed is shown in roman):

SECTION 3 OF THE NATIONAL SCIENCE FOUNDATION ACT OF 1950

           *       *       *       *       *       *       *

                      FUNCTIONS OF THE FOUNDATION

  Sec. 3. (a) The Foundation is authorized and directed--
          (1) * * *

           *       *       *       *       *       *       *

          (6) to provide a central clearinghouse for the 
        collection, interpretation, and analysis of data on 
        scientific and engineering and to provide a source of 
        information for policy formulation by other agencies of 
        the Federal Government; [and]
          (7) to initiate and maintain a program for the 
        determination of the total amount of money for 
        scientific and engineering research, including money 
        allocated for the construction of the facilities 
        wherein such research is conducted, received by each 
        educational institution and appropriate nonprofit 
        organization in the United States, by grant, contract, 
        or other arrangement from agencies of the Federal 
        Government, and to report annually thereon to the 
        President and the Congress[.]; and
          (8) to take a leading role in fostering and 
        supporting research and education activities to improve 
        the security of networked information systems.

           *       *       *       *       *       *       *

                              ----------                              

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY ACT

           *       *       *       *       *       *       *

  Sec. 20. (a) * * *

           *       *       *       *       *       *       *

  (d) As part of the research activities conducted in 
accordance with subsection (b)(4), the Institute shall--
          (1) conduct a research program to address emerging 
        technologies associated with assembling a networked 
        computer system from components while ensuring it 
        maintains desired security properties;
          (2) carry out research and support standards 
        development activities associated with improving the 
        security of real-time computing and communications 
        systems for use in process control; and
          (3) carry out multidisciplinary, long-term, high-risk 
        research on ways to improve the security of computer 
        systems.
  [(d)] (e) As used in this section--
          (1) the term ``computer system''--
                  (A) * * *
                  (B) includes--
                          (i) computers and computer networks;

           *       *       *       *       *       *       *

  (f) There are authorized to be appropriated to the Secretary 
$1,060,000 for fiscal year 2003 and $1,090,000 for fiscal year 
2004 to enable the Computer System Security and Privacy 
Advisory Board, established by section 21, to identify emerging 
issues, including research needs, related to computer security, 
privacy, and cryptography and, as appropriate, to convene 
public meetings on those subjects, receive presentations, and 
publish reports, digests, and summaries for public distribution 
on those subjects.

           *       *       *       *       *       *       *

            RESEARCH PROGRAM ON SECURITY OF COMPUTER SYSTEMS

  Sec. 22. (a) Establishment.--The Director shall establish a 
program of assistance to institutions of higher education that 
enter into partnerships with for-profit entities to support 
research to improve the security of computer systems. The 
partnerships may also include government laboratories. The 
program shall--
          (1) include multidisciplinary, long-term, high-risk 
        research;
          (2) include research directed toward addressing needs 
        identified through the activities of the Computer 
        System Security and Privacy Advisory Board under 
        section 20(f); and
          (3) promote the development of a robust research 
        community working at the leading edge of knowledge in 
        subject areas relevant to the security of computer 
        systems by providing support for graduate students, 
        post-doctoral researchers, and senior researchers.
  (b) Fellowships.--(1) The Director is authorized to establish 
a program to award post-doctoral research fellowships to 
individuals who are citizens, nationals, or lawfully admitted 
permanent resident aliens of the United States and are seeking 
research positions at institutions, including the Institute, 
engaged in research activities related to the security of 
computer systems, including the research areas described in 
section 4(a)(1) of the Cyber Security Research and Development 
Act.
  (2) The Director is authorized to establish a program to 
award senior research fellowships to individuals seeking 
research positions at institutions, including the Institute, 
engaged in research activities related to the security of 
computer systems, including the research areas described in 
section 4(a)(1) of the Cyber Security Research and Development 
Act. Senior research fellowships shall be made available for 
established researchers at institutions of higher education who 
seek to change research fields and pursue studies related to 
the security of computer systems.
  (3)(A) To be eligible for an award under this subsection, an 
individual shall submit an application to the Director at such 
time,in such manner, and containing such information as the 
Director may require.
  (B) Under this subsection, the Director is authorized to 
provide stipends for post-doctoral research fellowships at the 
level of the Institute's Post Doctoral Research Fellowship 
Program and senior research fellowships at levels consistent 
with support for a faculty member in a sabbatical position.
  (c) Awards; Applications.--The Director is authorized to 
award grants or cooperative agreements to institutions of 
higher education to carry out the program established under 
subsection (a). To be eligible for an award under this section, 
an institution of higher education shall submit an application 
to the Director at such time, in such manner, and containing 
such information as the Director may require. The application 
shall include, at a minimum, a description of--
          (1) the number of graduate students anticipated to 
        participate in the research project and the level of 
        support to be provided to each;
          (2) the number of post-doctoral research positions 
        included under the research project and the level of 
        support to be provided to each;
          (3) the number of individuals, if any, intending to 
        change research fields and pursue studies related to 
        the security of computer systems to be included under 
        the research project and the level of support to be 
        provided to each; and
          (4) how the for-profit entities and any other 
        partners will participate in developing and carrying 
        out the research and education agenda of the 
        partnership.
  (d) Program Operation.--(1) The program established under 
subsection (a) shall be managed by individuals who shall have 
both expertise in research related to the security of computer 
systems and knowledge of the vulnerabilities of existing 
computer systems. The Director shall designate such individuals 
as program managers.
  (2) Program managers designated under paragraph (1) may be 
new or existing employees of the Institute or individuals on 
assignment at the Institute under the Intergovernmental 
Personnel Act of 1970.
  (3) Program managers designated under paragraph (1) shall be 
responsible for--
          (A) establishing and publicizing the broad research 
        goals for the program;
          (B) soliciting applications for specific research 
        projects to address the goals developed under 
        subparagraph (A);
          (C) selecting research projects for support under the 
        program from among applications submitted to the 
        Institute, following consideration of--
                  (i) the novelty and scientific and technical 
                merit of the proposed projects;
                  (ii) the demonstrated capabilities of the 
                individual or individuals submitting the 
                applications to successfully carry out the 
                proposed research;
                  (iii) the impact the proposed projects will 
                have on increasing the number of computer 
                security researchers;
                  (iv) the nature of the participation by for-
                profit entities and the extent to which the 
                proposed projects address the concerns of 
                industry; and
                  (v) other criteria determined by the 
                Director, based on information specified for 
                inclusion in applications under subsection (c); 
                and
          (D) monitoring the progress of research projects 
        supported under the program.
  (e) Review of Program.--(1) The Director shall periodically 
review the portfolio of research awards monitored by each 
program manager designated in accordance with subsection (d). 
In conducting those reviews, the Director shall seek the advice 
of the Computer System Security and Privacy Advisory Board, 
established under section 21, on the appropriateness of the 
research goals and on the quality and utility of research 
projects managed by program managers in accordance with 
subsection (d).
  (2) The Director shall also contract with the National 
Research Council for a comprehensive review of the program 
established under subsection (a) during the 5th year of the 
program. Such review shall include an assessment of the 
scientific quality of the research conducted, the relevance of 
the research results obtained to the goals of the program 
established under subsection (d)(3)(A), and the progress of the 
program in promoting the development of a substantial academic 
research community working at the leading edge of knowledge in 
the field. The Director shall submit to Congress a report on 
the results of the review under this paragraph no later than 
six years after the initiation of the program.
  (f) Definitions.--For purposes of this section--
          (1) the term ``computer system'' has the meaning 
        given that term in section 20(d)(1); and
          (2) the term ``institution of higher education'' has 
        the meaning given that term in section 101 of the 
        Higher Education Act of 1965 (20 U.S.C. 1001).

           *       *       *       *       *       *       *

  Sec. [22] 32. Appropriations to carry out the provisions of 
this Act may remain available for obligation and expenditure 
for such period or periods as may be specified in the Acts 
making such appropriations.

                    XVII. Committee Recommendations

    On December 6, 2001, a quorum being present, the Committee 
on Science favorably reported the Cyber Security Research and 
Development Act, by a voice vote, and recommends its enactment.

      XVIII. Statement of General Performance Goals and Objectives

    Pursuant to clause (3)(c) of House rule XIII, the goals of 
H.R. 3394 are (1) to increase the amount of innovative basic 
cyber security research being supported by the Federal 
Government; (2) to increase the number of world class 
researchers conducting cyber security research in the United 
States; (3) build new partnerships between industry, academia, 
and Federal agencies and laboratories; and (4) increase the 
number and quality of undergraduate and graduate students 
preparing for careers in information assurance research, 
development, and implementation.

               XIX. Exchange of Committee Correspondence

                          House of Representatives,
                                      Committee on Science,
                                  Washington, DC, January 28, 2002.
Hon. John Boehner,
Chairman, Committee on Education and The Workforce, House of 
        Representatives, Washington, DC.
    Dear Chairman Boehner: Thank you for your letter regarding 
the Education and the Workforce Committee's jurisdictional 
interest in H.R. 3394, the Cyber Security Research and 
Development Act.
    I acknowledge your committee's jurisdiction over portions 
of H.R. 3394 and appreciate your cooperation in moving the bill 
to the House floor expeditiously. I concur that your decision 
to forego further action on the bill will not prejudice the 
Education and Workforce Committee with respect to its 
jurisdictional prerogatives on H.R. 3394 or on similar or 
related legislation. Should a conference occur on H.R. 3394 or 
similar legislation, the Committee on Science will support your 
request to have conferees on this or similar legislation that 
falls within your Committee's jurisdiction. I will include a 
copy of your letter and this response in the Committee's report 
on the bill as well as in the Congressional Record when the 
House considers the legislation.
    Once again, thank you for your cooperation in this matter.
            Sincerely,
                                      Sherwood L. Boehlert,
                                                          Chairman.
                                ------                                

                             Committee on Education
                               and the Workforce,
                                  Washington, DC, January 28, 2002.
Hon. Sherwood L. Boehlert,
Chairman, Committee on Science,
Rayburn HOB, Washington, DC.
    Dear Chairman Boehlert: Thank you for working with me 
regarding H.R. 3394, the ``Cyber Security Research and 
Development Act'', which was referred to the Committee on 
Science and in addition the Committee on Education and the 
Workforce, and ordered favorably reported by your Committee on 
December 6, 2001. I understand your desire to have this 
legislation considered expeditiously by the House; hence, I do 
not intend to hold a hearing or markup on this legislation.
    In agreeing to waive consideration by our Committee, I 
would expect you to agree that this procedural route should not 
be construed to prejudice the Committee on Education and the 
Workforce's jurisdictional interest and prerogatives on this or 
any similar legislation and will not be considered as precedent 
for consideration of matters of jurisdictional interest to my 
Committee in the future. I would also expect your support in my 
request to the Speaker for the appointment of conferees from my 
Committee with respect to matters within the jurisdiction of my 
Committee should a conference with the Senate be convened on 
this or similar legislation.
    I would appreciate your including our exchange of letters 
in your Committee's report to accompany H.R. 3394, which I 
understand you intend to file this week. Again, I thank you for 
working with me in developing this legislation and I look 
forward to working with you on these issues in the future.
            Sincerely,
                                              John Boehner,
                                                          Chairman.

                XX. Proceedings of Full Committee Markup

 PROCEEDINGS OF THE FULL COMMITTEE MARKUP ON H.R. 3394, CYBER SECURITY 
             RESEARCH AND DEVELOPMENT ACT, DECEMBER 6, 2001

    The committee met, pursuant to call, at 11:10 a.m., in room 
2318 of the Rayburn House Office Building, Hon. Sherwood L. 
Boehlert (chairman of the committee) presiding.
    Chairman Boehlert. Good morning. The Committee on Science 
will be in order. Pursuant to notice, the Committee on Science 
is meeting today to consider the following measures, H.R. 3394, 
the Cyber Security Research and Development Act, and H.R. 3400, 
the Networking and Information Technology Research Advancement 
Act. I ask unanimous consent for the authority to recess the 
Committee at any point and, without objection, so ordered.
    This morning we will mark up two important bills to boost 
our Nation's efforts in information technology. The first bill, 
H.R. 3394, which I introduced with my partner, Mr. Hall, 
creates new research programs to improve cyber security. The 
second bill, H.R. 3400, introduced by Research Subcommittee 
Chairman Nick Smith and Ranking Member Eddie Bernice Johnson, 
will augment and improve our existing interagency programs in 
networking and information technology.
    Both bills have the hallmarks of Science Committee 
legislation. They promote targeted solutions to real problems 
that were raised by expert witnesses at Committee hearings. 
They are designed to solve problems over the long-run, not just 
temporarily; and they are bipartisan. Indeed, the majority and 
minority staffs of the Committee worked together on these bills 
from day one.
    Let me say a bit more about H.R. 3394, the Cyber Security 
Research and Development Act, and Mr. Smith will discuss H.R. 
3400 in detail when we take it up at a later time.
    As I have pointed out repeatedly in recent weeks, the cyber 
security threat is real and potentially devastating. Experts 
from industry, government, and academia have told us that we 
simply do not have enough people conducting enough promising 
research on how to protect our computers and networks. And no 
federal agency is charged with solving that problem.
    H.R. 3394 attacks those concerns head on. It creates new 
programs at the National Science Foundation and the National 
Institute of Standards and Technology to draw new researchers 
into the cyber security field, to promote incentives to conduct 
more creative research, and to encourage undergraduates, 
graduate students, and post-docs to study cyber security.
    Right now, it's hard even to come up with a figure for how 
much the Federal Government is devoting to cyber security 
research, but the number is believed to be in the range of $60 
million, a pittance, really, considering the risk. This bill 
authorizes almost $800 million over 5 years to build a cadre of 
researchers and to set them to work on the problem.
    We hope to move this bill to the Floor early next year, and 
we are working with the Senate to develop a companion measure. 
This Committee must continue to lead the way indeveloping long-
term solutions to the problems that have come to the forefront since 
September 11.
    The Chair recognizes distinguished Ranking Member, Mr. Hall 
of Texas.
    [Statement of Mr. Boehlert follows:]

              Opening Statement of Hon. Sherwood Boehlert

     This morning we will mark up two important bills to boost 
our nation's efforts in information technology. The first bill, 
H.R. 3394, which I introduced with Mr. Hall, creates new 
research programs to improve cybersecurity. The second, H.R. 
3400, introduced by Research Subcommittee Chairman Nick Smith 
and Ranking Member Eddie Bernice Johnson, will augment and 
improve our existing interagency program in networking and 
information technology.
    Both bills have the hallmarks of Science Committee 
legislation--they promote targeted solutions to real problems 
that were raised by expert witnesses at Committee hearings; 
they are designed to solve problems over the long-run, not just 
temporarily; and they are bipartisan. Indeed, the majority and 
minority staffs of the Committee worked together on these bills 
from day one.
    Let me say a bit more about H.R. 3394, the ``Cyber Security 
Research and Development Act,'' and Mr. Smith will discuss H.R. 
3400 in detail when we take it up a little later.
    As I've pointed out repeatedly in recent weeks, the 
cybersecurity threat is real and potentially devastating. 
Experts from industry, government and academia have told us 
that we simply do not have enough people conducting promising 
research on how to protect our computers and networks. And no 
federal agency is charged with solving that problem.
    H.R. 3394 attacks those concerns head on. It creates new 
programs at the National Science Foundation and the National 
Institute of Standards and Technology to draw new researchers 
into the cyber security field, to provide incentives to conduct 
more creative research, and to encourage undergraduates, 
graduate students and post-docs to study cybersecurity.
    Right now, it's hard even to come up with a figure for how 
much the federal government is devoting to cybersecurity 
research, but the number is believed to be in the range of $60 
million--a pittance, really, considering the risk. This bill 
authorizes almost $800 million over five years to build a cadre 
of researchers and set them to work on the problem.
    We hope to move this bill to the floor early next year, and 
we are working with the Senate to develop a companion measure.
    This Committee must continue to lead the way in developing 
long-term solutions to the problems that have come to the fore 
since September 11th.

    Mr. Hall. Mr. Chairman, thank you. And, of course, this 
bill just hopefully paves the way for better computer security. 
And when you say that, you have just about said everything you 
can say for the bill, and you covered it very well. As the 
Committee knows, in the past few years, computer virus attacks 
by the computer hackers and electronic identification theft 
have become more common, and the events this fall makes us 
realize how vulnerable we are.
    We have had recent testimony before the Science Committee. 
These are too few scientists and too few engineers engaged in 
research on information security and too little funding for the 
security research, as you have pointed out.
    H.R. 3394 simply establishes substantial new research 
programs at the National Science Foundation and the National 
Institute of Standards and Technology. And these programs will 
support graduate students, postdoctoral researchers, senior 
researchers, while encouraging stronger ties between 
universities and industry.
    And the provisions pertaining to the thrust of these bills 
were first developed by Representative Baird and are contained 
in H.R. 3316, which is the bill he introduced a few weeks ago. 
I think that is very important and this Chairman and this 
Committee has given a lot of credence to that. I want to thank 
Congressman Baird for his important contribution to the 
legislation.
    Mr. Chairman, if I could, I would like to yield to him for 
any comments he wishes to make, limited down to my 15 minutes.
    [Statement of Mr. Hall follows:]

                Opening Statement of Hon. Ralph M. Hall

    The Cyber Security Research and Development Act, H.R. 3394, 
which Chairman Boehlert and I recently introduced, fills an 
important gap in current information technology research 
programs--namely, the need for better computer security.
    In the past few years, computer viruses, attacks by 
computer hackers, and electronic identification theft have 
become more common. The events of this fall have made us 
realize just how vulnerable we are to attack and have 
underscored the need to enhance the protection of the Nation's 
physical and electronic infrastructure.
    Recent testimony before the Science Committee highlighted 
an obstacle to achieving this goal. Currently there are too few 
scientists and engineers engaged in research on information 
security and too little funding for security research. and as 
federal agencies and private industry have found, there are few 
people with specialized computer security skills.
    H.R. 3394 establishes substantial new research programs at 
the Nation Science Foundation and the National Institute of 
Standards and Technology. Programs at both agencies are multi-
year and will increase the community of computer security 
researchers.
    These programs will support graduate students, post-
doctoral researchers and senior researchers, while encouraging 
stronger ties between universities and industry. This industry 
linkage will provide a reality check for the research 
priorities and will facilitate transfer of research results 
into new products and services.
    The provisions pertaining to NIST were first developed by 
Rep. Baird and are contained in H.R. 3316, a bill he introduced 
a few weeks ago. I want to thank Congressman Baird for his 
important contribution to this legislation, and yield to him 
for any comments he wishes to make on the bill.

    Chairman Boehlert. Without objection, go to.
    Mr. Baird. Mr. Chairman, and, Ranking Member, thank you 
very much. I want to thank you for your leadership on this 
important issue. Certainly coming from the great State of 
Washington where technology is so important to our economy, we 
know these issues well. And I want to emphasize that this is 
not just about an economic issue. It is actually about saving 
human lives with our air traffic control system, emergency 
medical response, water production, et cetera, all governed and 
communicated through information technology. Making sure that 
technology and the infrastructure is secure is not just an 
economic good policy; it is about saving lives.
    And I commend you for your leadership. Providing 
researchers and trained graduate students who can conduct 
research into this area is absolutely critical today and for 
the long-term viability of our economy. And I am privileged to 
be part of this. And thank you for including my statement.
    Chairman Boehlert. Thank you very much, Mr. Baird. Without 
objection, all additional member opening statements will be 
placed in the record at this point.
    [Statement of Mr. Smith of Michigan follows:]

            Opening Statement of Hon. Congressman Nick Smith

    Thank you, Mr. Chairman, for holding this markup today on 
two pieces of legislation that will significantly revamp our 
information technology and computer security research efforts. 
In keeping with the spirit of this Committee, I think we have 
put together two truly bipartisan bills will provide guidance 
and funding for important federal research and development 
challenges.
    I am pleased to be the sponsor of one of these bills along 
with my friend and colleague Congresswoman Johnson of Texas. 
Our bill, H.R. 3400, the Networking and Information Technology 
Research and Advancement Act (NITRA), will update and re-
authorize federally funded basic research in information 
technology. The bill authorizes a multi-agency research 
initiative that will ensure that America stays at the cutting 
edge of new information technologies that stimulate economic 
growth, stimulate further scientific advancements, and make all 
of our lives better.
    Additionally, I am proud to be a cosponsor of H.R. 3394, 
the Cybersecurity Research and Development Act, which will 
establish a research plan among several agencies to shore up 
the security of our computer systems. While much attention has 
been focused on other, more tangible forms of terrorism, we 
must not overlook the national security threat posed to our 
computer systems. In this age where we are increasingly 
dependent on computers for daily activities, the need for 
computer security cannot be understated. H.R. 3394 devotes 
significant resources to respond to these threats.
    I urge members to support both of these bills that will 
strengthen our research efforts to foster innovation, continued 
economic growth, and improve our national security from the 
very real threat of cyberterrorism. I am looking forward to 
this markup, and I am hopeful that we can pass these bills 
through committee and move ahead with floor preparation as 
expeditiously as possible.

    [Statement of Ms. Eddie Bernice Johnson follows:]

            Opening Statement of Hon. Eddie Bernice Johnson

    Mr. Speaker, I understand and support the Cyber Security 
Research and Development Act's aim to support research and 
education activities associated with increasing network and 
computer security.
    The events over the last few months have given America more 
reasons to establish and sustain research programs to stimulate 
the development of vigorous research enterprise in network and 
computer security. Also, the events have provided us with 
another opportunity to reevaluate our society and to appreciate 
the wealth of diversity in our nation.
    However, this legislation can provide an opportunity, which 
the language of the bill does not address. We can use this 
legislation to reiterate our commitment to diversity by 
providing an opportunity for us to ensure that everyone is 
provided the tools to succeed.
    For this reason, I would like the opportunity to work with 
the Majority, before this bill goes to the House floor for a 
vote. My aim is to place language within H.R. 3394 that will 
encourage participation from individuals of traditionally 
underrepresented groups and minority serving institutions.
    So often these individuals and institutions are unable to 
participate in the kinds of opportunities that this legislation 
will provide. I believe that we must make a valiant effort to 
include them as we have done in several pieces of legislation 
this committee has passed this session.
    I have provided the Majority staff with the changes I am 
proposing and look forward to working with you in our endless 
efforts to ensure opportunity to all.

    [Statement of Mr. Forbes follows:]

               Opening Statement of Hon. J. Randy Forbes

    Mr. Chairman, I would like to express my strong support 
both for the Networking and Information Technology Research 
Advancement Act, as well as the Cyber Security Research and 
Development Act. As a cosponsor of both pieces of legislation, 
I appreciate my colleagues' efforts to coordinate our national 
response to the very serious threat of cyber terrorism.
    Though it won't bring the death and destruction of 
biological or chemical weapons, cyber terrorism holds the power 
to disrupt our way of life, harm people's personal interests, 
and cause tremendous losses for businesses. Both bills before 
us are necessary for updating our national ability to thwart 
terrorist plots to disrupt our economy and do harm to our way 
of life using our own computer networks. As we heard from 
various witnesses who have come before this Committee over the 
past several months, have bright and innovative minds in this 
nation, but they need direction and coordination to maximize 
their efforts to find ways to prevent cyber terrorist attacks 
and ameliorate their consequences.
    The bills before us today will coordinate the various 
research and development efforts that currently exist and 
increase the overall federal contribution for them. In 
addition, they will revise the rules under which federal 
dollars operate to give our science and technology experts the 
ability to think outside the box. Our enemies use their evil 
cunning as a weapon. We should not be restricted in our 
thinking to defeat their efforts.
    Mr. Chairman, I appreciate your bringing these bills to our 
Committee so quickly. I am hopeful that they will get such 
prompt treatment by the Congress as a whole so that we can 
begin to implement this coordinated policy. Thank you.

    Chairman Boehlert. We will now consider H.R. 3394, the 
Cyber Security Research and Development Act. I ask unanimous 
consent that the bill be considered as read and open to 
amendment at any point. And I ask the members to proceed with 
the amendments in the order on the roster. And since we don't 
have a roster, I will ask, are there any amendments? Mr. 
Matheson.
    Mr. Matheson. I have none.
    Chairman Boehlert. Okay. Okay. All right. Yes. Who do--do I 
see a hand? Ms. Johnson.
    Ms. Johnson. Thank you, Mr. Chairman. I want to express my 
appreciation, and I have an amendment at the desk and would 
like to ask for that consideration. I have been in contact with 
the staff. And all it does is simply request the research 
dollars to keep in mind the Historically Black Universities 
and--Colleges and Universities, as well as the Hispanic Serving 
Colleges and Universities, as the money is distributed. And I 
would be happy to work with you and the staff with----
    Chairman Boehlert. And I will look forward to working with 
you. This is a cause near and dear to your heart and to mine 
also. So we will work cooperatively and do something for the 
Floor.
    Ms. Johnson. Thank you very much, Mr. Chairman.
    Chairman Boehlert. Anyone else seek recognition? Any 
further discussion? If no, the vote occurs on the bill. Okay. I 
reported--we haven't got--I am just trying to count for 
numbers. You are worth two, Jim. All right. We are just 23, 24. 
We are getting there.
    Mr. Mathson. Okay.
    Chairman Boehlert. Do I hear 25? Are we all set? Yeah. Here 
we are. Since there are no further discussion, no further 
amendments, the vote occurs on the bill. All in favor, say aye. 
Noes? The ayes have it. Without objection, the bill is ordered 
reported.
    Mr. Hall. Mr. Chairman----
    Chairman Boehlert. Yes, sir.
    Mr. Hall. Mr. Chairman----
    Chairman Boehlert. Mr. Hall.
    Mr. Hall. I move that the Committee favorably report H.R. 
3394 to the House with the recommendation that the bill do 
pass. Furthermore, I move the staff be instructed to prepare 
the legislative report and make the necessary and technical and 
conforming changes, and that the Chairman take all necessary 
steps to bring the bill before the House for consideration. I 
yield back my time.
    Chairman Boehlert. All right. The Chair notes the presence 
of a reporting quorum. The question is on the motionto report 
the bill favorably. Those in favor of the motion will signify by saying 
aye. Opposed, no. The ayes appear to have it. The bill is favorably 
reported. Without objection, the motion to reconsider is laid upon the 
table. I move that members have 2 subsequent calendar days in which to 
submit supplemental, minority, or additional views on the measure. 
Without objection, so ordered.
    I move, pursuant to Clause 1 of the Rule 22 of the House--
Rules of the House of Representatives, that the Committee 
authorize the Chairman to offer such motions as may be 
necessary in the House to go to conference with the Senate on 
the bill H.R. 3394, or a similar Senate bill. Without 
objection, so ordered.
    [H.R. 3394 follows:]

    
    
    [The information follows:]

H.R. 3394--The Cyber Security Research and Development Act, Introduced 
 by Mr. Boehlert, Mr. Hall (TX), Mr. Smith (TX), Mr. Baird, Mr. Smith 
                (MI), and Ms. Eddie Bernice Johnson (TX)

                       SECTION-BY-SECTION SUMMARY

Sec. 1. Short title
    ``Cyber Security Research and Development Act''
Sec. 2. Findings
    Discuss the interdependent nature of critical infrastructures 
brought about by advancements in computing and communications 
technology; the increased consequences of failure of communications and 
other critical services caused by exponential increases in 
interconnectivity; the nation's lack of preparedness for a coordinated 
cyber and physical attack; the lack of sufficient long-term research 
funding and the shortage of outstanding researchers in the field of 
cyber security; and the lack of coordination among government, 
academia, and industry for computer security; and the need to 
significantly increase the Federal investment in computer and network 
security research and development.
Sec. 3. Definitions
    Defines the term `Director' as the Director of the National Science 
Foundation (NSF) (Note that where the term `Director' is used in 
section 8 it refers to the Director of the National Institute for 
Standards and Technology (NIST)). Uses the definition for `institution 
of higher education' found in the Higher Education Act of 1965.
Sec. 4. National Science Foundation research
    (1) Establishes an NSF program to award merit-based grants for 
basic research on innovative approaches to enhance computer security. 
Research areas for which grants can be used include authentication and 
cryptography, computer forensics and intrusion detection, reliability 
of computer and network applications, and privacy. Authorizes 
appropriations of $35 million for FY 2003, $40 million for FY 2004, $46 
million for 2005, $52 million for FY 2006, and $60,000 for FY 2007.
    (b) Establishes an NSF program to award multi-year grants to 
institutions of higher education (or consortia thereof) to establish 
multidisciplinary Centers for Computer and Network Security Research. 
Consortia applying for grants may partner with one or more government 
laboratories or for-profit institutions. Applications for Center grants 
are to be reviewed on the basis of criteria that include: the ability 
of the institution (or consortium) to generate innovative approaches to 
computer and network security research; the applicant's support for 
students pursuing research in computer and network security; and the 
extent to which government laboratories or industry partners will 
participate in the Center's research activities. Requires the Director 
to convene an annual meeting of Centers to foster greater collaboration 
and communication. Authorizes appropriations of $12 million for FY 
2003, $24 million for FY 2004, $36 million for FY 2005, and $36 million 
for FY 2006 and FY 2007.
Sec. 5. National Science Foundation computer and network security 
        programs
    (a) Establishes a competitive, merit-based NSF program to award 
grants to institutions of higher education (or consortia thereof) to 
create or improve undergraduate and master's degree programs in 
computer security. Grants can be used for uses that include curriculum 
development, equipment acquisition, faculty enhancement, and the 
establishment of a student internship program in government or 
industry. Requires applicants to describe the plan for building 
increased capacity in computer and network security, to articulate the 
roles and responsibilities of each partnering institution or 
collaborative group, and to provide evidence of high potential for 
success in educating and placing students in relevant jobs or graduate 
programs. Instructs the Director to evaluate the impact of the program 
on increasing the quality and quantity of computer and network security 
professionals. Authorizes $15 million for FY 2003 and $20 million for 
each of fiscal years 2004-2007.
    (b) Expands NSF's existing program for community colleges 
(established by the Scientific and Advanced Technology Act of 1992) to 
include grants to improve education in fields related to computer and 
network security. Authorizes $1 million for FY 2003 and $1.25 million 
for each of fiscal years 2004-2007.
    (c) Establishes a competitive, merit-based NSF program to award 
grants to institutions of higher education to establish programs for 
students pursuing studies in computer and network security research 
leading to a doctorate degree. Grant funds are to be used to support 
student fellowships of at least $25,000 per year, to pay student 
tuition and fees, and to support students in scientific internship 
programs. Authorizes appropriations of $10 million for FY 2003, and $20 
million for each fiscal year 2004-2007.
    (d) Directs NSF to include computer and network security as an 
approved field of specialization under its current Graduate Research 
Fellowships program.
Sec. 6. Consultation
    Requires the NSF Director to consult with other Federal agencies in 
carrying out the programs described in Sections 4 and 5.
Sec. 7. Fostering research and education in computer and network 
        security
    Amends the National Science Foundation Act of 1950 to require NSF 
to take a leading role in fostering and supporting research and 
education in computer and network security.
Sec. 8. National Institute of Standards and Technology Research Program
    Amends the National Institute of Standards and Technology Act to 
establish a program that provides assistance to institutions of higher 
education that partner with for-profit entities to support 
multidisciplinary, long-term, high-risk research to improve the 
security of computer systems. Partnerships may also include government 
laboratories. Authorizes the Director to award research fellowships to 
post-doctoral researchers engaged in computer security research and to 
senior researchers who wish to transition from other research fields to 
computer security research. Instructs the NIST Director to select 
Program Managers who are responsible for establishing the research 
goals for the program, soliciting applications for specific research 
projects to address these goals, and selecting research projects for 
funding. Calls for the NIST Director to periodically review the 
portfolio of research awards in consultation with NIST's existing 
Computer System Security and Privacy Advisory Board. Also instructs the 
Director to contract with the National Academy of Sciences to conduct a 
formal review of the program and to submit a report of this review to 
Congress.
Sec. 9. Computer security review, public meetings, and information
    Authorizes funding ($1,060,000 for FY 2003 and $1,090,000 for FY 
2004) to enable NIST's Computer System Security and Privacy Advisory 
Board to identify emerging issues, including research needs related to 
computer security, privacy, and cryptography and, as appropriate, to 
convene public meetings on those subjects, receive presentations, and 
generate reports for public distribution.
Sec. 10. Intramural security research
    Amends the National Institute of Standards and Technology Act 
authorize NIST to pursue, as part of the agency's in-house research 
program, research related to computer security including the 
development of emerging technologies to ensure security of networked 
systems assembled from components, improved security of real-time 
computing and communications systems used in industrial and critical 
infrastructure operations, and improved security of computer systems.
Sec. 11. Authorization of appropriations
    Authorizes appropriations for sections 8 and 10 of the bill. For 
the research programs in section 8, provides $25 million for FY 2003, 
$40 million for FY 2004, $55 million for FY 2005, $70 million for FY 
2006, $85 million for FY 2007, and such sums as may be necessary for 
fiscal years 2008 through 2012. Authorizes appropriations for section 
10 at $6 million for FY 2003, $6.2 million for FY 2004, $6.4 million 
for FY 2005, $6.6 million for FY 2006, and $6.8 million for FY 2007.
Sec. 12. National Academy of Sciences study on computer and network 
        security in critical infrastructures
    Authorizes the Director of NIST to enter into an agreement with the 
National Research Council (NRC) of the National Academy of Sciences to 
conduct a study of the vulnerabilities of the Nation's critical 
infrastructure networks and make recommendations for appropriate 
improvements. The study requires the NRC to review existing data to 
identify gaps in the security of critical infrastructure networks, make 
recommendations for research priorities to address these gaps, and 
review the security of network-related infrastructure including 
industrial process controls. A report of the study results is to be 
submitted to Congress. Authorizes $700,000 for the purpose of carrying 
out the study.
                                 ________

Summary of H.R. 3394--The Cyber Security Research and Development Act--
 Introduced by Mr. Boehlert, Mr. Hall (TX), Mr. Smith (TX), Mr. Baird, 
           Mr. Smith (MI) and Ms. Eddie Bernice Johnson (TX)

    The Committee on Science held two full committee hearings devoted 
to research and development needs related to cyber security. These 
hearings offered a sobering view of the security of our nation's 
critical infrastructures and highlighted the lack of world-class 
research being conducted to address these cyber security needs. Four 
challenges emerged from these hearings that demand an immediate and 
sustained response:
     Too little cyber security research is being conducted and 
the research that is funded is incremental and unlikely to lead to the 
development of breakthrough approaches to cyber security.
     There is inadequate coordination between government, 
academia, and industry and no Federal agency has stepped forward to 
take the lead in supporting cyber security research.
     Too few researchers are prepared to meet our current and 
projected cyber security research needs.
     Too few undergraduate and graduate students are pursuing 
studies in cyber security related fields.
    The Cyber Security Research and Development Act responds to these 
challenges. It creates important new research programs at the National 
Science Foundation (NSF) and the National Institute of Standards and 
Technology (NIST). Building upon NSF's proven capacity to mobilize the 
academic research community, the Act authorizes NSF to create new 
academic centers and fellowships to stimulate innovative thinking about 
cyber security. Building upon NIST's proven ability to work with 
industry, the Act authorizes NIST to initiate a new research grant 
program that strengthens the interaction between government, academia, 
and industry.
    Funding for NSF is provided for competitive, peer-reviewed grant 
programs, including:
     $233 million over five years for a program providing 
grants to researchers for the pursuit of particularly innovative 
computer and network security basic research.
     $144 million over five years to fund multi-year grants to 
colleges and universities to establish multidisciplinary Centers for 
Computer and Network Security Research, alone or in partnership with 
other universities or with businesses and government laboratories.
     $95 million over five years for the award of grants to 
colleges and universities to improve undergraduate and master's degree 
programs including through the creation of internship programs and new 
courses.
     $6 million over five years to make grants to community 
colleges in order to enhance their ability to contribute to the supply 
of computer and network security technicians.
     $90 million over five years to establish a competitive 
grant program that will enable colleges and universities to offer 
fellowships, research opportunities in industry, and other educational 
opportunities to students pursuing doctoral degrees in computer and 
network security.
    The Act authorizes NIST to use an administrative model that has 
been successfully implemented at the Defense Advanced Research Projects 
Agency. The Act authorizes NIST to invest talented project managers 
with broad latitude to establish cyber security research objectives and 
to solicit and award proposals. This structure shortens the approval 
time for research proposals and allows the project manager to move 
quickly to in vest in promising new ideas.
    The funding for NIST includes:
     $275 million over five years for a grant program to 
support high-risk, cutting-edge research by academic researchers who 
are working with industry.
     Establishes research fellowships to increase the number of 
researchers engaged in computer and network security research.
     $32 million over five years for an in-house research 
program in computer and network security.
    Finally, the bill requires a National Academy of Sciences study and 
report to Congress on the nation's critical infrastructure 
vulnerabilities.

               CYBER SECURITY RESEARCH AND DEVELOPMENT ACT YEARLY AUTHORIZATION OF APPROPRIATIONS
                                            [In millions of dollars]
----------------------------------------------------------------------------------------------------------------
                       Program                         FY2003    FY2004    FY2005    FY2006    FY2007     Total
----------------------------------------------------------------------------------------------------------------
Section 4 National Science Foundation Research:
    Computer and Network Security Research Grants...     35        40        46        52        60       233
    Computer and Network Security Research Centers..     12        24        36        36        36       144
Section 5 National Science Foundation Computer and
 Network Security Programs:
    Computer and Network Security Capacity Building      15        20        20        20        20        95
     Grants.........................................
    Scientific and Advanced Technology Act of 1992..      1         1.25      1.25      1.25      1.25      6
    Graduate Traineeships in Computer and Network        10        20        20        20        20        90
     Security Research..............................
Section 6. Fostering Research and Education in
 Computer and Network Security......................
Section 7. National Institute of Standards and           25        40        55        70        85       275
 Technology Research Program........................
Section 8. Computer Security Review, Public               1.03      1.06  ........  ........  ........      2.09
 Meetings, and Information..........................
Section 9. Intramural Security Research.............      6         6.2       6.4       6.6       6.8      32
Section 11. National Academy of Sciences Study on         0.7   ........  ........  ........  ........      0.7
 Computer and Network Security in Critical
 Infrastructures....................................
                                                               -------------------------------------------------
      Total.........................................    105.73    152.51    184.65    205.85    229.05    877.79
----------------------------------------------------------------------------------------------------------------

    Five Year Total: $877.79 million.

                                

```