108TH CONGRESS

1ST SESSION H. R. 3159

AN ACT

To require Federal agencies to develop and implement plans to protect the security and privacy of

government computer systems from the risksposed by peer-to-peer file sharing.

108TH CONGRESS

1ST SESSION H. R. 3159

AN ACT

To require Federal agencies to develop and implement plans

to protect the security and privacy of government computer systems from the risks posed by peer-to-peer file

sharing.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,
2

•HR 3159 EH

1 SECTION 1. SHORT TITLE.

2 This Act may be cited as the ‘‘Government Network

3 Security Act of 2003’’.

4 SEC. 2. FINDINGS.

5 Congress finds the following:

6 (1) Peer-to-peer file sharing can pose security

7 and privacy threats to computers and networks by—

8 (A) exposing classified and sensitive infor9 mation that are stored on computers or net10 works;

11 (B) acting as a point of entry for viruses

12 and other malicious programs;

13 (C) consuming network resources, which

14 may result in a degradation of network per15 formance; and

16 (D) exposing identifying information about

17 host computers that can be used by hackers to

18 select potential targets.

19 (2) The computers and networks of the Federal

20 Government use and store a wide variety of classi21 fied and sensitive information, including—

22 (A) information vital to national security,

23 defense, law enforcement, economic markets,

24 public health, and the environment; and
3

•HR 3159 EH

1 (B) personal and financial information of

2 citizens and businesses that has been entrusted

3 to the Federal Government.

4 (3) Use of peer-to-peer file sharing on govern5 ment computers and networks can threaten the secu6 rity and privacy of the information on those com7 puters and networks by exposing the information to

8 others using peer-to-peer file sharing.

9 (4) The House of Representatives and the Sen10 ate are using methods to protect the security and

11 privacy of congressional computers and networks

12 from the risks posed by peer-to-peer file sharing.

13 (5) Innovations in peer-to-peer technology for

14 government applications can be pursued on

15 intragovernmental networks that do not pose risks

16 to network security.

17 (6) In light of these considerations, Federal

18 agencies need to take prompt action to address the

19 security and privacy risks posed by peer-to-peer file

20 sharing.

21 SEC. 3. PROTECTION OF GOVERNMENT COMPUTERS FROM

22 RISKS OF PEER-TO-PEER FILE SHARING.

23 (a) PLANS REQUIRED.—As part of the Federal agen24 cy responsibilities set forth in sections 3544 and 3545 of

25 title 44, United States Code, the head of each agency shall
4

•HR 3159 EH

1 develop and implement a plan to protect the security and

2 privacy of computers and networks of the Federal Govern3 ment from the risks posed by peer-to-peer file sharing.

4 (b) CONTENTS OF PLANS.—Such plans shall set forth

5 appropriate methods, including both technological (such as

6 the use of software and hardware) and nontechnological

7 methods (such as employee policies and user training), to

8 achieve the goal of protecting the security and privacy of

9 computers and networks of the Federal Government from

10 the risks posed by peer-to-peer file sharing.

11 (c) IMPLEMENTATION OF PLANS.—The head of each

12 agency shall—

13 (1) develop and implement the plan required

14 under this section as expeditiously as possible, but in

15 no event later than six months after the date of the

16 enactment of this Act; and

17 (2) review and revise the plan periodically as

18 necessary.

19 (d) REVIEW OF PLANS.—Not later than 18 months

20 after the date of the enactment of this Act, the Comp21 troller General shall—

22 (1) review the adequacy of the agency plans re23 quired by this section; and

24 (2) submit to the Committee on Government

25 Reform of the House of Representatives and the
5

•HR 3159 EH

1 Committee on Governmental Affairs of the Senate a

2 report on the results of the review, together with any

3 recommendations the Comptroller General considers

4 appropriate.

5 SEC. 4. DEFINITIONS.

6 In this Act:

7 (1) PEER-TO-PEER FILE SHARING.—The term

8 ‘‘peer-to-peer file sharing’’ means the use of com9 puter software, other than computer and network

10 operating systems, that has as its primary function

11 the capability to allow the computer on which such

12 software is used to designate files available for

13 transmission to another computer using such soft14 ware, to transmit files directly to another such com15 puter, and to request the transmission of files from

16 another such computer. The term does not include

17 the use of such software for file sharing between,

18 among, or within Federal, State, or local government

19 agencies.
6

•HR 3159 EH

1 (2) AGENCY.—The term ‘‘agency’’ has the

2 meaning provided by section 3502 of title 44, United

3 States Code.

Passed the House of Representatives October 8,

2003.

Attest:

Clerk.