II

106TH CONGRESS

2D SESSION S. 2430

To combat computer hacking through enhanced law enforcement and to

protect the privacy and constitutional rights of Americans, and for other

purposes.

IN THE SENATE OF THE UNITED STATES

APRIL 13, 2000

Mr. LEAHY introduced the following bill; which was read twice and referred

to the Committee on the Judiciary

A BILL

To combat computer hacking through enhanced law enforcement and to protect the privacy and constitutional rights

of Americans, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Internet Security Act

5 of 2000’’.

6 SEC. 2. AMENDMENTS TO THE COMPUTER FRAUD AND

7 ABUSE ACT.

8 Section 1030 of title 18, United States Code, is

9 amended—
2

•S 2430 IS

1 (1) in subsection (a)—

2 (A) in paragraph (5)—

3 (i) by inserting ‘‘(i)’’ after ‘‘(A)’’ and

4 redesignating subparagraphs (B) and (C)

5 as clauses (ii) and (iii), respectively;

6 (ii) in subparagraph (A)(iii), as redes7 ignated, by adding ‘‘and’’ at the end; and

8 (iii) by adding at the end the fol9 lowing:

10 ‘‘(B) the conduct described in clause (i),

11 (ii), or (iii) of subparagraph (A)—

12 ‘‘(i) caused loss aggregating at least

13 $5,000 in value during a 1-year period to

14 1 or more individuals;

15 ‘‘(ii) modified or impaired, or poten16 tially modified or impaired, the medical ex17 amination, diagnosis, treatment, or care of

18 1 or more individuals;

19 ‘‘(iii) caused physical injury to any

20 person; or

21 ‘‘(iv) threatened public health or safe22 ty;’’; and

23 (B) in paragraph (6), by adding ‘‘or’’ at

24 the end;

25 (2) in subsection (c)—
3

•S 2430 IS

1 (A) in paragraph (2)—

2 (i) in subparagraph (A), by striking

3 ‘‘and’’ at the end; and

4 (ii) in subparagraph (B), by inserting

5 ‘‘or an attempted offense’’ after ‘‘in the

6 case of an offense’’; and

7 (B) by adding at the end the following:

8 ‘‘(4) forfeiture to the United States in accord9 ance with subsection (i) of the interest of the of10 fender in—

11 ‘‘(A) any personal property used or in12 tended to be used to commit or to facilitate the

13 commission of the offense; and

14 ‘‘(B) any property, real or personal, that

15 constitutes or that is derived from proceeds

16 traceable to any violation of this section.’’;

17 (3) in subsection (d)—

18 (A) by striking ‘‘subsections (a)(2)(A),

19 (a)(2)(B), (a)(3), (a)(4), (a)(5), and (a)(6) of’’;

20 and

21 (B) by striking ‘‘which shall be entered

22 into by’’ and inserting ‘‘between’’;

23 (4) in subsection (e)—
4

•S 2430 IS

1 (A) in paragraph (2)(B), by inserting ‘‘,

2 including computers located outside the United

3 States’’ before the semicolon;

4 (B) in paragraph (4), by striking the pe5 riod at the end and inserting a semicolon;

6 (C) in paragraph (7), by striking ‘‘and’’ at

7 the end;

8 (D) in paragraph (8), by striking ‘‘, that’’

9 and all that follows through ‘‘; and’’ and insert10 ing a semicolon;

11 (E) in paragraph (9), by striking the pe12 riod at the end and inserting ‘‘; and’’; and

13 (F) by adding at the end the following:

14 ‘‘(10) the term ‘loss’ includes—

15 ‘‘(A) the reasonable costs to any victim

16 of—

17 ‘‘(i) responding to the offense;

18 ‘‘(ii) conducting a damage assessment;

19 and

20 ‘‘(iii) restoring the system and data to

21 their condition prior to the offense; and

22 ‘‘(B) any lost revenue or costs incurred by

23 the victim as a result of interruption of serv24 ice.’’;
5

•S 2430 IS

1 (5) in subsection (g), by striking ‘‘Damages for

2 violations involving damage as defined in subsection

3 (c)(8)(A)’’ and inserting ‘‘losses specified in sub4 section (a)(5)(B)(i)’’; and

5 (6) by adding at the end the following:

6 ‘‘(i) PROVISIONS GOVERNING FORFEITURE.—Prop7 erty subject to forfeiture under this section, any seizure

8 and disposition thereof, and any administrative or judicial

9 proceeding in relation thereto, shall be governed by sub10 section (c) and subsections (e) through (p) of section 413

11 of the Comprehensive Drug Abuse Prevention and Control

12 Act of 1970 (21 U.S.C. 853).’’.

13 SEC. 3. SENSE OF CONGRESS.

14 It is the sense of Congress that—

15 (1) acts that damage or attempt to damage

16 computers used in the delivery of critical infrastruc17 ture services such as telecommunications, energy,

18 transportation, banking and financial services, and

19 emergency and government services pose a serious

20 threat to public health and safety and cause or have

21 the potential to cause losses to victims that include

22 costs of responding to offenses, conducting damage

23 assessments, and restoring systems and data to their

24 condition prior to the offense, as well as lost revenue
6

•S 2430 IS

1 and costs incurred as a result of interruptions of

2 service; and

3 (2) the Federal Government should have juris4 diction to investigate acts affecting protected com5 puters, as defined in section 1030(e)(2)(B) of title

6 18, United States Code, as amended by this Act,

7 even if the effects of such acts occur wholly outside

8 the United States, as in such instances a sufficient

9 Federal nexus is conferred through the inter10 connected and interdependent nature of computers

11 used in interstate or foreign commerce or commu12 nication.

13 SEC. 4. MODIFICATION OF SENTENCING COMMISSION DI14 RECTIVE.

15 Pursuant to its authority under section 994(p) of title

16 28, United States Code, the United States Sentencing

17 Commission shall amend the Federal sentencing guidelines

18 to ensure that any individual convicted of a violation of

19 paragraph (4) or (5) of section 1030(a) of title 18, United

20 States Code, can be subjected to appropriate penalties,

21 without regard to any mandatory minimum term of im22 prisonment.
7

•S 2430 IS

1 SEC. 5. FORFEITURE OF DEVICES USED IN COMPUTER

2 SOFTWARE COUNTERFEITING.

3 Section 2318(d) of title 18, United States Code, is

4 amended by—

5 (1) inserting ‘‘(1)’’ before ‘‘When’’;

6 (2) inserting ‘‘, and any replicator or other de7 vice or thing used to copy or produce the computer

8 program or other item to which the counterfeit label

9 was affixed, or was intended to be affixed’’ before

10 the period; and

11 (3) by adding at the end the following:

12 ‘‘(2) The forfeiture of property under this section, in13 cluding any seizure and disposition of the property, and

14 any related judicial or administrative proceeding, shall be

15 governed by the provisions of section 413 (other than sub16 section (d) of that section) of the Comprehensive Drug

17 Abuse Prevention and Control Act of 1970 (21 U.S.C.

18 853).’’.

19 SEC. 6. CONFORMING AMENDMENT.

20 Section 492 of title 18, United States Code, is

21 amended by striking ‘‘or 1720,’’ and inserting ‘‘, 1720,

22 or 2318’’.

23 SEC. 7. PEN REGISTERS AND TRAP AND TRACE DEVICES.

24 Section 3123 of title 18, United States Code is

25 amended—
8

•S 2430 IS

1 (1) by striking subsection (a) and inserting the

2 following:

3 ‘‘(a) ISSUANCE OF ORDER.—

4 ‘‘(1) REQUESTS FROM ATTORNEYS FOR THE

5 GOVERNMENT.—Upon an application made under

6 section 3122(a)(1), the court may enter an ex parte

7 order authorizing the installation and use of a pen

8 register or a trap and trace device if the court finds,

9 based on the certification by the attorney for the

10 Government, that the information likely to be ob11 tained by such installation and use is relevant to an

12 ongoing criminal investigation. Such order shall

13 apply to any entity providing wire or electronic com14 munication service in the United States whose as15 sistance is necessary to effectuate the order.

16 ‘‘(2) REQUESTS FROM STATE INVESTIGATIVE

17 OR LAW ENFORCEMENT OFFICERS.—Upon an appli18 cation made under section 3122(a)(2), the court

19 may enter an ex parte order authorizing the installa20 tion and use of a pen register or a trap and trace

21 device within the jurisdiction of the court, if the

22 court finds, based on the certification by the State

23 law enforcement or investigative officer, that the in24 formation likely to be obtained by such installation
9

•S 2430 IS

1 and use is relevant to an ongoing criminal investiga2 tion.’’; and

3 (2) in subsection (b)—

4 (A) in paragraph (1)—

5 (i) in subparagraph (C), by inserting

6 ‘‘authorized under subsection (a)(2)’’ after

7 ‘‘in the case of a trap and trace device’’;

8 and

9 (ii) in subparagraph (D), by striking

10 ‘‘and’’ at the end;

11 (B) in paragraph (2), by striking the pe12 riod at the end and inserting ‘‘; and’’; and

13 (C) by adding at the end the following:

14 ‘‘(3) shall direct that the use of the pen register

15 or trap and trace device be conducted in such a way

16 as to minimize the recording or decoding of any elec17 tronic or other impulses that are not related to the

18 dialing and signaling information utilized in proc19 essing by the service provider upon whom the order

20 is served.’’.

21 SEC. 8. TECHNICAL AMENDMENTS TO PEN REGISTER AND

22 TRAP AND TRACE PROVISIONS.

23 (a) ISSUANCE OF AN ORDER.—Section 3123 of title

24 18, United States Code, is amended—
10

•S 2430 IS

1 (1) by inserting ‘‘or other facility’’ after ‘‘line’’

2 each place that term appears;

3 (2) by inserting ‘‘or applied’’ after ‘‘attached’’

4 each place that term appears;

5 (3) in subsection (b)(1)(C), by inserting ‘‘or

6 other identifier’’ after ‘‘the number’’; and

7 (4) in subsection (d)(2), by striking ‘‘who has

8 been ordered by the court’’ and inserting ‘‘who is ob9 ligated by the order’’.

10 (b) DEFINITIONS.—Section 3127 of title 18, United

11 States Code is amended—

12 (1) by striking paragraph (3) and inserting the

13 following:

14 ‘‘(3) the term ‘pen register’—

15 ‘‘(A) means a device or process that

16 records or decodes electronic or other impulses

17 that identify the telephone numbers or elec18 tronic addresses dialed or otherwise transmitted

19 by an instrument or facility from which a wire

20 or electronic communication is transmitted and

21 used for purposes of identifying the destination

22 or termination of such communication by the

23 service provider upon which the order is served;

24 and
11

•S 2430 IS

1 ‘‘(B) does not include any device or process

2 used by a provider or customer of a wire or

3 electronic communication service for billing, or

4 recording as an incident to billing, for commu5 nications services provided by such provider or

6 any device or process by a provider or customer

7 of a wire communication service for cost ac8 counting or other like purposes in the ordinary

9 course of its business;’’; and

10 (2) in paragraph (4)—

11 (A) by inserting ‘‘or process’’ after ‘‘means

12 a device’’;

13 (B) by inserting ‘‘or other identifier’’ after

14 ‘‘number’’; and

15 (C) by striking ‘‘or device’’ and inserting

16 ‘‘or other facility’’.

17 SEC. 9. PEN REGISTER AND TRAP AND TRACE REPORTS.

18 Section 3126 of title 18, United States Code, is

19 amended by inserting before the period at the end the fol20 lowing: ‘‘, which report shall include information

21 concerning—

22 ‘‘(1) the period of interceptions authorized by

23 the order, and the number and duration of any ex24 tensions of the order;
12

•S 2430 IS

1 ‘‘(2) the offense specified in the order or appli2 cation, or extension of an order;

3 ‘‘(3) the number of investigations involved;

4 ‘‘(4) the number and nature of the facilities af5 fected; and

6 ‘‘(5) the identity, including district, of the ap7 plying investigative or law enforcement agency mak8 ing the application and the person authorizing the

9 order’’.

10 SEC. 10. ENHANCED DENIAL OF SERVICE INVESTIGATIONS.

11 Section 2511(2)(c) of title 18, United States Code,

12 is amended to read as follows:

13 ‘‘(c)(i) It shall not be unlawful under this chapter for

14 a person acting under color of law to intercept a wire, oral,

15 or electronic communication, if such person is a party to

16 the communication or 1 of the parties to the communica17 tion has given prior consent to such interception.

18 ‘‘(ii) It shall not be unlawful under this chapter for

19 a person acting under color of law to intercept a wire or

20 electronic communication, if—

21 ‘‘(I) the transmission of the wire or electronic

22 communication is causing harmful interference to a

23 lawfully operating computer system;

24 ‘‘(II) any person who is not a provider of serv25 ice to the public and who is authorized to use the
13

•S 2430 IS

1 facility from which the wire or electronic commu2 nication is to be intercepted has given prior consent

3 to the interception; and

4 ‘‘(III) the interception is conducted only to the

5 extent necessary to identify the source of the harm6 ful interference described in subclause (I).’’.

7 SEC. 11. ENCRYPTION REPORTING REQUIREMENTS.

8 Section 2519(2)(b) of title 18, United States Code,

9 is amended by striking ‘‘and (iv)’’ and inserting ‘‘(iv) the

10 number of orders in which encryption was encountered

11 and whether such encryption prevented law enforcement

12 from obtaining the plain text of communications inter13 cepted pursuant to such order, and (v)’’.

14 SEC. 12. STATE AND LOCAL COMPUTER CRIME ENFORCE15 MENT.

16 (a) IN GENERAL.—Subject to the availability of

17 amounts provided in advance in appropriations Acts, the

18 Assistant Attorney General for the Office of Justice Pro19 grams of the Department of Justice shall make a grant

20 to each State, which shall be used by the State, in conjunc21 tion with units of local government, State and local courts,

22 other States, or combinations thereof, to—

23 (1) assist State and local law enforcement in

24 enforcing State and local criminal laws relating to

25 computer crime;
14

•S 2430 IS

1 (2) assist State and local law enforcement in

2 educating the public to prevent and identify com3 puter crime;

4 (3) assist in educating and training State and

5 local law enforcement officers and prosecutors to

6 conduct investigations and forensic analyses of evi7 dence and prosecutions of computer crime;

8 (4) assist State and local law enforcement offi9 cers and prosecutors in acquiring computer and

10 other equipment to conduct investigations and foren11 sic analysis of evidence of computer crimes; and

12 (5) facilitate and promote the sharing of Fed13 eral law enforcement expertise and information

14 about the investigation, analysis, and prosecution of

15 computer crimes with State and local law enforce16 ment officers and prosecutors, including the use of

17 multijurisdictional task forces.

18 (b) USE OF GRANT AMOUNTS.—Grants under this

19 section may be used to establish and develop programs

20 to—

21 (1) assist State and local law enforcement agen22 cies in enforcing State and local criminal laws relat23 ing to computer crime;
15

•S 2430 IS

1 (2) assist State and local law enforcement agen2 cies in educating the public to prevent and identify

3 computer crime;

4 (3) educate and train State and local law en5 forcement officers and prosecutors to conduct inves6 tigations and forensic analyses of evidence and pros7 ecutions of computer crime;

8 (4) assist State and local law enforcement offi9 cers and prosecutors in acquiring computer and

10 other equipment to conduct investigations and foren11 sic analysis of evidence of computer crimes; and

12 (5) facilitate and promote the sharing of Fed13 eral law enforcement expertise and information

14 about the investigation, analysis, and prosecution of

15 computer crimes with State and local law enforce16 ment officers and prosecutors, including the use of

17 multijurisdictional task forces.

18 (c) ASSURANCES.—To be eligible to receive a grant

19 under this section, a State shall provide assurances to the

20 Attorney General that the State—

21 (1) has in effect laws that penalize computer

22 crime, such as penal laws prohibiting—

23 (A) fraudulent schemes executed by means

24 of a computer system or network;
16

•S 2430 IS

1 (B) the unlawful damaging, destroying, al2 tering, deleting, removing of computer software,

3 or data contained in a computer, computer sys4 tem, computer program, or computer network;

5 or

6 (C) the unlawful interference with the op7 eration of or denial of access to a computer,

8 computer program, computer system, or com9 puter network;

10 (2) an assessment of the State and local re11 source needs, including criminal justice resources

12 being devoted to the investigation and enforcement

13 of computer crime laws; and

14 (3) a plan for coordinating the programs fund15 ed under this section with other federally funded

16 technical assistant and training programs, including

17 directly funded local programs such as the Local

18 Law Enforcement Block Grant program (described

19 under the heading ‘‘Violent Crime Reduction Pro20 grams, State and Local Law Enforcement Assist21 ance’’ of the Departments of Commerce, Justice,

22 and State, the Judiciary, and Related Agencies Ap23 propriations Act, 1998 (Public Law 105–119)).

24 (d) MATCHING FUNDS.—The Federal share of a

25 grant received under this section may not exceed 90 per-
17

•S 2430 IS

1 cent of the total cost of a program or proposal funded

2 under this section unless the Attorney General waives,

3 wholly or in part, the requirements of this subsection.

4 (e) AUTHORIZATION OF APPROPRIATIONS.—

5 (1) IN GENERAL.—There is authorized to be

6 appropriated to carry out this section $25,000,000

7 for each of fiscal years 2000 through 2003.

8 (2) LIMITATIONS.—Of the amount made avail9 able to carry out this section in any fiscal year not

10 more than 3 percent may be used by the Attorney

11 General for salaries and administrative expenses.

12 (3) MINIMUM AMOUNT.—Unless all eligible ap13 plications submitted by any State or units of local

14 government within a State for a grant under this

15 section have been funded, the State, together with

16 grantees within the State (other than Indian tribes),

17 shall be allocated in each fiscal year under this sec18 tion not less than 0.75 percent of the total amount

19 appropriated in the fiscal year for grants pursuant

20 to this section, except that the United States Virgin

21 Islands, American Samoa, Guam, and the Northern

22 Mariana Islands each shall be allocated 0.25 per23 cent.

24 (f) GRANTS TO INDIAN TRIBES.—Notwithstanding

25 any other provision of this section, the Attorney General
18

•S 2430 IS

1 may use amounts made available under this section to

2 make grants to Indian tribes for use in accordance with

3 this section.

Æ