IIB

107TH CONGRESS

1ST SESSION H. R. 1259

IN THE SENATE OF THE UNITED STATES

NOVEMBER 28, 2001

Received; read twice and referred to the Committee on Commerce, Science,

and Transportation

AN ACT

To amend the National Institute of Standards and Technology Act to enhance the ability of the National Institute of Standards and Technology to improve computer

security, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,
2

HR 1259 RFS

1 SECTION 1. SHORT TITLE.

2 This Act may be cited as the ‘‘Computer Security En3 hancement Act of 2001’’.

4 SEC. 2. FINDINGS AND PURPOSES.

5 (a) FINDINGS.—The Congress finds the following:

6 (1) The National Institute of Standards and

7 Technology has responsibility for developing stand8 ards and guidelines needed to ensure the cost-effec9 tive security and privacy of sensitive information in

10 Federal computer systems.

11 (2) The Federal Government has an important

12 role in ensuring the protection of sensitive, but un13 classified, information controlled by Federal agen14 cies.

15 (3) Technology that is based on the application

16 of cryptography exists and can be readily provided

17 by private sector companies to ensure the confiden18 tiality, authenticity, and integrity of information as19 sociated with public and private activities.

20 (4) The development and use of encryption

21 technologies by industry should be driven by market

22 forces rather than by Government imposed require23 ments.

24 (b) PURPOSES.—The purposes of this Act are to—

25 (1) reinforce the role of the National Institute

26 of Standards and Technology in ensuring the secu-
3

HR 1259 RFS

1 rity of unclassified information in Federal computer

2 systems; and

3 (2) promote technology solutions based on pri4 vate sector offerings to protect the security of Fed5 eral computer systems.

6 SEC. 3. SECURITY OF FEDERAL COMPUTERS AND NET7 WORKS.

8 Section 20(b) of the National Institute of Standards

9 and Technology Act (15 U.S.C. 278g–3(b)) is amended—

10 (1) by redesignating paragraphs (4) and (5) as

11 paragraphs (7) and (8), respectively; and

12 (2) by inserting after paragraph (3) the fol13 lowing new paragraphs:

14 ‘‘(4) except for national security systems, as de15 fined in section 5142 of Public Law 104-106 (40

16 U.S.C. 1452), to provide guidance and assistance to

17 Federal agencies for protecting the security and pri18 vacy of sensitive information in interconnected Fed19 eral computer systems, including identification of

20 significant risks thereto;

21 ‘‘(5) to promote compliance by Federal agencies

22 with existing Federal computer information security

23 and privacy guidelines;
4

HR 1259 RFS

1 ‘‘(6) in consultation with appropriate Federal

2 agencies, assist Federal response efforts related to

3 unauthorized access to Federal computer systems;’’.

4 SEC. 4. COMPUTER SECURITY IMPLEMENTATION.

5 Section 20 of the National Institute of Standards and

6 Technology Act (15 U.S.C. 278g–3) is further amended—

7 (1) by redesignating subsections (c) and (d) as

8 subsections (e) and (f), respectively; and

9 (2) by inserting after subsection (b) the fol10 lowing new subsection:

11 ‘‘(c)(1) In carrying out subsection (a)(2) and (3), the

12 Institute shall—

13 ‘‘(A) emphasize the development of technology14 neutral policy guidelines for computer security and

15 electronic authentication practices by the Federal

16 agencies;

17 ‘‘(B) promote the use of commercially available

18 products, which appear on the list required by para19 graph (2), to provide for the security and privacy of

20 sensitive information in Federal computer systems;

21 ‘‘(C) develop qualitative and quantitative meas22 ures appropriate for assessing the quality and effec23 tiveness of information security and privacy pro24 grams at Federal agencies;
5

HR 1259 RFS

1 ‘‘(D) upon the request of a Federal agency, per2 form evaluations to assess its existing information

3 security and privacy programs;

4 ‘‘(E) promote development of accreditation pro5 cedures for Federal agencies based on the measures

6 developed under subparagraph (C);

7 ‘‘(F) if requested, consult with and provide as8 sistance to Federal agencies regarding the selection

9 by agencies of security technologies and products

10 and the implementation of security practices; and

11 ‘‘(G)(i) develop uniform testing procedures suit12 able for determining the conformance of commer13 cially available security products to the guidelines

14 and standards developed under subsection (a)(2) and

15 (3);

16 ‘‘(ii) establish procedures for certification of

17 private sector laboratories to perform the tests and

18 evaluations of commercially available security prod19 ucts developed in accordance with clause (i); and

20 ‘‘(iii) promote the testing of commercially avail21 able security products for their conformance with

22 guidelines and standards developed under subsection

23 (a)(2) and (3).

24 ‘‘(2) The Institute shall maintain and make available

25 to Federal agencies and to the public a list of commercially
6

HR 1259 RFS

1 available security products that have been tested by pri2 vate sector laboratories certified in accordance with proce3 dures established under paragraph (1)(G)(ii), and that

4 have been found to be in conformance with the guidelines

5 and standards developed under subsection (a)(2) and (3).

6 ‘‘(3) The Institute shall annually transmit to the

7 Congress, in an unclassified format, a report containing—

8 ‘‘(A) the findings of the evaluations and tests of

9 Federal computer systems conducted under this sec10 tion during the 12 months preceding the date of the

11 report, including the frequency of the use of com12 mercially available security products included on the

13 list required by paragraph (2);

14 ‘‘(B) the planned evaluations and tests under

15 this section for the 12 months following the date of

16 the report; and

17 ‘‘(C) any recommendations by the Institute to

18 Federal agencies resulting from the findings de19 scribed in subparagraph (A), and the response by

20 the agencies to those recommendations.’’.

21 SEC. 5. COMPUTER SECURITY REVIEW, PUBLIC MEETINGS,

22 AND INFORMATION.

23 Section 20 of the National Institute of Standards and

24 Technology Act (15 U.S.C. 278g–3), as amended by this

25 Act, is further amended by inserting after subsection (c),
7

HR 1259 RFS

1 as added by section 4 of this Act, the following new sub2 section:

3 ‘‘(d)(1) The Institute shall solicit the recommenda4 tions of the Computer System Security and Privacy Advi5 sory Board, established by section 21, regarding standards

6 and guidelines that are being considered for submittal to

7 the Secretary in accordance with subsection (a)(4). The

8 recommendations of the Board shall accompany standards

9 and guidelines submitted to the Secretary.

10 ‘‘(2) There are authorized to be appropriated to the

11 Secretary $1,030,000 for fiscal year 2002 and $1,060,000

12 for fiscal year 2003 to enable the Computer System Secu13 rity and Privacy Advisory Board, established by section

14 21, to identify emerging issues related to computer secu15 rity, privacy, and cryptography and to convene public

16 meetings on those subjects, receive presentations, and

17 publish reports, digests, and summaries for public dis18 tribution on those subjects.’’.

19 SEC. 6. LIMITATION ON PARTICIPATION IN REQUIRING

20 ENCRYPTION AND ELECTRONIC AUTHEN21 TICATION STANDARDS.

22 Section 20 of the National Institute of Standards and

23 Technology Act (15 U.S.C. 278g–3), as amended by this

24 Act, is further amended by adding at the end the following

25 new subsection:
8

HR 1259 RFS

1 ‘‘(g) The Institute shall not promulgate, enforce, or

2 otherwise adopt standards or policies for the Federal es3 tablishment of encryption and electronic authentication

4 standards required for use in computer systems other than

5 Federal Government computer systems.’’.

6 SEC. 7. MISCELLANEOUS AMENDMENTS.

7 Section 20 of the National Institute of Standards and

8 Technology Act (15 U.S.C. 278g–3), as amended by this

9 Act, is further amended—

10 (1) in subsection (b)(8), as so redesignated by

11 section 3(1) of this Act, by inserting ‘‘to the extent

12 that such coordination will improve computer secu13 rity and to the extent necessary for improving such

14 security for Federal computer systems’’ after ‘‘Man15 agement and Budget)’’;

16 (2) in subsection (e), as so redesignated by sec17 tion 4(1) of this Act, by striking ‘‘shall draw upon’’

18 and inserting in lieu thereof ‘‘may draw upon’’;

19 (3) in subsection (e)(2), as so redesignated by

20 section 4(1) of this Act, by striking ‘‘(b)(5)’’ and in21 serting in lieu thereof ‘‘(b)(7)’’; and

22 (4) in subsection (f)(1)(B)(i), as so redesig23 nated by section 4(1) of this Act, by inserting ‘‘and

24 computer networks’’ after ‘‘computers’’.
9

HR 1259 RFS

1 SEC. 8. FEDERAL COMPUTER SYSTEM SECURITY TRAINING.

2 Section 5(b) of the Computer Security Act of 1987

3 (40 U.S.C. 759 note) is amended—

4 (1) by striking ‘‘and’’ at the end of paragraph

5 (1);

6 (2) by striking the period at the end of para7 graph (2) and inserting in lieu thereof ‘‘; and’’; and

8 (3) by adding at the end the following new

9 paragraph:

10 ‘‘(3) to include emphasis on protecting informa11 tion in Federal databases and Federal computer

12 sites that are accessible through public networks.’’.

13 SEC. 9. COMPUTER SECURITY FELLOWSHIP PROGRAM.

14 There are authorized to be appropriated to the Sec15 retary of Commerce $5,000,000 for fiscal year 2002 and

16 $5,000,000 for fiscal year 2003 for the Director of the

17 National Institute of Standards and Technology for fellow18 ships, subject to the provisions of section 18 of the Na19 tional Institute of Standards and Technology Act (15

20 U.S.C. 278g–1), to support students at institutions of

21 higher learning in computer security. Amounts authorized

22 by this section shall not be subject to the percentage limi23 tation stated in such section 18.
10

HR 1259 RFS

1 SEC. 10. STUDY OF ELECTRONIC AUTHENTICATION TECH2 NOLOGIES BY THE NATIONAL RESEARCH

3 COUNCIL.

4 (a) REVIEW BY NATIONAL RESEARCH COUNCIL.—

5 Not later than 90 days after the date of the enactment

6 of this Act, the Secretary of Commerce shall enter into

7 a contract with the National Research Council of the Na8 tional Academy of Sciences to conduct a study of elec9 tronic authentication technologies for use by individuals,

10 businesses, and government.

11 (b) CONTENTS.—The study referred to in subsection

12 (a) shall—

13 (1) assess technology needed to support elec14 tronic authentication technologies;

15 (2) assess current public and private plans for

16 the deployment of electronic authentication tech17 nologies;

18 (3) assess interoperability, scalability, and in19 tegrity of private and public entities that are ele20 ments of electronic authentication technologies; and

21 (4) address such other matters as the National

22 Research Council considers relevant to the issues of

23 electronic authentication technologies.

24 (c) INTERAGENCY COOPERATION WITH STUDY.—All

25 agencies of the Federal Government shall cooperate fully

26 with the National Research Council in its activities in car-
11

HR 1259 RFS

1 rying out the study under this section, including access

2 by properly cleared individuals to classified information if

3 necessary.

4 (d) REPORT.—Not later than 18 months after the

5 date of the enactment of this Act, the Secretary of Com6 merce shall transmit to the Committee on Science of the

7 House of Representatives and the Committee on Com8 merce, Science, and Transportation of the Senate a report

9 setting forth the findings, conclusions, and recommenda10 tions of the National Research Council for public policy

11 related to electronic authentication technologies for use by

12 individuals, businesses, and government. The National Re13 search Council shall not recommend the implementation

14 or application of a specific electronic authentication tech15 nology or electronic authentication technical specification

16 for use by the Federal Government. Such report shall be

17 submitted in unclassified form.

18 (e) AUTHORIZATION OF APPROPRIATIONS.—There

19 are authorized to be appropriated to the Secretary of Com20 merce $450,000 for fiscal year 2002, to remain available

21 until expended, for carrying out this section.

22 SEC. 11. PROMOTION OF NATIONAL INFORMATION SECU23 RITY.

24 The Under Secretary of Commerce for Technology

25 shall—
12

HR 1259 RFS

1 (1) promote an increased use of security tech2 niques, such as risk assessment, and security tools,

3 such as cryptography, to enhance the protection of

4 the Nation’s information infrastructure;

5 (2) establish a central repository of information

6 for dissemination to the public to promote awareness

7 of information security vulnerabilities and risks; and

8 (3) in a manner consistent with section 12(d) of

9 the National Technology Transfer and Advancement

10 Act of 1995 (15 U.S.C. 272 nt), promote the devel11 opment of national standards-based infrastructures

12 needed to support government, commercial, and pri13 vate uses of encryption technologies for confiden14 tiality and authentication.

15 SEC. 12. ELECTRONIC AUTHENTICATION INFRASTRUC16 TURES.

17 (a) ELECTRONIC AUTHENTICATION INFRASTRUC18 TURES.—

19 (1) TECHNOLOGY-NEUTRAL GUIDELINES AND

20 STANDARDS.—Not later than 18 months after the

21 date of the enactment of this Act, the Director, in

22 consultation with industry and appropriate Federal

23 agencies, shall develop technology-neutral guidelines

24 and standards, or adopt existing technology-neutral

25 industry guidelines and standards, for electronic au-
13

HR 1259 RFS

1 thentication infrastructures to be made available to

2 Federal agencies so that such agencies may effec3 tively select and utilize electronic authentication

4 technologies in a manner that is—

5 (A) adequately secure to meet the needs of

6 those agencies and their transaction partners;

7 and

8 (B) interoperable, to the maximum extent

9 possible.

10 (2) ELEMENTS.—The guidelines and standards

11 developed under paragraph (1) shall include—

12 (A) protection profiles for cryptographic

13 and noncryptographic methods of authen14 ticating identity for electronic authentication

15 products and services;

16 (B) a core set of interoperability specifica17 tions for the use of electronic authentication

18 products and services in electronic transactions

19 between Federal agencies and their transaction

20 partners; and

21 (C) validation criteria to enable Federal

22 agencies to select cryptographic electronic au23 thentication products and services appropriate

24 to their needs.
14

HR 1259 RFS

1 (3) REVISIONS.—The Director shall periodically

2 review the guidelines and standards developed under

3 paragraph (1) and revise them as appropriate.

4 (b) LISTING OF PRODUCTS.—Not later than 30

5 months after the date of the enactment of this Act, and

6 thereafter, the Director shall maintain and make available

7 to Federal agencies a nonmandatory list of commercially

8 available electronic authentication products, and other

9 such products used by Federal agencies, evaluated as con10 forming with the guidelines and standards developed

11 under subsection (a).

12 (c) SPECIFICATIONS FOR ELECTRONIC CERTIFI13 CATION AND MANAGEMENT TECHNOLOGIES.—

14 (1) SPECIFICATIONS.—The Director shall, as

15 appropriate, establish core specifications for par16 ticular electronic certification and management tech17 nologies, or their components, for use by Federal

18 agencies.

19 (2) EVALUATION.—The Director shall advise

20 Federal agencies on how to evaluate the conform21 ance with the specifications established under para22 graph (1) of electronic certification and management

23 technologies, developed for use by Federal agencies

24 or available for such use.
15

HR 1259 RFS

1 (3) MAINTENANCE OF LIST.—The Director

2 shall maintain and make available to Federal agen3 cies a list of electronic certification and management

4 technologies evaluated as conforming to the speci5 fications established under paragraph (1).

6 (d) REPORTS.—Not later than 18 months after the

7 date of the enactment of this Act, and annually thereafter,

8 the Director shall transmit to the Congress a report that

9 includes—

10 (1) a description and analysis of the utilization

11 by Federal agencies of electronic authentication

12 technologies; and

13 (2) a description and analysis regarding the

14 problems Federal agencies are having, and the

15 progress such agencies are making, in implementing

16 electronic authentication infrastructures.

17 (e) DEFINITIONS.—For purposes of this section—

18 (1) the term ‘‘electronic authentication’’ means

19 cryptographic or noncryptographic methods of au20 thenticating identity in an electronic communication;

21 (2) the term ‘‘electronic authentication infra22 structure’’ means the software, hardware, and per23 sonnel resources, and the procedures, required to ef24 fectively utilize electronic authentication tech25 nologies;
16

HR 1259 RFS

1 (3) the term ‘‘electronic certification and man2 agement technologies’’ means computer systems, in3 cluding associated personnel and procedures, that

4 enable individuals to apply electronic authentication

5 to electronic information; and

6 (4) the term ‘‘protection profile’’ means a list of

7 security functions and associated assurance levels

8 used to describe a product.

9 SEC. 13. SOURCE OF AUTHORIZATIONS.

10 There are authorized to be appropriated to the Sec11 retary of Commerce $7,000,000 for fiscal year 2002 and

12 $8,000,000 for fiscal year 2003, for the National Institute

13 of Standards and Technology to carry out activities au14 thorized by this Act for which funds are not otherwise spe15 cifically authorized to be appropriated by this Act.

Passed the House of Representatives November 27,

2001.

Attest: JEFF TRANDAHL,

Clerk.