II 

111TH CONGRESS 

2D SESSION S. 3484 

To require the Director of the Office of Management and Budget to issue 

guidance on the use of peer-to-peer file sharing software to prohibit 

the personal use of such software by Government employees, and for 

other purposes. 

IN THE SENATE OF THE UNITED STATES 

JUNE 14, 2010 

Mrs. MCCASKILL (for herself and Mr. BENNETT) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To require the Director of the Office of Management and 

Budget to issue guidance on the use of peer-to-peer 

file sharing software to prohibit the personal use of such 

software by Government employees, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Secure Federal File 

5 Sharing Act’’. 

mstockstill on DSKH9S0YB1PROD with BILLS

2 

•S 3484 IS

1 SEC. 2. REQUIREMENTS. 

2 (a) UPDATED GUIDANCE ON USE OF CERTAIN SOFT3 WARE PROGRAMS.—Not later than 90 days after the date 

4 of the enactment of this Act, the Director of the Office 

5 of Management and Budget, after consultation with the 

6 Federal Chief Information Officers Council, shall issue 

7 guidance on the use of peer-to-peer file sharing software— 

8 (1) to prohibit the download, installation, or use 

9 by Government employees and contractors of open10 network peer-to-peer file sharing software on all 

11 Federal computers, computer systems, and networks, 

12 including those operated by contractors of the Gov13 ernment, unless such software is approved in accord14 ance with procedures under subsection (b); and 

15 (2) to address the download, installation, or use 

16 by Government employees and contractors of such 

17 software on home or personal computers as it relates 

18 to telework and remotely accessing Federal com19 puters, computer systems, and networks, including 

20 those operated by contractors of the Government. 

21 (b) APPROVAL PROCESS FOR CERTAIN SOFTWARE

22 PROGRAMS.—Not later than 90 days after the date of the 

23 enactment of this Act, the Director of the Office of Man24 agement and Budget shall develop a procedure by which 

25 the Director, in consultation with the Chief Information 

26 Officer, may receive requests from heads of agencies or 

mstockstill on DSKH9S0YB1PROD with BILLS

3 

•S 3484 IS

1 chief information officers of agencies for approval for use 

2 by Government employees and contractors of specific 

3 open-network peer-to-peer file sharing software programs 

4 that are— 

5 (1) necessary for the day-to-day business oper6 ations of the agency; 

7 (2) instrumental in completing a particular task 

8 or project that directly supports the agency’s overall 

9 mission; 

10 (3) necessary for use between, among, or within 

11 Federal, State, or local government agencies in order 

12 to perform official agency business; or 

13 (4) necessary for use during the course of a law 

14 enforcement investigation. 

15 (c) AGENCY RESPONSIBILITIES.—Not later than 180 

16 days after the date of enactment of this Act, the Director 

17 of the Office of Management and Budget shall— 

18 (1) direct agencies to establish or update per19 sonal use policies of the agency to be consistent with 

20 the guidance issued pursuant to subsection (a); 

21 (2) direct agencies to require any contract 

22 awarded by the agency to include a requirement that 

23 the contractor comply with the guidance issued pur24 suant to subsection (a) in the performance of the 

25 contract; 

mstockstill on DSKH9S0YB1PROD with BILLS

4 

•S 3484 IS

1 (3) direct agencies to update their information 

2 technology security or ethics training policies to en3 sure that all employees, including those working for 

4 contractors of the Government, are aware of the re5 quirements of the guidance required by subsection 

6 (a) and the consequences of engaging in prohibited 

7 conduct; and 

8 (4) direct agencies to ensure that proper secu9 rity controls are in place to prevent, detect, and re10 move file sharing software that is prohibited by the 

11 guidance issued pursuant to subsection (a) from all 

12 Federal computers, computer systems, and networks, 

13 including those operated by contractors of the Gov14 ernment. 

15 SEC. 3. ANNUAL REPORT. 

16 (a) IN GENERAL.—Not later than 1 year after the 

17 date of enactment of this Act, and annually thereafter, 

18 the Director of the Office of Management and Budget 

19 shall submit to the Committee on Oversight and Govern20 ment Reform of the House of Representatives and the 

21 Committee on Homeland Security and Governmental Af22 fairs of the Senate a report on the implementation of this 

23 Act, including— 

mstockstill on DSKH9S0YB1PROD with BILLS

5 

•S 3484 IS

1 (1) a justification for each open-network peer2 to-peer file sharing software program that is ap3 proved under subsection (b); and 

4 (2) an inventory of the agencies where such 

5 programs are being used. 

6 (b) RULE OF CONSTRUCTION.—Nothing in this sec7 tion shall be construed to require the disclosure of any 

8 information relating to any confidential Government oper9 ation or investigation, including any law enforcement, na10 tional security, or terrorism investigation. 

11 SEC. 4. DEFINITIONS. 

12 In this Act: 

13 (1) AGENCY.—The term ‘‘agency’’— 

14 (A) means any executive department, mili15 tary department, Government corporation, Gov16 ernment-controlled corporation, or other estab17 lishment in the executive branch of the Govern18 ment (including the Executive Office of the 

19 President), or any independent regulatory agen20 cy, the governments of the District of Columbia 

21 and of the territories and possessions of the 

22 United States, and their various subdivisions; 

23 and 

24 (B) includes Government-owned con25 tractor-operated facilities, including laboratories 

mstockstill on DSKH9S0YB1PROD with BILLS

6 

•S 3484 IS

1 engaged in national defense research and pro2 duction activities. 

3 (2) OPEN-NETWORK.—The term ‘‘open-net4 work’’, with respect to software, means a network in 

5 which— 

6 (A) access is granted freely, without limita7 tion or restriction; or 

8 (B) there are little or no security measures 

9 in place. 

10 (3) PEER-TO-PEER FILE SHARING SOFT11 WARE.—The term ‘‘peer-to-peer file sharing soft12 ware’’— 

13 (A) means a program, application, or soft14 ware that is commercially marketed or distrib15 uted to the public and that enables— 

16 (i) a file or files on the computer on 

17 which such program is installed to be des18 ignated as available for searching and 

19 copying to one or more other computers; 

20 (ii) the searching of files on the com21 puter on which such program is installed 

22 and the copying of any such file to another 

23 computer— 

24 (I) at the initiative of such other 

25 computer and without requiring any 

mstockstill on DSKH9S0YB1PROD with BILLS

7 

•S 3484 IS

1 action by an owner or authorized user 

2 of the computer on which such pro3 gram is installed; and 

4 (II) without requiring an owner 

5 or authorized user of the computer on 

6 which such program is installed to 

7 have selected or designated another 

8 computer as the recipient of any such 

9 file; and 

10 (iii) an owner or authorized user of 

11 the computer on which such program is in12 stalled to search files on one or more other 

13 computers using the same or a compatible 

14 program, application, or software, and 

15 copy such files to such owner or user’s 

16 computer; and 

17 (B) does not include a program, applica18 tion, or software designed primarily— 

19 (i) to operate as a server that is ac20 cessible over the Internet using the Inter21 net Domain Name system; 

22 (ii) to transmit or receive email mes23 sages, instant messaging, real-time audio 

24 or video communications, or real-time voice 

25 communications; or 

mstockstill on DSKH9S0YB1PROD with BILLS

8 

•S 3484 IS

1 (iii) to provide network or computer 

2 security (including the detection or preven3 tion of fraudulent activities), network man4 agement, maintenance, diagnostics, or 

5 technical support or repair. 

6 (4) CONTRACTOR.—The term ‘‘contractor’’ 

7 means a prime contractor or a subcontractor, as de8 fined by the Federal Acquisition Regulation. 

Æ 

mstockstill on DSKH9S0YB1PROD with BILLS