I 
110TH CONGRESS 
1ST SESSION 
H. R. 836 
To amend title 18, United States Code, to better assure cyber-security, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 6, 2007 
Mr. SMITH of Texas (for himself, Mr. FORBES, Mr. GALLEGLY, Mr. CHABOT, 
Mr. COBLE, Mr. FRANKS of Arizona, Mr. GOODLATTE, and Mr. PENCE) 
introduced the following bill; which was referred to the Committee on the 
Judiciary 
A BILL 
To amend title 18, United States Code, to better assure 
cyber-security, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cyber-Security En-
hancement and Consumer Data Protection Act of 2007’’. 
SEC. 2. PERSONAL ELECTRONIC RECORDS. 
Section 1030(a)(2) of title 18, United States Code, 
is amended— 
VerDate Aug 31 2005 
01:14 Feb 09, 2007
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H836.IH
H836
hmoore on PROD1PC68 with HMBILLS
(1) by striking ‘‘or’’ at the end of subparagraph 
(B); and 
(2) by adding at the end the following: 
‘‘(D) a means of identification (as defined 
in section 1028(d)) from a protected computer; 
or 
‘‘(E) the capability to gain access to or re-
motely control a protected computer.’’. 
SEC. 3. USE OF FULL INTERSTATE AND FOREIGN COM-
MERCE POWER FOR CRIMINAL PENALTIES. 
(a) BROADENING OF SCOPE.—Section 1030(e)(2)(B) 
of title 18, United States Code, is amended by inserting 
‘‘or affecting’’ after ‘‘which is used in’’. 
(b) ELIMINATION OF REQUIREMENT OF AN INTER-
STATE OR FOREIGN COMMUNICATION FOR CERTAIN OF-
FENSES INVOLVING PROTECTED COMPUTERS.—Section 
1030(a)(2)(C) of title 18, United States Code, is amended 
by striking ‘‘if the conduct involved an interstate or for-
eign communication’’. 
SEC. 4. RICO PREDICATES. 
Section 1961(1)(B) of title 18, United States Code, 
is amended by inserting ‘‘section 1030 (relating to fraud 
and related activity in connection with computers),’’ before 
‘‘section 1084’’. 
VerDate Aug 31 2005 
01:14 Feb 09, 2007
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H836.IH
H836
hmoore on PROD1PC68 with HMBILLS
SEC. 5. CYBER-EXTORTION. 
Section 1030(a)(7) of title 18, United States Code, 
is amended by inserting ‘‘, or to access without authoriza-
tion or exceed authorized access to a protected computer’’ 
after ‘‘cause damage to a protected computer’’. 
SEC. 6. CONSPIRACY TO COMMIT CYBER-CRIMES. 
Section 1030(b) of title 18, United States Code, is 
amended by inserting ‘‘or conspires’’ after ‘‘attempts’’. 
SEC. 7. NOTICE TO LAW ENFORCEMENT. 
(a) CRIMINAL PENALTY FOR FAILURE TO NOTIFY 
LAW ENFORCEMENT.—Chapter 47 of title 18, United 
States Code, is amended by adding at the end the fol-
lowing: 
‘‘§ 1039. Concealment of security breaches involving 
personal information 
‘‘(a) OFFENSE.—Whoever owns or possesses data in 
electronic form containing a means of identification (as 
defined in section 1028), having knowledge of a major se-
curity breach of the system containing such data main-
tained by such person, and knowingly fails to provide no-
tice of such breach to the United States Secret Service 
or Federal Bureau of Investigation, with the intent to pre-
vent, obstruct, or impede a lawful investigation of such 
breach, shall be fined under this title, imprisoned not more 
than 5 years, or both. 
‘‘(b) DEFINITIONS.—As used in this section— 
VerDate Aug 31 2005 
01:14 Feb 09, 2007
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H836.IH
H836
hmoore on PROD1PC68 with HMBILLS
‘‘(1) MAJOR
SECURITY
BREACH.—The term 
‘major security breach’ means any security breach— 
‘‘(A) whereby means of identification per-
taining to 10,000 or more individuals is, or is 
reasonably believed to have been acquired, and 
such acquisition causes a significant risk of 
identity theft; 
‘‘(B) involving databases owned by the 
Federal Government; or 
‘‘(C) involving primarily data in electronic 
form containing means of identification of Fed-
eral Government employees or contractors in-
volved in national security matters or law en-
forcement. 
‘‘(2) SIGNIFICANT RISK OF IDENTITY THEFT.— 
‘‘(A) IN GENERAL.—The term ‘significant 
risk of identity theft’ means such risk that a 
reasonable person would conclude, after a rea-
sonable opportunity to investigate, that it is 
more probable than not that identity theft has 
occurred or will occur as a result of the breach. 
‘‘(B) PRESUMPTION.—If the data in elec-
tronic form containing a means of identification 
involved in a suspected breach has been 
encrypted, redacted, requires technology to use 
VerDate Aug 31 2005 
01:14 Feb 09, 2007
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H836.IH
H836
hmoore on PROD1PC68 with HMBILLS
or access the data that is not commercially 
available, or has otherwise been rendered unus-
able, then there shall be a presumption that the 
breach has not caused a significant risk of iden-
tity theft. Such presumption may be rebutted 
by facts demonstrating that the encryption code 
has been or is reasonably likely to be com-
promised, that the entity that acquired the data 
is believed to possess the technology to access 
it, or the owner or possessor of the data is or 
reasonably should be aware of an unusual pat-
tern of misuse of the data that indicates fraud 
or identity theft.’’. 
(b) RULEMAKING.—Within 180 days after the date 
of enactment of this Act, the Attorney General and Sec-
retary of Homeland Security shall jointly promulgate rules 
and regulations, after adequate notice and an opportunity 
for comment, as are reasonably necessary, governing the 
form, content, and timing of the notices required pursuant 
to section 1039 of title 18, United States Code. Such rules 
and regulations shall not require the deployment or use 
of specific products or technologies, including any specific 
computer hardware or software, to protect against a secu-
rity breach. Such rules and regulations shall require 
that— 
VerDate Aug 31 2005 
01:14 Feb 09, 2007
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H836.IH
H836
hmoore on PROD1PC68 with HMBILLS
(1) such notice be provided to the United States 
Secret Service or Federal Bureau of Investigation 
before any notice of a breach is made to consumers 
under State or Federal law, and within 14 days of 
discovery of the breach; 
(2) if the United States Secret Service or Fed-
eral Bureau of Investigation determines that any no-
tice required to be made to consumers under State 
or Federal law would impede or compromise a crimi-
nal investigation or national security, the United 
States Secret Service or Federal Bureau of Inves-
tigation shall direct in writing within 7 days that 
such notice shall be delayed for 30 days, or until the 
United States Secret Service or Federal Bureau of 
Investigation determines that such notice will not 
impede or compromise a criminal investigation or 
national security; 
(3) the United States Secret Service shall notify 
the Federal Bureau of Investigation, if the United 
States Secret Service determines that such breach 
may involve espionage, foreign counterintelligence, 
information protected against unauthorized disclo-
sure for reasons of national defense or foreign rela-
tions, or Restricted Data (as that term is defined in 
section 11y of the Atomic Energy Act of 1954 (42 
VerDate Aug 31 2005 
01:14 Feb 09, 2007
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H836.IH
H836
hmoore on PROD1PC68 with HMBILLS
U.S.C. 2014(y))), except for offenses affecting the 
duties of the United States Secret Service under sec-
tion 3056(a) of title 18, United States Code; and 
(4) the United States Secret Service or Federal 
Bureau of Investigation notify the Attorney General 
in each State affected by the breach, if the United 
States Secret Service or Federal Bureau of Inves-
tigation declines to pursue a criminal investigation, 
or as deemed necessary and appropriate. 
(c) IMMUNITY FROM LAWSUIT.—No cause of action 
shall lie in any court against any law enforcement entity 
or any person who notifies law enforcement of a security 
breach pursuant to this section for any penalty, prohibi-
tion, or damages relating to the delay of notification for 
law enforcement purposes under this Act. 
(d) CIVIL PENALTY FOR FAILURE TO NOTIFY.— 
Whoever knowingly fails to give a notice required under 
section 1039 of title 18, United States Code, shall be sub-
ject to a civil penalty of not more than $50,000 for each 
day of such failure, but not more than $1,000,000. 
(e) RELATION TO STATE LAWS.— 
(1) IN GENERAL.—The requirement to notify 
law enforcement under this section shall supersede 
any other notice to law enforcement required under 
State law. 
VerDate Aug 31 2005 
01:14 Feb 09, 2007
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H836.IH
H836
hmoore on PROD1PC68 with HMBILLS
(2) EXCEPTION FOR STATE CONSUMER NOTICE 
LAWS.—The notice required to law enforcement 
under this section shall be in addition to any notice 
to consumers required under State or Federal law 
following the discovery of a security breach. Nothing 
in this section annuls, alters, affects or exempts any 
person from complying with the laws of any State 
with respect to notice to consumers of a security 
breach, except as provided by subsections (b) and 
(c). 
(f) DUTY
OF FEDERAL AGENCIES
AND DEPART-
MENTS.—An agency or department of the Federal Govern-
ment which would be required to give notice of a major 
security breach under section 1039 of title 18, United 
States Code, if that agency or department were a person, 
shall notify the United States Secret Service or Federal 
Bureau of Investigation of the breach in the same time 
and manner as a person subject to that section. The rule-
making authority under subsection (b) shall include the 
authority to make rules for notice under this subsection 
of a major security breach. 
(g) CLERICAL AMENDMENT.—The table of sections 
at the beginning of chapter 47 of title 18, United States 
Code, is amended by adding at the end the following new 
item: 
‘‘1039. Concealment of security breaches involving personal information.’’. 
VerDate Aug 31 2005 
01:14 Feb 09, 2007
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6211
E:\BILLS\H836.IH
H836
hmoore on PROD1PC68 with HMBILLS
SEC. 8. PENALTIES FOR SECTION 1030 VIOLATIONS. 
Subsection (c) of section 1030 of title 18, United 
States Code, is amended to read as follows: 
‘‘(c)(1) The punishment for an offense under sub-
section (a) or (b) is a fine under this title or imprisonment 
for not more than 30 years, or both. 
‘‘(2) The court, in imposing sentence for an offense 
under subsection (a) or (b), shall, in addition to any other 
sentence imposed and irrespective of any provision of 
State law, order that the person forfeit to the United 
States— 
‘‘(A) the person’s interest in any personal prop-
erty that was used or intended to be used to commit 
or to facilitate the commission of such violation; and 
‘‘(B) any property, real or personal, consti-
tuting or derived from, any proceeds the person ob-
tained, directly or indirectly, as a result of such vio-
lation.’’. 
SEC. 9. DIRECTIVE TO SENTENCING COMMISSION. 
(a) DIRECTIVE.—Pursuant to its authority under 
section 994(p) of title 28, United States Code, and in ac-
cordance with this section, the United States Sentencing 
Commission shall forthwith review its guidelines and pol-
icy statements applicable to persons convicted of offenses 
under sections 1028, 1028A, 1030, 1030A, 2511 and 
2701 of title 18, United States Code and any other rel-
VerDate Aug 31 2005 
01:14 Feb 09, 2007
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H836.IH
H836
hmoore on PROD1PC68 with HMBILLS
evant provisions of law, in order to reflect the intent of 
Congress that such penalties be increased in comparison 
to those currently provided by such guidelines and policy 
statements. 
(b) REQUIREMENTS.—In determining its guidelines 
and policy statements on the appropriate sentence for the 
crimes enumerated in paragraph (a), the Commission shall 
consider the extent to which the guidelines and policy 
statements may or may not account for the following fac-
tors in order to create an effective deterrent to computer 
crime and the theft or misuse of personally identifiable 
data— 
(1) the level of sophistication and planning in-
volved in such offense; 
(2) whether such offense was committed for 
purpose of commercial advantage or private financial 
benefit; 
(3) the potential and actual loss resulting from 
the offense; 
(4) whether the defendant acted with intent to 
cause either physical or property harm in commit-
ting the offense; 
(5) the extent to which the offense violated the 
privacy rights of individuals; 
VerDate Aug 31 2005 
01:14 Feb 09, 2007
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H836.IH
H836
hmoore on PROD1PC68 with HMBILLS