(2) by inserting after section 21 the following
new section:
‘‘RESEARCH PROGRAM ON SECURITY OF COMPUTER
SYSTEMS
‘‘SEC. 22. (a) ESTABLISHMENT.—The Director shall
establish a program of assistance to institutions of higher
education that enter into partnerships with for-profit enti-
ties to support research to improve the security of com-
puter systems. The partnerships may also include govern-
ment laboratories. The program shall—
‘‘(1) include multidisciplinary, long-term, high-
risk research;
‘‘(2) include research directed toward address-
ing needs identified through the activities of the
Computer System Security and Privacy Advisory
Board under section 20(f); and
‘‘(3) promote the development of a robust re-
search community working at the leading edge of
knowledge in subject areas relevant to the security
of computer systems by providing support for grad-
uate students, post-doctoral researchers, and senior
researchers.
‘‘(b) FELLOWSHIPS.—(1) The Director is authorized
to establish a program to award post-doctoral research fel-
lowships to individuals who are citizens, nationals, or law-
fully admitted permanent resident aliens of the United
States and are seeking research positions at institutions,
including the Institute, engaged in research activities re-
lated to the security of computer systems, including the
research areas described in section 4(a)(1) of the Cyber
Security Research and Development Act.
‘‘(2) The Director is authorized to establish a pro-
gram to award senior research fellowships to individuals
seeking research positions at institutions, including the In-
stitute, engaged in research activities related to the secu-
rity of computer systems, including the research areas de-
scribed in section 4(a)(1) of the Cyber Security Research
and Development Act. Senior research fellowships shall be
made available for established researchers at institutions
of higher education who seek to change research fields and
pursue studies related to the security of computer systems.
‘‘(3)(A) To be eligible for an award under this sub-
section, an individual shall submit an application to the
Director at such time, in such manner, and containing
such information as the Director may require.
‘‘(B) Under this subsection, the Director is author-
ized to provide stipends for post-doctoral research fellow-
ships at the level of the Institute’s Post Doctoral Research
Fellowship Program and senior research fellowships at lev-
els consistent with support for a faculty member in a sab-
batical position.
‘‘(c) AWARDS; APPLICATIONS.—The Director is au-
thorized to award grants or cooperative agreements to in-
stitutions of higher education to carry out the program
established under subsection (a). To be eligible for an
award under this section, an institution of higher edu-
cation shall submit an application to the Director at such
time, in such manner, and containing such information as
the Director may require. The application shall include,
at a minimum, a description of—
‘‘(1) the number of graduate students antici-
pated to participate in the research project and the
level of support to be provided to each;
‘‘(2) the number of post-doctoral research posi-
tions included under the research project and the
level of support to be provided to each;
‘‘(3) the number of individuals, if any, intend-
ing to change research fields and pursue studies re-
lated to the security of computer systems to be in-
cluded under the research project and the level of
support to be provided to each; and
‘‘(4) how the for-profit entities and any other
partners will participate in developing and carrying
out the research and education agenda of the part-
nership.
‘‘(d) PROGRAM OPERATION.—(1) The program es-
tablished under subsection (a) shall be managed by indi-
viduals who shall have both expertise in research related
to the security of computer systems and knowledge of the
vulnerabilities of existing computer systems. The Director
shall designate such individuals as program managers.
‘‘(2) Program managers designated under paragraph
(1) may be new or existing employees of the Institute or
individuals on assignment at the Institute under the Inter-
governmental Personnel Act of 1970.
‘‘(3) Program managers designated under paragraph
(1) shall be responsible for—
‘‘(A) establishing and publicizing the broad re-
search goals for the program;
‘‘(B) soliciting applications for specific research
projects to address the goals developed under sub-
paragraph (A);
‘‘(C) selecting research projects for support
under the program from among applications sub-
mitted to the Institute, following consideration of—
‘‘(i) the novelty and scientific and technical
merit of the proposed projects;
‘‘(ii) the demonstrated capabilities of the
individual or individuals submitting the applica-
tions to successfully carry out the proposed re-
search;
‘‘(iii) the impact the proposed projects will
have on increasing the number of computer se-
curity researchers;
‘‘(iv) the nature of the participation by for-
profit entities and the extent to which the pro-
posed projects address the concerns of industry;
and
‘‘(v) other criteria determined by the Di-
rector, based on information specified for inclu-
sion in applications under subsection (c); and
‘‘(D) monitoring the progress of research
projects supported under the program.
‘‘(e) REVIEW OF PROGRAM.—(1) The Director shall
periodically review the portfolio of research awards mon-
itored by each program manager designated in accordance
with subsection (d). In conducting those reviews, the Di-
rector shall seek the advice of the Computer System Secu-
rity and Privacy Advisory Board, established under section
21, on the appropriateness of the research goals and on
the quality and utility of research projects managed by
program managers in accordance with subsection (d).
‘‘(2) The Director shall also contract with the Na-
tional Research Council for a comprehensive review of the
program established under subsection (a) during the 5th
year of the program. Such review shall include an assess-
ment of the scientific quality of the research conducted,
the relevance of the research results obtained to the goals
of the program established under subsection (d)(3)(A),
and the progress of the program in promoting the develop-
ment of a substantial academic research community work-
ing at the leading edge of knowledge in the field. The Di-
rector shall submit to Congress a report on the results
of the review under this paragraph no later than six years
after the initiation of the program.
‘‘(f) DEFINITIONS.—For purposes of this section—
‘‘(1) the term ‘computer system’ has the mean-
ing given that term in section 20(d)(1); and
‘‘(2) the term ‘institution of higher education’
has the meaning given that term in section 101 of
the Higher Education Act of 1965 (20 U.S.C.
1001).’’; and
(3) in section 20(d)(1)(B)(i) (15 U.S.C. 278g–
3(d)(1)(B)(i)), by inserting ‘‘and computer net-
works’’ after ‘‘computers’’.
SEC. 9. COMPUTER SECURITY REVIEW, PUBLIC MEETINGS,
AND INFORMATION.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3) is amended by adding
at the end the following new subsection:
‘‘(f) There are authorized to be appropriated to the
Secretary $1,060,000 for fiscal year 2003 and $1,090,000
for fiscal year 2004 to enable the Computer System Secu-
rity and Privacy Advisory Board, established by section
21, to identify emerging issues, including research needs,
related to computer security, privacy, and cryptography
and, as appropriate, to convene public meetings on those
subjects, receive presentations, and publish reports, di-
gests, and summaries for public distribution on those sub-
jects.’’.
SEC. 10. INTRAMURAL SECURITY RESEARCH.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3) is further amended—
(1) by redesignating subsection (d) as sub-
section (e); and
(2) by inserting after subsection (c) the fol-
lowing new subsection:
‘‘(d) As part of the research activities conducted in
accordance with subsection (b)(4), the Institute shall—
‘‘(1) conduct a research program to address
emerging technologies associated with assembling a
networked computer system from components while
ensuring it maintains desired security properties;
‘‘(2) carry out research and support standards
development activities associated with improving the
security of real-time computing and communications
systems for use in process control; and
‘‘(3) carry out multidisciplinary, long-term,
high-risk research on ways to improve the security
of computer systems.’’.
SEC. 11. AUTHORIZATION OF APPROPRIATIONS.
There are authorized to be appropriated to the Sec-
retary of Commerce for the National Institute of Stand-
ards and Technology—
(1) for activities under section 22 of the Na-
tional Institute of Standards and Technology Act, as
added by section 8 of this Act—
(A) $25,000,000 for fiscal year 2003;
(B) $40,000,000 for fiscal year 2004;
(C) $55,000,000 for fiscal year 2005;
(D) $70,000,000 for fiscal year 2006;
(E) $85,000,000 for fiscal year 2007; and
(F) such sums as may be necessary for fis-
cal years 2008 through 2012; and
(2) for activities under section 20(d) of the Na-
tional Institute of Standards and Technology Act, as
added by section 10 of this Act—
(A) $6,000,000 for fiscal year 2003;
(B) $6,200,000 for fiscal year 2004;
(C) $6,400,000 for fiscal year 2005;
(D) $6,600,000 for fiscal year 2006; and
(E) $6,800,000 for fiscal year 2007.
SEC. 12. NATIONAL ACADEMY OF SCIENCES STUDY ON
COMPUTER AND NETWORK SECURITY IN
CRITICAL INFRASTRUCTURES.
(a) STUDY.—Not later than 3 months after the date
of the enactment of this Act, the Director of the National
Institute of Standards and Technology shall enter into an
arrangement with the National Research Council of the
National Academy of Sciences to conduct a study of the
vulnerabilities of the Nation’s network infrastructure and
make recommendations for appropriate improvements.
The National Research Council shall—
(1) review existing studies and associated data
on the architectural, hardware, and software
vulnerabilities and interdependencies in United
States critical infrastructure networks;
(2) identify and assess gaps in technical capa-
bility for robust critical infrastructure network secu-
rity, and make recommendations for research prior-
ities and resource requirements; and
(3) review any and all other essential elements
of computer and network security, including security
of industrial process controls, to be determined in
the conduct of the study.
(b) REPORT.—The Director of the National Institute
of Standards and Technology shall transmit a report con-
taining the results of the study and recommendations re-
quired by subsection (a) to the Congress not later than
21 months after the date of enactment of this Act.
(c) SECURITY.—The Director of the National Insti-
tute of Standards and Technology shall ensure that no in-
formation that is classified is included in any publicly re-
leased version of the report required by this section.
(d) AUTHORIZATION
OF APPROPRIATIONS.—There
are authorized to be appropriated to the Secretary of Com-
merce for the National Institute of Standards and Tech-
nology for the purposes of carrying out this section,
$700,000.
Æ