HR 1684 RFS
present a serious risk to human popu-
lations; and 
‘‘(iv) advanced or engineered agents, 
which are defined as novel pathogens or 
other materials of biological nature that 
have been artificially engineered in the lab-
oratory to bypass traditional counter-
measures or produce a more severe or oth-
erwise enhanced spectrum of disease. 
‘‘(C) Nuclear and radiological threats, in-
cluding fissile and other radiological material 
that could be incorporated into an improvised 
nuclear device or a radiological dispersal device 
or released into a wide geographic area by dam-
age to a nuclear reactor. 
‘‘(D) Threats to the agriculture sector and 
food and water supplies. 
‘‘(E) Other threat agents the Secretary de-
termines appropriate. 
‘‘(2) SOURCES.—The risk analysis process de-
veloped under subsection (a) shall be informed by 
findings of the intelligence and law enforcement 
communities and integrated with expert input from 
the scientific, medical, and public health commu-
VerDate Aug 31 2005 
21:56 May 11, 2007
Jkt 059200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6201
E:\BILLS\H1684.RFS
H1684
pwalker on PROD1PC71 with BILLS
HR 1684 RFS
nities, including from relevant components of the 
Department and other Federal agencies. 
‘‘(3) DATA QUALITY, SPECIFICITY, AND CON-
FIDENCE.—In developing the risk analysis process 
under subsection (a), the Secretary shall consider 
the degree of uncertainty and variability in the avail-
able scientific information and other information 
about the classes of threat agents under paragraph 
(1). An external review shall be conducted to assess 
the ability of the risk analysis process developed by 
the Secretary to address areas of large degrees of 
uncertainty. 
‘‘(4) NEW INFORMATION.—The Secretary shall 
frequently and systematically update the risk assess-
ment conducted under subsection (b), as needed, to 
incorporate emerging intelligence information or 
technological changes in order to keep pace with 
evolving threats and rapid scientific advances. 
‘‘(e) METHODOLOGY.—The risk analysis process de-
veloped by the Secretary under subsection (a) shall— 
‘‘(1) consider, as variables— 
‘‘(A) threat, or the likelihood that a type 
of attack that might be attempted; 
‘‘(B) vulnerability, or the likelihood that an 
attacker would succeed; and 
VerDate Aug 31 2005 
21:56 May 11, 2007
Jkt 059200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6201
E:\BILLS\H1684.RFS
H1684
pwalker on PROD1PC71 with BILLS
HR 1684 RFS
‘‘(C) consequence, or the likely impact of 
an attack; 
‘‘(2) evaluate the consequence component of 
risk as it relates to mortality, morbidity, and eco-
nomic effects; 
‘‘(3) allow for changes in assumptions to evalu-
ate a full range of factors, including technological, 
economic, and social trends, which may alter the fu-
ture security environment; 
‘‘(4) contain a well-designed sensitivity analysis 
to address high degrees of uncertainty associated 
with the risk analyses of certain CBRN agents; 
‘‘(5) utilize red teaming analysis to identify 
vulnerabilities an adversary may discover and exploit 
in technology, training, and operational procedures 
and to identify open-source information that could 
be used by those attempting to defeat the counter-
measures; and 
‘‘(6) incorporate an interactive interface that 
makes results and limitations transparent and useful 
to decision makers for identifying appropriate risk 
management activities. 
‘‘(f) COORDINATION.—The Secretary shall ensure 
that all risk analysis activities with respect to radiological 
VerDate Aug 31 2005 
21:56 May 11, 2007
Jkt 059200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6201
E:\BILLS\H1684.RFS
H1684
pwalker on PROD1PC71 with BILLS
HR 1684 RFS
or nuclear materials shall be conducted in coordination 
with the Domestic Nuclear Detection Office. 
‘‘(g) TIMEFRAME; REPORTS TO CONGRESS.— 
‘‘(1) INITIAL REPORT.—By not later than June 
2008, the Secretary shall complete the first formal, 
integrated, CBRN risk assessment required under 
subsection (b) and shall submit to Congress a report 
summarizing the findings of such assessment and 
identifying improvements that could be made to en-
hance the transparency and usability of the risk 
analysis process developed under subsection (a). 
‘‘(2) UPDATES
TO
REPORT.—The Secretary 
shall submit to Congress updates to the findings and 
report in paragraph (1), when appropriate, but by 
not later than two years after the date on which the 
initial report is submitted. Such updates shall reflect 
improvements in the risk analysis process developed 
under subsection (a).’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of such Act is amended by inserting after 
the items relating to such title the following: 
‘‘Sec. 317. Risk analysis process and integrated CBRN risk assessment.’’. 
VerDate Aug 31 2005 
21:56 May 11, 2007
Jkt 059200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6211
E:\BILLS\H1684.RFS
H1684
pwalker on PROD1PC71 with BILLS
HR 1684 RFS
TITLE 
VII—HOMELAND 
SECU-
RITY 
CYBERSECURITY 
IM-
PROVEMENTS 
SEC. 701. CYBERSECURITY AND COMMUNICATIONS. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 (6 U.S.C. 141 et seq.) is amend-
ed by adding at the end the following new section: 
‘‘SEC. 226. OFFICE OF CYBERSECURITY AND COMMUNICA-
TIONS. 
‘‘(a) IN GENERAL.—There shall be within the De-
partment of Homeland Security an Office of Cybersecurity 
and Communications, which shall be headed by the Assist-
ant Secretary for Cybersecurity and Communications. 
‘‘(b) DUTY OF THE ASSISTANT SECRETARY.—The 
Assistant Secretary shall assist the Secretary in carrying 
out the responsibilities of the Department regarding 
cybersecurity and communications. 
‘‘(c) RESPONSIBILITIES.—The Assistant Secretary 
shall be responsible for overseeing preparation, situational 
awareness, response, reconstitution, and mitigation nec-
essary for cybersecurity and to protect communications 
from terrorist attacks, major disasters, and other emer-
gencies, including large-scale disruptions, and shall con-
duct the following activities to execute those responsibil-
ities: 
VerDate Aug 31 2005 
21:56 May 11, 2007
Jkt 059200
PO 00000
Frm 00097
Fmt 6652
Sfmt 6201
E:\BILLS\H1684.RFS
H1684
pwalker on PROD1PC71 with BILLS
HR 1684 RFS
‘‘(1) PREPARATION AND SITUATIONAL AWARE-
NESS.— 
‘‘(A) Establish and maintain a capability 
within the Department for ongoing activities to 
identify threats to critical information infra-
structure to aid in detection of vulnerabilities 
and warning of potential acts of terrorism and 
other attacks. 
‘‘(B) Conduct risk assessments on critical 
information infrastructure with respect to acts 
of terrorism and other large-scale disruptions, 
identify and prioritize vulnerabilities in critical 
information infrastructure, and coordinate the 
mitigation of such vulnerabilities. 
‘‘(C) Develop a plan for the continuation 
of critical information operations in the event of 
a cyber attack or other large-scale disruption of 
the information infrastructure of the United 
States. 
‘‘(D) Oversee an emergency communica-
tions system in the event of an act of terrorism 
or other large-scale disruption of the informa-
tion infrastructure of the United States. 
‘‘(2) RESPONSE AND RECONSTITUTION.— 
VerDate Aug 31 2005 
21:56 May 11, 2007
Jkt 059200
PO 00000
Frm 00098
Fmt 6652
Sfmt 6201
E:\BILLS\H1684.RFS
H1684
pwalker on PROD1PC71 with BILLS
HR 1684 RFS
‘‘(A) Define what qualifies as a cyber inci-
dent of national significance for purposes of the 
National Response Plan. 
‘‘(B) Ensure that the Department’s prior-
ities, procedures, and resources are in place to 
reconstitute critical information infrastructures 
in the event of an act of terrorism or other 
large-scale disruption. 
‘‘(3) MITIGATION.— 
‘‘(A) Develop a national cybersecurity 
awareness, training, and education program 
that promotes cybersecurity awareness within 
the Federal Government and throughout the 
Nation. 
‘‘(B) Consult and coordinate with the 
Under Secretary for Science and Technology on 
cybersecurity research and development to 
strengthen critical information infrastructure 
against acts of terrorism and other large-scale 
disruptions. 
‘‘(d) DEFINITION.—In this section the term ‘critical 
information infrastructure’ means systems and assets, 
whether physical or virtual, used in processing, transfer-
ring, and storing information so vital to the United States 
that the incapacity or destruction of such systems and as-
VerDate Aug 31 2005 
21:56 May 11, 2007
Jkt 059200
PO 00000
Frm 00099
Fmt 6652
Sfmt 6201
E:\BILLS\H1684.RFS
H1684
pwalker on PROD1PC71 with BILLS
100 
HR 1684 RFS
sets would have a debilitating impact on security, national 
economic security, national public health or safety, or any 
combination of those matters.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of such Act is amended by inserting at the 
end of the items relating to subtitle C of title II the fol-
lowing: 
‘‘Sec. 226. Office of Cybersecurity and Communications.’’. 
SEC. 702. CYBERSECURITY RESEARCH AND DEVELOPMENT. 
(a) IN GENERAL.—The Under Secretary for Science 
and Technology shall support research, development, test-
ing, evaluation, and transition of cybersecurity technology, 
including fundamental, long-term research to improve the 
ability of the United States to prevent, protect against, 
detect, respond to, and recover from acts of terrorism and 
cyber attacks, with emphasis on research and development 
relevant to large-scale, high-impact attacks. 
(b) ACTIVITIES.—The research and development sup-
ported under subsection (a) shall include work to— 
(1) advance the development and accelerate the 
deployment of more secure versions of fundamental 
Internet protocols and architectures, including for 
the domain name system and routing protocols; 
(2) improve and create technologies for detect-
ing attacks or intrusions, including monitoring tech-
nologies; 
VerDate Aug 31 2005 
21:56 May 11, 2007
Jkt 059200
PO 00000
Frm 00100
Fmt 6652
Sfmt 6201
E:\BILLS\H1684.RFS
H1684
pwalker on PROD1PC71 with BILLS
101 
HR 1684 RFS
(3) improve and create mitigation and recovery 
methodologies, including techniques for containment 
of attacks and development of resilient networks and 
systems that degrade gracefully; 
(4) develop and support infrastructure and tools 
to support cybersecurity research and development 
efforts, including modeling, testbeds, and data sets 
for assessment of new cybersecurity technologies; 
(5) assist the development and support of tech-
nologies to reduce vulnerabilities in process control 
systems (PCS); and 
(6) test, evaluate, and facilitate the transfer of 
technologies associated with the engineering of less 
vulnerable software and securing the IT software de-
velopment lifecycle. 
(c) COORDINATION.—In carrying out this section, the 
Under Secretary for Science and Technology shall coordi-
nate activities with— 
(1) the Assistant Secretary for Cybersecurity 
and Communications; and 
(2) other Federal agencies, including the Na-
tional Science Foundation, the Defense Advanced 
Research Projects Agency, the Information Assur-
ance Directorate of the National Security Agency, 
the National Institute of Standards and Technology, 
VerDate Aug 31 2005 
21:56 May 11, 2007
Jkt 059200
PO 00000
Frm 00101
Fmt 6652
Sfmt 6201
E:\BILLS\H1684.RFS
H1684
pwalker on PROD1PC71 with BILLS
102 
HR 1684 RFS
the Department of Commerce, and other appropriate 
working groups established by the President to iden-
tify unmet needs and cooperatively support activi-
ties, as appropriate. 
(d) AUTHORIZATION OF APPROPRIATIONS.—Of the 
amount authorized by section 101, there is authorized to 
be appropriated for the Department of Homeland Security 
for fiscal year 2008, $50,000,000, for the cybersecurity 
research and development activities of the Directorate for 
Science and Technology to prevent, detect, and respond 
to acts of terrorism and other large-scale disruptions to 
information infrastructure. 
SEC. 703. COLLABORATION. 
In carrying out this title, the Assistant Secretary of 
Homeland Security for Cybersecurity and Communica-
tions shall collaborate with any Federal entity that, under 
law, has authority over the activities set forth in this title. 
TITLE VIII—SCIENCE AND 
TECHNOLOGY IMPROVEMENTS 
SEC. 801. REPORT TO CONGRESS ON STRATEGIC PLAN. 
Not later than 120 days after the date of enactment 
of this Act, the Under Secretary for Science and Tech-
nology shall transmit to Congress the strategic plan de-
scribed in section 302(2) of the Homeland Security Act 
of 2002 (6 U.S.C. 182(2)). In addition to the require-
VerDate Aug 31 2005 
21:56 May 11, 2007
Jkt 059200
PO 00000
Frm 00102
Fmt 6652
Sfmt 6201
E:\BILLS\H1684.RFS
H1684
pwalker on PROD1PC71 with BILLS
103 
HR 1684 RFS
ments described in that section 302(2), the strategic plan 
transmitted under this section shall include— 
(1) a strategy to enhance the Directorate for 
Science and Technology workforce, including edu-
cation and training programs, improving morale, 
minimizing turnover, strengthening workforce re-
cruitment, and securing institutional knowledge; 
(2) the Department policy describing the proce-
dures by which the Directorate for Science and 
Technology hires and administers assignments to in-
dividuals assigned to the Department as detailees 
under an arrangement described in subchapter VI of 
chapter 33 of title 5, United States Code; 
(3) the Department policy governing the re-
sponsibilities of the Under Secretary for Science and 
Technology, the Under Secretary for Policy, and the 
Under Secretary for Management, and the oper-
ational components of the Department regarding re-
search, development, testing, evaluation, and pro-
curement of homeland security technologies; 
(4) a description of the methodology by which 
research, development, testing, and evaluation is 
prioritized and funded by the Directorate for Science 
and Technology; 
VerDate Aug 31 2005 
21:56 May 11, 2007
Jkt 059200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6201
E:\BILLS\H1684.RFS
H1684
pwalker on PROD1PC71 with BILLS