IB
Union Calendar No. 527
106TH CONGRESS
2D SESSION
H. R. 2413
[Report No. 106–876]
To amend the National Institute of Standards and Technology Act to enhance
the ability of the National Institute of Standards and Technology to
improve computer security, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
JULY 1, 1999
Mr. SENSENBRENNER (for himself, Mr. GORDON, and Mrs. MORELLA)
introduced the following bill; which was referred to the Committee on Science
SEPTEMBER 21, 2000
Additional sponsors: Mr. EHLERS, Mr. COOK, Mr. EWING, Mr. GUTKNECHT,
and Mr. KUYKENDALL
SEPTEMBER 21, 2000
Reported with an amendment, committed to the Committee of the Whole
House on the State of the Union, and ordered to be printed
[Strike out all after the enacting clause and insert the part printed in italic]
[For text of introduced bill, see copy of bill as introduced on July 21, 1999]
A BILL
To amend the National Institute of Standards and Tech-
nology Act to enhance the ability of the National Insti-
tute of Standards and Technology to improve computer
security, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Computer Security
Enhancement Act of 2000’’.
SEC. 2. FINDINGS AND PURPOSES.
(a) FINDINGS.—The Congress finds the following:
(1) The National Institute of Standards and
Technology has responsibility for developing stand-
ards and guidelines needed to ensure the cost-effective
security and privacy of sensitive information in Fed-
eral computer systems.
(2) The Federal Government has an important
role in ensuring the protection of sensitive, but un-
classified, information controlled by Federal agencies.
(3) Technology that is based on the application
of cryptography exists and can be readily provided by
private sector companies to ensure the confidentiality,
authenticity, and integrity of information associated
with public and private activities.
(4) The development and use of encryption tech-
nologies by industry should be driven by market
forces rather than by Government imposed require-
ments.
(b) PURPOSES.—The purposes of this Act are to—
(1) reinforce the role of the National Institute of
Standards and Technology in ensuring the security of
unclassified information in Federal computer systems;
and
(2) promote technology solutions based on pri-
vate sector offerings to protect the security of Federal
computer systems.
SEC. 3. VOLUNTARY STANDARDS FOR PUBLIC KEY MANAGE-
MENT INFRASTRUCTURE.
Section 20(b) of the National Institute of Standards
and Technology Act (15 U.S.C. 278g–3(b)) is amended—
(1) by redesignating paragraphs (2), (3), (4),
and (5) as paragraphs (3), (4), (8), and (9), respec-
tively; and
(2) by inserting after paragraph (1) the fol-
lowing new paragraph:
‘‘(2) upon request from the private sector, to as-
sist in establishing voluntary interoperable standards,
guidelines, and associated methods and techniques to
facilitate and expedite the establishment of non-Fed-
eral management infrastructures for public keys that
can be used to communicate with and conduct trans-
actions with the Federal Government;’’.
SEC. 4. SECURITY OF FEDERAL COMPUTERS AND NET-
WORKS.
Section 20(b) of the National Institute of Standards
and Technology Act (15 U.S.C. 278g–3(b)), as amended by
section 3 of this Act, is further amended by inserting after
paragraph (4), as so redesignated by section 3(1) of this
Act, the following new paragraphs:
‘‘(5) except for national security systems, as de-
fined in section 5142 of Public Law 104–106 (40
U.S.C. 1452), to provide guidance and assistance to
Federal agencies for protecting the security and pri-
vacy of sensitive information in interconnected Fed-
eral computer systems, including identification of sig-
nificant risks thereto;
‘‘(6) to promote compliance by Federal agencies
with existing Federal computer information security
and privacy guidelines;
‘‘(7) in consultation with appropriate Federal
agencies, assist Federal response efforts related to un-
authorized access to Federal computer systems;’’.
SEC. 5. COMPUTER SECURITY IMPLEMENTATION.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3) is further amended—
(1) by redesignating subsections (c) and (d) as
subsections (e) and (f), respectively; and
(2) by inserting after subsection (b) the following
new subsection:
‘‘(c)(1) In carrying out subsection (a)(2) and (3), the
Institute shall—
‘‘(A) emphasize the development of technology-
neutral policy guidelines for computer security prac-
tices by the Federal agencies;
‘‘(B) promote the use of commercially available
products, which appear on the list required by para-
graph (2), to provide for the security and privacy of
sensitive information in Federal computer systems;
‘‘(C) develop qualitative and quantitative meas-
ures appropriate for assessing the quality and effec-
tiveness of information security and privacy pro-
grams at Federal agencies;
‘‘(D) perform evaluations and tests at Federal
agencies to assess existing information security and
privacy programs;
‘‘(E) promote development of accreditation proce-
dures for Federal agencies based on the measures de-
veloped under subparagraph (C);
‘‘(F) if requested, consult with and provide as-
sistance to Federal agencies regarding the selection by
agencies of security technologies and products and the
implementation of security practices; and
‘‘(G)(i) develop uniform testing procedures suit-
able for determining the conformance of commercially
available security products to the guidelines and
standards developed under subsection (a)(2) and (3);
‘‘(ii) establish procedures for certification of pri-
vate sector laboratories to perform the tests and eval-
uations of commercially available security products
developed in accordance with clause (i); and
‘‘(iii) promote the testing of commercially avail-
able security products for their conformance with
guidelines and standards developed under subsection
(a)(2) and (3).
‘‘(2) The Institute shall maintain and make available
to Federal agencies and to the public a list of commercially
available security products that have been tested by private
sector laboratories certified in accordance with procedures
established under paragraph (1)(G)(ii), and that have been
found to be in conformance with the guidelines and stand-
ards developed under subsection (a)(2) and (3).
‘‘(3) The Institute shall annually transmit to the Con-
gress, in an unclassified format, a report containing—
‘‘(A) the findings of the evaluations and tests of
Federal computer systems conducted under this sec-
tion during the 12 months preceding the date of the
report, including the frequency of the use of commer-
and Privacy Advisory Board, established by section 21, to
identify emerging issues related to computer security, pri-
vacy, and cryptography and to convene public meetings on
those subjects, receive presentations, and publish reports, di-
gests, and summaries for public distribution on those sub-
jects.’’.
SEC. 7. LIMITATION ON PARTICIPATION IN REQUIRING
ENCRYPTION STANDARDS.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this Act,
is further amended by adding at the end the following new
subsection:
‘‘(g) The Institute shall not promulgate, enforce, or oth-
erwise adopt standards, or carry out activities or policies,
for the Federal establishment of encryption standards re-
quired for use in computer systems other than Federal Gov-
ernment computer systems.’’.
SEC. 8. MISCELLANEOUS AMENDMENTS.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this Act,
is further amended—
(1) in subsection (b)(9), as so redesignated by
section 3(1) of this Act, by inserting ‘‘to the extent
that such coordination will improve computer secu-
rity and to the extent necessary for improving such
security for Federal computer systems’’ after ‘‘Man-
agement and Budget)’’;
(2) in subsection (e), as so redesignated by sec-
tion 5(1) of this Act, by striking ‘‘shall draw upon’’
and inserting in lieu thereof ‘‘may draw upon’’;
(3) in subsection (e)(2), as so redesignated by
section 5(1) of this Act, by striking ‘‘(b)(5)’’ and in-
serting in lieu thereof ‘‘(b)(8)’’; and
(4) in subsection (f)(1)(B)(i), as so redesignated
by section 5(1) of this Act, by inserting ‘‘and com-
puter networks’’ after ‘‘computers’’.
SEC. 9. FEDERAL COMPUTER SYSTEM SECURITY TRAINING.
Section 5(b) of the Computer Security Act of 1987 (40
U.S.C. 759 note) is amended—
(1) by striking ‘‘and’’ at the end of paragraph
(1);
(2) by striking the period at the end of para-
graph (2) and inserting in lieu thereof ‘‘; and’’; and
(3) by adding at the end the following new para-
graph:
‘‘(3) to include emphasis on protecting sensitive
information in Federal databases and Federal com-
puter sites that are accessible through public net-
works.’’.
SEC. 10. COMPUTER SECURITY FELLOWSHIP PROGRAM.
There are authorized to be appropriated to the Sec-
retary of Commerce $500,000 for fiscal year 2001 and
$500,000 for fiscal year 2002 for the Director of the Na-
tional Institute of Standards and Technology for fellow-
ships, subject to the provisions of section 18 of the National
Institute of Standards and Technology Act (15 U.S.C.
278g–1), to support students at institutions of higher learn-
ing in computer security. Amounts authorized by this sec-
tion shall not be subject to the percentage limitation stated
in such section 18.
SEC. 11. STUDY OF PUBLIC KEY INFRASTRUCTURE BY THE
NATIONAL RESEARCH COUNCIL.
(a) REVIEW BY NATIONAL RESEARCH COUNCIL.—Not
later than 90 days after the date of the enactment of this
Act, the Secretary of Commerce shall enter into a contract
with the National Research Council of the National Acad-
emy of Sciences to conduct a study of public key infrastruc-
tures for use by individuals, businesses, and government.
(b) CONTENTS.—The study referred to in subsection
(a) shall—
(1) assess technology needed to support public
key infrastructures;
(2) assess current public and private plans for
the deployment of public key infrastructures;
(3) assess interoperability, scalability, and integ-
rity of private and public entities that are elements
of public key infrastructures;
(4) make recommendations for Federal legisla-
tion and other Federal actions required to ensure the
national feasibility and utility of public key infra-
structures; and
(5) address such other matters as the National
Research Council considers relevant to the issues of
public key infrastructure.
(c) INTERAGENCY COOPERATION WITH STUDY.—All
agencies of the Federal Government shall cooperate fully
with the National Research Council in its activities in car-
rying out the study under this section, including access by
properly cleared individuals to classified information if
necessary.
(d) REPORT.—Not later than 18 months after the date
of the enactment of this Act, the Secretary of Commerce
shall transmit to the Committee on Science of the House
of Representatives and the Committee on Commerce,
Science, and Transportation of the Senate a report setting
forth the findings, conclusions, and recommendations of the
National Research Council for public policy related to pub-
lic key infrastructures for use by individuals, businesses,
and government. Such report shall be submitted in unclassi-
fied form.
(e) AUTHORIZATION OF APPROPRIATIONS.—There are
authorized to be appropriated to the Secretary of Commerce
$450,000 for fiscal year 2001, to remain available until ex-
pended, for carrying out this section.
SEC. 12. PROMOTION OF NATIONAL INFORMATION SECU-
RITY.
The Under Secretary of Commerce for Technology
shall—
(1) promote an increased use of security tech-
niques, such as risk assessment, and security tools,
such as cryptography, to enhance the protection of the
Nation’s information infrastructure;
(2) establish a central repository of information
for dissemination to the public to promote awareness
of information security vulnerabilities and risks; and
(3) promote the development of the national,
standards-based infrastructure needed to support gov-
ernment, commercial, and private uses of encryption
technologies for confidentiality and authentication.
SEC. 13. ELECTRONIC AUTHENTICATION INFRASTRUCTURE.
(a) 
ELECTRONIC
AUTHENTICATION
INFRASTRUC-
TURE.—
(1) GUIDELINES
AND
STANDARDS.—Not later
than 18 months after the date of the enactment of this
Act, the Director, in consultation with industry and
appropriate Federal agencies, shall develop electronic
authentication infrastructure guidelines and stand-
ards for use by Federal agencies to assist those agen-
cies to effectively select and utilize electronic authen-
tication technologies in a manner that is—
(A) adequately secure to meet the needs of
those agencies and their transaction partners;
and
(B) interoperable, to the maximum extent
possible.
(2) ELEMENTS.—The guidelines and standards
developed under paragraph (1) shall include—
(A) protection profiles for cryptographic
and noncryptographic methods of authenticating
identity for electronic authentication products
and services;
(B) a core set of interoperability specifica-
tions for the Federal acquisition of electronic au-
thentication products and services; and
(C) validation criteria to enable Federal
agencies to select cryptographic electronic au-
thentication products and services appropriate to
their needs.
(3) COORDINATION
WITH
NATIONAL
POLICY
PANEL.—The Director shall ensure that the develop-
ment of guidelines and standards with respect to
cryptographic electronic authentication products and
services under this subsection is carried out in con-
sultation with the National Policy Panel for Digital
Signatures established under subsection (e).
(4) REVISIONS.—The Director shall periodically
review the guidelines and standards developed under
paragraph (1) and revise them as appropriate.
(b) LISTING
OF VALIDATED PRODUCTS.—Not later
than 30 months after the date of the enactment of this Act,
and thereafter, the Director shall maintain and make avail-
able to Federal agencies and to the public a list of commer-
cially available electronic authentication products, and
other such products used by Federal agencies, evaluated as
conforming with the guidelines and standards developed
under subsection (a).
(c) SPECIFICATIONS FOR ELECTRONIC CERTIFICATION
AND MANAGEMENT TECHNOLOGIES.—
(1) SPECIFICATIONS.—The Director shall, as ap-
propriate, establish core specifications for particular
electronic certification and management technologies,
or their components, for use by Federal agencies.
(2) EVALUATION.—The Director shall advise
Federal agencies on how to evaluate the conformance
with the specifications established under paragraph
(1) of electronic certification and management tech-
nologies, developed for use by Federal agencies or
available for such use.
(3) MAINTENANCE OF LIST.—The Director shall
maintain and make available to Federal agencies a
list of electronic certification and management tech-
nologies evaluated as conforming to the specifications
established under paragraph (1).
(d) REPORTS.—Not later than 18 months after the
date of the enactment of this Act, and annually thereafter,
the Director shall transmit to the Congress a report that
includes—
(1) a description and analysis of the utilization
by Federal agencies of electronic authentication tech-
nologies; and
(2) an evaluation of the extent to which Federal
agencies’ electronic authentication infrastructures
conform to the guidelines and standards developed
under subsection (a)(1).
(e) NATIONAL POLICY PANEL FOR DIGITAL SIGNA-
TURES.—
(1) ESTABLISHMENT.—Not later than 90 days
after the date of the enactment of this Act, the Under
Secretary shall establish a National Policy Panel for
Digital Signatures. The Panel shall be composed of
government, academic, and industry technical and
legal experts on the implementation of digital signa-
ture technologies, State officials, including officials
from States which have enacted laws recognizing the
use of digital signatures, and representative individ-
uals from the interested public.
(2) RESPONSIBILITIES.—The Panel shall serve as
a forum for exploring all relevant factors associated
with the development of a national digital signature
infrastructure based on uniform guidelines and stand-
ards to enable the widespread availability and use of
digital signature systems. The Panel shall develop—
(A) model practices and procedures for cer-
tification authorities to ensure the accuracy, reli-
ability, and security of operations associated
with issuing and managing digital certificates;
(B) guidelines and standards to ensure con-
sistency among jurisdictions that license certifi-
cation authorities; and
(C) audit procedures for certification au-
thorities.
(3) COORDINATION.—The Panel shall coordinate
its efforts with those of the Director under subsection
(a).
(4) ADMINISTRATIVE SUPPORT.—The Under Sec-
retary shall provide administrative support to enable
the Panel to carry out its responsibilities.
(5) REPORT.—Not later than 1 year after the
date of the enactment of this Act, the Under Secretary
shall transmit to the Congress a report containing the
recommendations of the Panel.
(f) DEFINITIONS.—For purposes of this section—
(1) the term ‘‘certification authorities’’ means
issuers of digital certificates;
(2) the term ‘‘digital certificate’’ means an elec-
tronic document that binds an individual’s identity
to the individual’s key;
(3) the term ‘‘digital signature’’ means a mathe-
matically generated mark utilizing key cryptography
techniques that is unique to both the signatory and
the information signed;
(4) the term ‘‘digital signature infrastructure’’
means the software, hardware, and personnel re-
sources, and the procedures, required to effectively uti-
lize digital certificates and digital signatures;
(5) the term ‘‘electronic authentication’’ means
cryptographic or noncryptographic methods of au-
thenticating identity in an electronic communication;
(6) the term ‘‘electronic authentication infra-
structure’’ means the software, hardware, and per-
sonnel resources, and the procedures, required to effec-
tively utilize electronic authentication technologies;
(7) the term ‘‘electronic certification and man-
agement technologies’’ means computer systems, in-
cluding associated personnel and procedures, that en-
able individuals to apply unique digital signatures to
electronic information;
(8) the term ‘‘protection profile’’ means a list of
security functions and associated assurance levels
used to describe a product; and
(9) the term ‘‘Under Secretary’’ means the
Under Secretary of Commerce for Technology.
SEC. 14. SOURCE OF AUTHORIZATIONS.
There are authorized to be appropriated to the Sec-
retary of Commerce $7,000,000 for fiscal year 2001 and
$8,000,000 for fiscal year 2002, for the National Institute
of Standards and Technology to carry out activities author-
ized by this Act for which funds are not otherwise specifi-
cally authorized to be appropriated by this Act.
Union Calendar No. 527
106TH CONGRESS
2D SESSION
H. R. 2413
[Report No. 106–876]
A BILL
To amend the National Institute of Standards and
Technology Act to enhance the ability of the Na-
tional Institute of Standards and Technology to
improve computer security, and for other pur-
poses.
SEPTEMBER 21, 2000
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union,
and ordered to be printed