†
HR 5005 EAS
(E) shall not, if provided to a State or local
government or government agency—
(i) be made available pursuant to any
State or local law requiring disclosure of
information or records;
(ii) otherwise be disclosed or distrib-
uted to any party by said State or local
government or government agency without
the written consent of the person or entity
submitting such information; or
(iii) be used other than for the purpose
of protecting critical infrastructure or pro-
tected systems, or in furtherance of an in-
vestigation or the prosecution of a criminal
act; and
(F) does not constitute a waiver of any ap-
plicable privilege or protection provided under
law, such as trade secret protection.
(2) EXPRESS
STATEMENT.—For purposes of
paragraph (1), the term ‘‘express statement’’, with re-
spect to information or records, means—
(A) in the case of written information or
records, a written marking on the information or
records substantially similar to the following:
‘‘This information is voluntarily submitted to
†
HR 5005 EAS
the Federal Government in expectation of protec-
tion from disclosure as provided by the provi-
sions of the Critical Infrastructure Information
Act of 2002.’’; or
(B) in the case of oral information, a simi-
lar written statement submitted within a reason-
able period following the oral communication.
(b) LIMITATION.—No communication of critical infra-
structure information to a covered Federal agency made
pursuant to this subtitle shall be considered to be an action
subject to the requirements of the Federal Advisory Com-
mittee Act (5 U.S.C. App. 2).
(c) INDEPENDENTLY OBTAINED INFORMATION.—Noth-
ing in this section shall be construed to limit or otherwise
affect the ability of a State, local, or Federal Government
entity, agency, or authority, or any third party, under ap-
plicable law, to obtain critical infrastructure information
in a manner not covered by subsection (a), including any
information lawfully and properly disclosed generally or
broadly to the public and to use such information in any
manner permitted by law.
(d) TREATMENT OF VOLUNTARY SUBMITTAL OF IN-
FORMATION.—The voluntary submittal to the Government
of information or records that are protected from disclosure
by this subtitle shall not be construed to constitute compli-
†
HR 5005 EAS
ance with any requirement to submit such information to
a Federal agency under any other provision of law.
(e) PROCEDURES.—
(1) IN GENERAL.—The Secretary of the Depart-
ment of Homeland Security shall, in consultation
with appropriate representatives of the National Se-
curity Council and the Office of Science and Tech-
nology Policy, establish uniform procedures for the re-
ceipt, care, and storage by Federal agencies of critical
infrastructure information that is voluntarily sub-
mitted to the Government. The procedures shall be es-
tablished not later than 90 days after the date of the
enactment of this subtitle.
(2) 
ELEMENTS.—The 
procedures 
established
under paragraph (1) shall include mechanisms
regarding—
(A) the acknowledgement of receipt by Fed-
eral agencies of critical infrastructure informa-
tion that is voluntarily submitted to the Govern-
ment;
(B) the maintenance of the identification of
such information as voluntarily submitted to the
Government for purposes of and subject to the
provisions of this subtitle;
†
HR 5005 EAS
(C) the care and storage of such informa-
tion; and
(D) the protection and maintenance of the
confidentiality of such information so as to per-
mit the sharing of such information within the
Federal Government and with State and local
governments, and the issuance of notices and
warnings related to the protection of critical in-
frastructure and protected systems, in such man-
ner as to protect from public disclosure the iden-
tity of the submitting person or entity, or infor-
mation that is proprietary, business sensitive, re-
lates specifically to the submitting person or en-
tity, and is otherwise not appropriately in the
public domain.
(f) PENALTIES.—Whoever, being an officer or employee
of the United States or of any department or agency thereof,
knowingly publishes, divulges, discloses, or makes known in
any manner or to any extent not authorized by law, any
critical infrastructure information protected from disclo-
sure by this subtitle coming to him in the course of this
employment or official duties or by reason of any examina-
tion or investigation made by, or return, report, or record
made to or filed with, such department or agency or officer
or employee thereof, shall be fined under title 18 of the
†
HR 5005 EAS
United States Code, imprisoned not more than 1 year, or
both, and shall be removed from office or employment.
(g) AUTHORITY TO ISSUE WARNINGS.—The Federal
Government may provide advisories, alerts, and warnings
to relevant companies, targeted sectors, other governmental
entities, or the general public regarding potential threats
to critical infrastructure as appropriate. In issuing a
warning, the Federal Government shall take appropriate
actions to protect from disclosure—
(1) the source of any voluntarily submitted crit-
ical infrastructure information that forms the basis
for the warning; or
(2) information that is proprietary, business sen-
sitive, relates specifically to the submitting person or
entity, or is otherwise not appropriately in the public
domain.
(h) AUTHORITY TO DELEGATE.—The President may
delegate authority to a critical infrastructure protection
program, designated under section 213, to enter into a vol-
untary agreement to promote critical infrastructure secu-
rity, including with any Information Sharing and Analysis
Organization, or a plan of action as otherwise defined in
section 708 of the Defense Production Act of 1950 (50
U.S.C. App. 2158).
†
HR 5005 EAS
SEC. 215. NO PRIVATE RIGHT OF ACTION.
Nothing in this subtitle may be construed to create a
private right of action for enforcement of any provision of
this Act.
Subtitle C—Information Security
SEC. 221. PROCEDURES FOR SHARING INFORMATION.
The Secretary shall establish procedures on the use of
information shared under this title that—
(1) limit the redissemination of such information
to ensure that it is not used for an unauthorized pur-
pose;
(2) ensure the security and confidentiality of
such information;
(3) protect the constitutional and statutory
rights of any individuals who are subjects of such in-
formation; and
(4) provide data integrity through the timely re-
moval and destruction of obsolete or erroneous names
and information.
SEC. 222. PRIVACY OFFICER.
The Secretary shall appoint a senior official in the De-
partment to assume primary responsibility for privacy pol-
icy, including—
(1) assuring that the use of technologies sustain,
and do not erode, privacy protections relating to the
use, collection, and disclosure of personal information;
†
HR 5005 EAS
(2) assuring that personal information contained
in Privacy Act systems of records is handled in full
compliance with fair information practices as set out
in the Privacy Act of 1974;
(3) evaluating legislative and regulatory pro-
posals involving collection, use, and disclosure of per-
sonal information by the Federal Government;
(4) conducting a privacy impact assessment of
proposed rules of the Department or that of the De-
partment on the privacy of personal information, in-
cluding the type of personal information collected and
the number of people affected; and
(5) preparing a report to Congress on an annual
basis on activities of the Department that affect pri-
vacy, including complaints of privacy violations, im-
plementation of the Privacy Act of 1974, internal
controls, and other matters.
SEC. 
223. 
ENHANCEMENT 
OF 
NON-FEDERAL
CYBERSECURITY.
In carrying out the responsibilities under section 201,
the Under Secretary for Information Analysis and Infra-
structure Protection shall—
(1) as appropriate, provide to State and local
government entities, and upon request to private enti-
†
HR 5005 EAS
ties that own or operate critical information
systems—
(A) analysis and warnings related to
threats to, and vulnerabilities of, critical infor-
mation systems; and
(B) in coordination with the Under Sec-
retary for Emergency Preparedness and Re-
sponse, crisis management support in response to
threats to, or attacks on, critical information
systems; and
(2) as appropriate, provide technical assistance,
upon request, to the private sector and other govern-
ment entities, in coordination with the Under Sec-
retary for Emergency Preparedness and Response,
with respect to emergency recovery plans to respond
to major failures of critical information systems.
SEC. 224. NET GUARD.
The Under Secretary for Information Analysis and In-
frastructure Protection may establish a national technology
guard, to be known as ‘‘NET Guard’’, comprised of local
teams of volunteers with expertise in relevant areas of
science and technology, to assist local communities to re-
spond and recover from attacks on information systems and
communications networks.
†
HR 5005 EAS
SEC. 225. CYBER SECURITY ENHANCEMENT ACT OF 2002.
(a) SHORT TITLE.—This section may be cited as the
‘‘Cyber Security Enhancement Act of 2002’’.
(b) AMENDMENT OF SENTENCING GUIDELINES RELAT-
ING TO CERTAIN COMPUTER CRIMES.—
(1) DIRECTIVE
TO
THE
UNITED
STATES
SEN-
TENCING
COMMISSION.—Pursuant to its authority
under section 994(p) of title 28, United States Code,
and in accordance with this subsection, the United
States Sentencing Commission shall review and, if
appropriate, amend its guidelines and its policy
statements applicable to persons convicted of an of-
fense under section 1030 of title 18, United States
Code.
(2) REQUIREMENTS.—In carrying out this sub-
section, the Sentencing Commission shall—
(A) ensure that the sentencing guidelines
and policy statements reflect the serious nature
of the offenses described in paragraph (1), the
growing incidence of such offenses, and the need
for an effective deterrent and appropriate pun-
ishment to prevent such offenses;
(B) consider the following factors and the
extent to which the guidelines may or may not
account for them—
†
HR 5005 EAS
(i) the potential and actual loss result-
ing from the offense;
(ii) the level of sophistication and
planning involved in the offense;
(iii) whether the offense was committed
for purposes of commercial advantage or
private financial benefit;
(iv) whether the defendant acted with
malicious intent to cause harm in commit-
ting the offense;
(v) the extent to which the offense vio-
lated the privacy rights of individuals
harmed;
(vi) whether the offense involved a com-
puter used by the government in furtherance
of national defense, national security, or the
administration of justice;
(vii) whether the violation was in-
tended to or had the effect of significantly
interfering with or disrupting a critical in-
frastructure; and
(viii) whether the violation was in-
tended to or had the effect of creating a
threat to public health or safety, or injury
to any person;
†
HR 5005 EAS
(C) assure reasonable consistency with other
relevant directives and with other sentencing
guidelines;
(D) account for any additional aggravating
or mitigating circumstances that might justify
exceptions to the generally applicable sentencing
ranges;
(E) make any necessary conforming changes
to the sentencing guidelines; and
(F) assure that the guidelines adequately
meet the purposes of sentencing as set forth in
section 3553(a)(2) of title 18, United States
Code.
(c) STUDY AND REPORT ON COMPUTER CRIMES.—Not
later than May 1, 2003, the United States Sentencing Com-
mission shall submit a brief report to Congress that ex-
plains any actions taken by the Sentencing Commission in
response to this section and includes any recommendations
the Commission may have regarding statutory penalties for
offenses under section 1030 of title 18, United States Code.
(d) EMERGENCY DISCLOSURE EXCEPTION.—
(1) IN GENERAL.—Section 2702(b) of title 18,
United States Code, is amended—
(A) in paragraph (5), by striking ‘‘or’’ at
the end;
†
HR 5005 EAS
(B) in paragraph (6)(A), by inserting ‘‘or’’
at the end;
(C) by striking paragraph (6)(C); and
(D) by adding at the end the following:
‘‘(7) to a Federal, State, or local governmental
entity, if the provider, in good faith, believes that an
emergency involving danger of death or serious phys-
ical injury to any person requires disclosure without
delay of communications relating to the emergency.’’.
(2) REPORTING
OF
DISCLOSURES.—A govern-
ment entity that receives a disclosure under section
2702(b) of title 18, United States Code, shall file, not
later than 90 days after such disclosure, a report to
the Attorney General stating the paragraph of that
section under which the disclosure was made, the date
of the disclosure, the entity to which the disclosure
was made, the number of customers or subscribers to
whom the information disclosed pertained, and the
number of communications, if any, that were dis-
closed. The Attorney General shall publish all such re-
ports into a single report to be submitted to Congress
1 year after the date of enactment of this Act.
(e) GOOD FAITH EXCEPTION.—Section 2520(d)(3) of
title 18, United States Code, is amended by inserting ‘‘or
2511(2)(i)’’ after ‘‘2511(3)’’.