IIB
107TH CONGRESS
1ST SESSION
H. R. 1259
IN THE SENATE OF THE UNITED STATES
NOVEMBER 28, 2001
Received; read twice and referred to the Committee on Commerce, Science,
and Transportation
AN ACT
To amend the National Institute of Standards and Tech-
nology Act to enhance the ability of the National Insti-
tute of Standards and Technology to improve computer
security, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
HR 1259 RFS
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Computer Security En-
hancement Act of 2001’’.
SEC. 2. FINDINGS AND PURPOSES.
(a) FINDINGS.—The Congress finds the following:
(1) The National Institute of Standards and
Technology has responsibility for developing stand-
ards and guidelines needed to ensure the cost-effec-
tive security and privacy of sensitive information in
Federal computer systems.
(2) The Federal Government has an important
role in ensuring the protection of sensitive, but un-
classified, information controlled by Federal agen-
cies.
(3) Technology that is based on the application
of cryptography exists and can be readily provided
by private sector companies to ensure the confiden-
tiality, authenticity, and integrity of information as-
sociated with public and private activities.
(4) The development and use of encryption
technologies by industry should be driven by market
forces rather than by Government imposed require-
ments.
(b) PURPOSES.—The purposes of this Act are to—
(1) reinforce the role of the National Institute
of Standards and Technology in ensuring the secu-
HR 1259 RFS
rity of unclassified information in Federal computer
systems; and
(2) promote technology solutions based on pri-
vate sector offerings to protect the security of Fed-
eral computer systems.
SEC. 3. SECURITY OF FEDERAL COMPUTERS AND NET-
WORKS.
Section 20(b) of the National Institute of Standards
and Technology Act (15 U.S.C. 278g–3(b)) is amended—
(1) by redesignating paragraphs (4) and (5) as
paragraphs (7) and (8), respectively; and
(2) by inserting after paragraph (3) the fol-
lowing new paragraphs:
‘‘(4) except for national security systems, as de-
fined in section 5142 of Public Law 104-106 (40
U.S.C. 1452), to provide guidance and assistance to
Federal agencies for protecting the security and pri-
vacy of sensitive information in interconnected Fed-
eral computer systems, including identification of
significant risks thereto;
‘‘(5) to promote compliance by Federal agencies
with existing Federal computer information security
and privacy guidelines;
HR 1259 RFS
‘‘(6) in consultation with appropriate Federal
agencies, assist Federal response efforts related to
unauthorized access to Federal computer systems;’’.
SEC. 4. COMPUTER SECURITY IMPLEMENTATION.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3) is further amended—
(1) by redesignating subsections (c) and (d) as
subsections (e) and (f), respectively; and
(2) by inserting after subsection (b) the fol-
lowing new subsection:
‘‘(c)(1) In carrying out subsection (a)(2) and (3), the
Institute shall—
‘‘(A) emphasize the development of technology-
neutral policy guidelines for computer security and
electronic authentication practices by the Federal
agencies;
‘‘(B) promote the use of commercially available
products, which appear on the list required by para-
graph (2), to provide for the security and privacy of
sensitive information in Federal computer systems;
‘‘(C) develop qualitative and quantitative meas-
ures appropriate for assessing the quality and effec-
tiveness of information security and privacy pro-
grams at Federal agencies;
HR 1259 RFS
‘‘(D) upon the request of a Federal agency, per-
form evaluations to assess its existing information
security and privacy programs;
‘‘(E) promote development of accreditation pro-
cedures for Federal agencies based on the measures
developed under subparagraph (C);
‘‘(F) if requested, consult with and provide as-
sistance to Federal agencies regarding the selection
by agencies of security technologies and products
and the implementation of security practices; and
‘‘(G)(i) develop uniform testing procedures suit-
able for determining the conformance of commer-
cially available security products to the guidelines
and standards developed under subsection (a)(2) and
(3);
‘‘(ii) establish procedures for certification of
private sector laboratories to perform the tests and
evaluations of commercially available security prod-
ucts developed in accordance with clause (i); and
‘‘(iii) promote the testing of commercially avail-
able security products for their conformance with
guidelines and standards developed under subsection
(a)(2) and (3).
‘‘(2) The Institute shall maintain and make available
to Federal agencies and to the public a list of commercially
HR 1259 RFS
available security products that have been tested by pri-
vate sector laboratories certified in accordance with proce-
dures established under paragraph (1)(G)(ii), and that
have been found to be in conformance with the guidelines
and standards developed under subsection (a)(2) and (3).
‘‘(3) The Institute shall annually transmit to the
Congress, in an unclassified format, a report containing—
‘‘(A) the findings of the evaluations and tests of
Federal computer systems conducted under this sec-
tion during the 12 months preceding the date of the
report, including the frequency of the use of com-
mercially available security products included on the
list required by paragraph (2);
‘‘(B) the planned evaluations and tests under
this section for the 12 months following the date of
the report; and
‘‘(C) any recommendations by the Institute to
Federal agencies resulting from the findings de-
scribed in subparagraph (A), and the response by
the agencies to those recommendations.’’.
SEC. 5. COMPUTER SECURITY REVIEW, PUBLIC MEETINGS,
AND INFORMATION.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this
Act, is further amended by inserting after subsection (c),
HR 1259 RFS
as added by section 4 of this Act, the following new sub-
section:
‘‘(d)(1) The Institute shall solicit the recommenda-
tions of the Computer System Security and Privacy Advi-
sory Board, established by section 21, regarding standards
and guidelines that are being considered for submittal to
the Secretary in accordance with subsection (a)(4). The
recommendations of the Board shall accompany standards
and guidelines submitted to the Secretary.
‘‘(2) There are authorized to be appropriated to the
Secretary $1,030,000 for fiscal year 2002 and $1,060,000
for fiscal year 2003 to enable the Computer System Secu-
rity and Privacy Advisory Board, established by section
21, to identify emerging issues related to computer secu-
rity, privacy, and cryptography and to convene public
meetings on those subjects, receive presentations, and
publish reports, digests, and summaries for public dis-
tribution on those subjects.’’.
SEC. 6. LIMITATION ON PARTICIPATION IN REQUIRING
ENCRYPTION 
AND 
ELECTRONIC 
AUTHEN-
TICATION STANDARDS.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this
Act, is further amended by adding at the end the following
new subsection:
HR 1259 RFS
‘‘(g) The Institute shall not promulgate, enforce, or
otherwise adopt standards or policies for the Federal es-
tablishment of encryption and electronic authentication
standards required for use in computer systems other than
Federal Government computer systems.’’.
SEC. 7. MISCELLANEOUS AMENDMENTS.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this
Act, is further amended—
(1) in subsection (b)(8), as so redesignated by
section 3(1) of this Act, by inserting ‘‘to the extent
that such coordination will improve computer secu-
rity and to the extent necessary for improving such
security for Federal computer systems’’ after ‘‘Man-
agement and Budget)’’;
(2) in subsection (e), as so redesignated by sec-
tion 4(1) of this Act, by striking ‘‘shall draw upon’’
and inserting in lieu thereof ‘‘may draw upon’’;
(3) in subsection (e)(2), as so redesignated by
section 4(1) of this Act, by striking ‘‘(b)(5)’’ and in-
serting in lieu thereof ‘‘(b)(7)’’; and
(4) in subsection (f)(1)(B)(i), as so redesig-
nated by section 4(1) of this Act, by inserting ‘‘and
computer networks’’ after ‘‘computers’’.
HR 1259 RFS
SEC. 8. FEDERAL COMPUTER SYSTEM SECURITY TRAINING.
Section 5(b) of the Computer Security Act of 1987
(40 U.S.C. 759 note) is amended—
(1) by striking ‘‘and’’ at the end of paragraph
(1);
(2) by striking the period at the end of para-
graph (2) and inserting in lieu thereof ‘‘; and’’; and
(3) by adding at the end the following new
paragraph:
‘‘(3) to include emphasis on protecting informa-
tion in Federal databases and Federal computer
sites that are accessible through public networks.’’.
SEC. 9. COMPUTER SECURITY FELLOWSHIP PROGRAM.
There are authorized to be appropriated to the Sec-
retary of Commerce $5,000,000 for fiscal year 2002 and
$5,000,000 for fiscal year 2003 for the Director of the
National Institute of Standards and Technology for fellow-
ships, subject to the provisions of section 18 of the Na-
tional Institute of Standards and Technology Act (15
U.S.C. 278g–1), to support students at institutions of
higher learning in computer security. Amounts authorized
by this section shall not be subject to the percentage limi-
tation stated in such section 18.
HR 1259 RFS
SEC. 10. STUDY OF ELECTRONIC AUTHENTICATION TECH-
NOLOGIES BY THE NATIONAL RESEARCH
COUNCIL.
(a) REVIEW BY NATIONAL RESEARCH COUNCIL.—
Not later than 90 days after the date of the enactment
of this Act, the Secretary of Commerce shall enter into
a contract with the National Research Council of the Na-
tional Academy of Sciences to conduct a study of elec-
tronic authentication technologies for use by individuals,
businesses, and government.
(b) CONTENTS.—The study referred to in subsection
(a) shall—
(1) assess technology needed to support elec-
tronic authentication technologies;
(2) assess current public and private plans for
the deployment of electronic authentication tech-
nologies;
(3) assess interoperability, scalability, and in-
tegrity of private and public entities that are ele-
ments of electronic authentication technologies; and
(4) address such other matters as the National
Research Council considers relevant to the issues of
electronic authentication technologies.
(c) INTERAGENCY COOPERATION WITH STUDY.—All
agencies of the Federal Government shall cooperate fully
with the National Research Council in its activities in car-
HR 1259 RFS
rying out the study under this section, including access
by properly cleared individuals to classified information if
necessary.
(d) REPORT.—Not later than 18 months after the
date of the enactment of this Act, the Secretary of Com-
merce shall transmit to the Committee on Science of the
House of Representatives and the Committee on Com-
merce, Science, and Transportation of the Senate a report
setting forth the findings, conclusions, and recommenda-
tions of the National Research Council for public policy
related to electronic authentication technologies for use by
individuals, businesses, and government. The National Re-
search Council shall not recommend the implementation
or application of a specific electronic authentication tech-
nology or electronic authentication technical specification
for use by the Federal Government. Such report shall be
submitted in unclassified form.
(e) AUTHORIZATION
OF APPROPRIATIONS.—There
are authorized to be appropriated to the Secretary of Com-
merce $450,000 for fiscal year 2002, to remain available
until expended, for carrying out this section.
SEC. 11. PROMOTION OF NATIONAL INFORMATION SECU-
RITY.
The Under Secretary of Commerce for Technology
shall—
HR 1259 RFS
(1) promote an increased use of security tech-
niques, such as risk assessment, and security tools,
such as cryptography, to enhance the protection of
the Nation’s information infrastructure;
(2) establish a central repository of information
for dissemination to the public to promote awareness
of information security vulnerabilities and risks; and
(3) in a manner consistent with section 12(d) of
the National Technology Transfer and Advancement
Act of 1995 (15 U.S.C. 272 nt), promote the devel-
opment of national standards-based infrastructures
needed to support government, commercial, and pri-
vate uses of encryption technologies for confiden-
tiality and authentication.
SEC. 12. ELECTRONIC AUTHENTICATION INFRASTRUC-
TURES.
(a) ELECTRONIC
AUTHENTICATION
INFRASTRUC-
TURES.—
(1) TECHNOLOGY-NEUTRAL
GUIDELINES
AND
STANDARDS.—Not later than 18 months after the
date of the enactment of this Act, the Director, in
consultation with industry and appropriate Federal
agencies, shall develop technology-neutral guidelines
and standards, or adopt existing technology-neutral
industry guidelines and standards, for electronic au-
HR 1259 RFS
thentication infrastructures to be made available to
Federal agencies so that such agencies may effec-
tively select and utilize electronic authentication
technologies in a manner that is—
(A) adequately secure to meet the needs of
those agencies and their transaction partners;
and
(B) interoperable, to the maximum extent
possible.
(2) ELEMENTS.—The guidelines and standards
developed under paragraph (1) shall include—
(A) protection profiles for cryptographic
and noncryptographic methods of authen-
ticating identity for electronic authentication
products and services;
(B) a core set of interoperability specifica-
tions for the use of electronic authentication
products and services in electronic transactions
between Federal agencies and their transaction
partners; and
(C) validation criteria to enable Federal
agencies to select cryptographic electronic au-
thentication products and services appropriate
to their needs.
HR 1259 RFS
(3) REVISIONS.—The Director shall periodically
review the guidelines and standards developed under
paragraph (1) and revise them as appropriate.
(b) LISTING
OF PRODUCTS.—Not later than 30
months after the date of the enactment of this Act, and
thereafter, the Director shall maintain and make available
to Federal agencies a nonmandatory list of commercially
available electronic authentication products, and other
such products used by Federal agencies, evaluated as con-
forming with the guidelines and standards developed
under subsection (a).
(c) SPECIFICATIONS
FOR
ELECTRONIC
CERTIFI-
CATION AND MANAGEMENT TECHNOLOGIES.—
(1) SPECIFICATIONS.—The Director shall, as
appropriate, establish core specifications for par-
ticular electronic certification and management tech-
nologies, or their components, for use by Federal
agencies.
(2) EVALUATION.—The Director shall advise
Federal agencies on how to evaluate the conform-
ance with the specifications established under para-
graph (1) of electronic certification and management
technologies, developed for use by Federal agencies
or available for such use.
HR 1259 RFS
(3) MAINTENANCE
OF
LIST.—The Director
shall maintain and make available to Federal agen-
cies a list of electronic certification and management
technologies evaluated as conforming to the speci-
fications established under paragraph (1).
(d) REPORTS.—Not later than 18 months after the
date of the enactment of this Act, and annually thereafter,
the Director shall transmit to the Congress a report that
includes—
(1) a description and analysis of the utilization
by Federal agencies of electronic authentication
technologies; and
(2) a description and analysis regarding the
problems Federal agencies are having, and the
progress such agencies are making, in implementing
electronic authentication infrastructures.
(e) DEFINITIONS.—For purposes of this section—
(1) the term ‘‘electronic authentication’’ means
cryptographic or noncryptographic methods of au-
thenticating identity in an electronic communication;
(2) the term ‘‘electronic authentication infra-
structure’’ means the software, hardware, and per-
sonnel resources, and the procedures, required to ef-
fectively 
utilize 
electronic 
authentication 
tech-
nologies;
HR 1259 RFS
(3) the term ‘‘electronic certification and man-
agement technologies’’ means computer systems, in-
cluding associated personnel and procedures, that
enable individuals to apply electronic authentication
to electronic information; and
(4) the term ‘‘protection profile’’ means a list of
security functions and associated assurance levels
used to describe a product.
SEC. 13. SOURCE OF AUTHORIZATIONS.
There are authorized to be appropriated to the Sec-
retary of Commerce $7,000,000 for fiscal year 2002 and
$8,000,000 for fiscal year 2003, for the National Institute
of Standards and Technology to carry out activities au-
thorized by this Act for which funds are not otherwise spe-
cifically authorized to be appropriated by this Act.
Passed the House of Representatives November 27,
2001.
Attest:
JEFF TRANDAHL,
Clerk.