I 
108TH CONGRESS 
2D SESSION 
H. R. 5068
To amend the Homeland Security Act of 2002 to enhance cybersecurity, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 13, 2004
Mr. THORNBERRY (for himself and Ms. LOFGREN) introduced the following 
bill; which was referred to the Select Committee on Homeland Security, 
and in addition to the Committee on Science, for a period to be subse-
quently determined by the Speaker, in each case for consideration of such 
provisions as fall within the jurisdiction of the committee concerned 
A BILL 
To amend the Homeland Security Act of 2002 to enhance 
cybersecurity, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Department of Home-
land Security Cybersecurity Enhancement Act of 2004’’. 
SEC. 2. ASSISTANT SECRETARY FOR CYBERSECURITY. 
(a) IN GENERAL.—Subtitle A of title II of the Home-
land Security Act of 2002 (6 U.S.C. 121 et seq.) is amend-
ed by adding at the end the following:
‘‘SEC. 203. ASSISTANT SECRETARY FOR CYBERSECURITY. 
‘‘(a) IN GENERAL.—There shall be in the Directorate 
for Information Analysis and Infrastructure Protection a 
National Cybersecurity Office headed by an Assistant Sec-
retary for Cybersecurity (in this section referred to as the 
‘Assistant Secretary’), who shall assist the Secretary in 
promoting cybersecurity for the Nation. 
‘‘(b) GENERAL AUTHORITY.—The Assistant Sec-
retary, subject to the direction and control of the Sec-
retary, shall have primary authority within the Depart-
ment for all cybersecurity-related critical infrastructure 
protection programs of the Department, including with re-
spect to policy formulation and program management. 
‘‘(c) RESPONSIBILITIES.—The responsibilities of the 
Assistant Secretary shall include the following: 
‘‘(1) To establish and manage—
‘‘(A) a national cybersecurity response sys-
tem that includes the ability to—
‘‘(i) analyze the effect of cybersecurity 
threat information on national critical in-
frastructure; and 
‘‘(ii) aid in the detection and warning 
of attacks on, and in the restoration of, 
cybersecurity infrastructure in the after-
math of such attacks;
‘‘(B) a national cybersecurity threat and 
vulnerability reduction program that identifies 
cybersecurity vulnerabilities that would have a 
national effect on critical infrastructure, per-
forms vulnerability assessments on information 
technologies, and coordinates the mitigation of 
such vulnerabilities; 
‘‘(C) a national cybersecurity awareness 
and 
training 
program 
that 
promotes 
cybersecurity awareness among the public and 
the private sectors and promotes cybersecurity 
training and education programs; 
‘‘(D) a government cybersecurity program 
to coordinate and consult with Federal, State, 
and 
local 
governments 
to 
enhance 
their 
cybersecurity programs; and 
‘‘(E) a national security and international 
cybersecurity cooperation program to help fos-
ter Federal efforts to enhance international 
cybersecurity awareness and cooperation. 
‘‘(2) To coordinate with the private sector on 
the program under paragraph (1) as appropriate, 
and to promote cybersecurity information sharing, 
vulnerability assessment, and threat warning regard-
ing critical infrastructure.
‘‘(3) To coordinate with other directorates and 
offices within the Department on the cybersecurity 
aspects of their missions. 
‘‘(4) To coordinate with the Under Secretary 
for Emergency Preparedness and Response to en-
sure that the National Response Plan developed pur-
suant to section 502(6) of the Homeland Security 
Act of 2002 (6 U.S.C. 312(6)) includes appropriate 
measures for the recovery of the cybersecurity ele-
ments of critical infrastructure. 
‘‘(5) To develop processes for information shar-
ing with the private sector, consistent with section 
214, that—
‘‘(A) promote voluntary cybersecurity best 
practices, standards, and benchmarks that are 
responsive to rapid technology changes and to 
the security needs of critical infrastructure; and 
‘‘(B) consider roles of Federal, State, local, 
and foreign governments and the private sector, 
including the insurance industry and auditors. 
‘‘(6) To coordinate with the Chief Information 
Officer of the Department in establishing a secure 
information sharing architecture and information 
sharing processes, including with respect to the De-
partment’s operation centers.
‘‘(7) To consult with the Electronic Crimes 
Task Force of the United States Secret Service on 
private sector outreach and information activities. 
‘‘(8) To consult with the Office for Domestic 
Preparedness to ensure that realistic cybersecurity 
scenarios are incorporated into tabletop and recovery 
exercises. 
‘‘(9) To consult and coordinate, as appropriate, 
with other Federal agencies on cybersecurity-related 
programs, policies, and operations. 
‘‘(10) To consult and coordinate within the De-
partment and, where appropriate, with other rel-
evant Federal agencies, on security of digital control 
systems, such as Supervisory Control and Data Ac-
quisition (SCADA) systems. 
‘‘(d) AUTHORITY OVER THE NATIONAL COMMUNICA-
TIONS SYSTEM.—The Assistant Secretary shall have pri-
mary authority within the Department over the National 
Communications System.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of such Act is amended by adding at the 
end of the items relating to subtitle A of title II the fol-
lowing:
‘‘203. Assistant Secretary for Cybersecurity.’’.
SEC. 3. CYBERSECURITY DEFINED. 
Section 2 of the Homeland Security Act of 2002 (6 
U.S.C. 101) is amended by adding at the end the fol-
lowing: 
‘‘(17)(A) The term ‘cybersecurity’ means the 
prevention of damage to, the protection of, and the 
restoration of computers, electronic communications 
systems, electronic communication services, wire 
communication, and electronic communication, in-
cluding information contained therein, to ensure its 
availability, integrity, authentication, confidentiality, 
and nonrepudiation. 
‘‘(B) In this paragraph—
‘‘(i) each of the terms ‘damage’ and ‘com-
puter’ has the meaning that term has in section 
1030 of title 18, United States Code; and 
‘‘(ii) each of the terms ‘electronic commu-
nications system’, ‘electronic communication 
service’, ‘wire communication’, and ‘electronic 
communication’ has the meaning that term has 
in section 2510 of title 18, United States 
Code.’’.
Æ