I
105TH CONGRESS
1ST SESSION
H. R. 1903
To amend the National Institute of Standards and Technology Act to enhance
the ability of the National Institute of Standards and Technology to
improve computer security, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
JUNE 17, 1997
Mr. SENSENBRENNER (for himself, Mr. BROWN of California, Mrs. MORELLA,
Mr. GORDON, Mr. DAVIS of Virginia, Ms. STABENOW, Mr. EHLERS, Ms.
JACKSON-LEE of Texas, Mr. SESSIONS, Mr. PICKERING, Mr. TRAFICANT,
Mr. COOK, and Mr. CANNON) introduced the following bill; which was re-
ferred to the Committee on Science
A BILL
To amend the National Institute of Standards and Tech-
nology Act to enhance the ability of the National Insti-
tute of Standards and Technology to improve computer
security, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Computer Security
Enhancement Act of 1997’’.
SEC. 2. FINDINGS AND PURPOSES.
(a) FINDINGS.—The Congress finds the following:
HR 1903 IH
(1) The National Institute of Standards and
Technology has responsibility for developing stand-
ards and guidelines needed to ensure the cost-effec-
tive security and privacy of sensitive information in
Federal computer systems.
(2) The Federal Government has an important
role in ensuring the protection of sensitive, but un-
classified, information controlled by Federal agen-
cies.
(3) Technology that is based on the application
of cryptography exists and can be readily provided
by private sector companies to ensure the confiden-
tiality, authenticity, and integrity of information
associated with public and private activities.
(4) The development and use of encryption
technologies should be driven by market forces rath-
er than by Government imposed requirements.
(5) Federal policy for control of the export of
encryption technologies should be determined in
light of the public availability of comparable
encryption technologies outside of the United States
in order to avoid harming the competitiveness of
United States computer hardware and software com-
panies.
(b) PURPOSES.—The purposes of this Act are to—
HR 1903 IH
(1) reinforce the role of the National Institute
of Standards and Technology in ensuring the secu-
rity of unclassified information in Federal computer
systems;
(2) promote technology solutions based on pri-
vate sector offerings to protect the security of Fed-
eral computer systems; and
(3) provide the assessment of the capabilities of
information security products incorporating cryptog-
raphy that are generally available outside the United
States.
SEC. 3. VOLUNTARY STANDARDS FOR PUBLIC KEY MAN-
AGEMENT INFRASTRUCTURE.
Section 20(b) of the National Institute of Standards
and Technology Act (15 U.S.C. 278g–3(b)) is amended—
(1) by redesignating paragraphs (2), (3), (4),
and (5) as paragraphs (3), (4), (7), and (8), respec-
tively; and
(2) by inserting after paragraph (1) the follow-
ing new paragraph:
‘‘(2) upon request from the private sector, to
assist in establishing voluntary interoperable stand-
ards, guidelines, and associated methods and tech-
niques to facilitate and expedite the establishment of
non-Federal management infrastructures for public
HR 1903 IH
keys that can be used to communicate with and con-
duct transactions with the Federal Government;’’.
SEC. 4. SECURITY OF FEDERAL COMPUTERS AND NET-
WORKS.
Section 20(b) of the National Institute of Standards
and Technology Act (15 U.S.C. 278g–3(b)), as amended
by section 3 of this Act, is further amended by inserting
after paragraph (4), as so redesignated by section 3(1)
of this Act, the following new paragraphs:
‘‘(5) to provide guidance and assistance to Fed-
eral agencies in the protection of interconnected
computer systems and to coordinate Federal re-
sponse efforts related to unauthorized access to Fed-
eral computer systems;
‘‘(6) to perform evaluations and tests of—
‘‘(A) information technologies to assess
security vulnerabilities; and
‘‘(B) commercially available security prod-
ucts for their suitability for use by Federal
agencies for protecting sensitive information in
computer systems;’’.
SEC. 5. COMPUTER SECURITY IMPLEMENTATION.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3) is further amended—
HR 1903 IH
(1) by redesignating subsections (c) and (d) as
subsections (f) and (g), respectively; and
(2) by inserting after subsection (b) the follow-
ing new subsection:
‘‘(c) In carrying out subsection (a)(3), the Institute
shall—
‘‘(1) emphasize the development of technology-
neutral policy guidelines for computer security prac-
tices by the Federal agencies;
‘‘(2) actively promote the use of commercially
available products to provide for the security and
privacy of sensitive information in Federal computer
systems; and
‘‘(3) 
participate 
in 
implementations 
of
encryption technologies in order to develop required
standards and guidelines for Federal computer sys-
tems, including assessing the desirability of and the
costs associated with establishing and managing key
recovery infrastructures for Federal Government in-
formation.’’.
SEC. 6. COMPUTER SECURITY REVIEW, PUBLIC MEETINGS,
AND INFORMATION.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this
Act, is further amended by inserting after subsection (c),
HR 1903 IH
as added by section 5 of this Act, the following new sub-
section:
‘‘(d)(1) The Institute shall solicit the recommenda-
tions of the Computer System Security and Privacy Advi-
sory Board, established by section 21, regarding standards
and guidelines that are being considered for submittal to
the Secretary of Commerce in accordance with subsection
(a)(4). No standards or guidelines shall be submitted to
the Secretary prior to the receipt by the Institute of the
Board’s written recommendations. The recommendations
of the Board shall accompany standards and guidelines
submitted to the Secretary.
‘‘(2) There are authorized to be appropriated to the
Secretary of Commerce $1,000,000 for fiscal year 1998
and $1,030,000 for fiscal year 1999 to enable the Com-
puter System Security and Privacy Advisory Board, estab-
lished by section 21, to identify emerging issues related
to computer security, privacy, and cryptography and to
convene public meetings on those subjects, receive presen-
tations, and publish reports, digests, and summaries for
public distribution on those subjects.’’.
SEC. 7. EVALUATION OF CAPABILITIES OF FOREIGN
ENCRYPTION.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this
HR 1903 IH
Act, is further amended by inserting after subsection (d),
as added by section 6 of this Act, the following new sub-
section:
‘‘(e)(1) If the Secretary has imposed, or proposes to
impose, export restrictions on a product that incorporates
encryption technologies, the Institute may accept technical
evidence from the commercial provider of the product of-
fered to indicate that encryption technologies, embodied
in the form of software or hardware, that are offered and
generally available outside the United States for use, sale,
license, or transfer (whether for consideration or not) pro-
vide stronger participation for privacy of computer data
and transmissions of information in digital form than the
encryption technologies incorporated in the commercial
provider’s product.
‘‘(2) Within 30 days after accepting technical evi-
dence from a commercial provider under paragraph (1),
the Institute shall evaluate the accuracy and completeness
of the technical evidence and transmit to the Secretary,
and to the Committee on Science of the House of Rep-
resentatives and the Committee on Commerce, Science,
and Transportation of the Senate, a report containing the
results of that evaluation. The Institute may obtain assist-
ance from other Federal and private sector entities in car-
rying out evaluations under this paragraph.
HR 1903 IH
‘‘(3) Not later than 180 days after the date of the
enactment of the Computer Security Enhancement Act of
1997, the Institute shall develop standard procedures and
tests for determining the capabilities of encryption tech-
nologies, and shall provide information regarding those
procedures and tests to the public.
‘‘(4) The Institute may require a commercial provider
seeking evaluation under this subsection to follow proce-
dures and carry out tests developed by the Institute pursu-
ant to paragraph (3).’’.
SEC. 8. LIMITATION ON PARTICIPATION IN REQUIRING
ENCRYPTION STANDARDS.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this
Act, is further amended by adding at the end the following
new subsection:
‘‘(h) The Institute shall not promulgate, enforce, or
otherwise adopt standards, or carry out activities or poli-
cies, for the Federal establishment of encryption standards
required for use in computer systems other than Federal
Government computer systems.’’.
SEC. 9. MISCELLANEOUS AMENDMENTS.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this
Act, is further amended—
HR 1903 IH
(1) in subsection (b)(8), as so redesignated by
section 3(1) of this Act, by inserting ‘‘to the extent
that such coordination will improve computer secu-
rity and to the extent necessary for improving such
security for Federal computer systems’’ after ‘‘Man-
agement and Budget)’’;
(2) in subsection (f), as so redesignated by sec-
tion 5(1) of this Act, by striking ‘‘shall draw upon’’
and inserting in lieu thereof ‘‘may draw upon’’;
(3) in subsection (f)(2), as so redesignated by
section 5(1) of this Act, by striking ‘‘(b)(5)’’ and in-
serting in lieu thereof ‘‘(b)(5)’’; and
(4) in subsection (g)(1)(B)(i), as so redesig-
nated by section 5(1) of this Act, by inserting ‘‘and
computer networks’’ after ‘‘computers’’.
SEC. 10. FEDERAL COMPUTER SYSTEM SECURITY TRAIN-
ING.
Section 5(b) of the Computer Security Act of 1987
(49 U.S.C. 759 note) is amended—
(1) by striking ‘‘and’’ at the end of paragraph
(1);
(2) by striking the period at the end of para-
graph (2) and inserting in lieu thereof ‘‘; and’’; and
(3) by adding at the end the following new
paragraph:
HR 1903 IH
‘‘(3) to include emphasis on protecting sensitive
information in Federal databases and Federal com-
puter sites that are accessible through public net-
works.’’.
SEC. 11. COMPUTER SECURITY FELLOWSHIP PROGRAM.
There are authorized to be appropriated to the Sec-
retary of Commerce $250,000 for fiscal year 1998 and
$250,000 for fiscal year 1999 for the Director of the Na-
tional Institute of Standards and Technology for fellow-
ships, subject to the provisions of section 18 of the Na-
tional Institute of Standards and Technology Act (15
U.S.C. 278g–1), to support students at institutions of
higher learning in computer security. Amounts authorized
by this section shall not be subject to the percentage limi-
tation stated in such section 18.
SEC. 12. STUDY OF PUBLIC KEY INFRASTRUCTURE BY THE
NATIONAL RESEARCH COUNCIL.
(a) REVIEW BY NATIONAL RESEARCH COUNCIL.—
Not later than 90 days after the date of the enactment
of this Act, the Secretary of Commerce shall enter into
a contract with the National Research Council of the Na-
tional Academy of Sciences to conduct a study of public
key infrastructures for use by individuals, businesses, and
government.
HR 1903 IH
(b) CONTENTS.—The study referred to in subsection
(a) shall—
(1) assess technology needed to support public
key infrastructures;
(2) assess current public and private plans for
the deployment of public key infrastructures;
(3) assess interoperability, scalability, and in-
tegrity of private and public entities that are ele-
ments of public key infrastructures;
(4) make recommendations for Federal legisla-
tion and other Federal actions required to ensure
the national feasibility and utility of public key in-
frastructures; and
(5) address such other matters as the National
Research Council considers relevant to the issues of
public key infrastructure.
(c) INTERAGENCY COOPERATION WITH STUDY.—All
agencies of the Federal Government shall cooperate fully
with the National Research Council in its activities in car-
rying out the study under this section, including access
by properly cleared individuals to classified information if
necessary.
(d) REPORT.—Not later than 18 months after the
date of the enactment of this Act, the Secretary of Com-
merce shall transmit to the Committee on Science of the
HR 1903 IH
House of Representatives and the Committee on Com-
merce, Science, and Transportation of the Senate a report
setting forth the findings, conclusions, and recommenda-
tions of the National Research Council for public policy
related to public key infrastructures for use by individuals,
businesses, and government. Such report shall be submit-
ted in unclassified form.
(e) AUTHORIZATION
OF APPROPRIATIONS.—There
are authorized to be appropriated to the Secretary of Com-
merce $450,000 for fiscal year 1998, to remain available
until expended, for carrying out this section.
SEC. 13. SOURCE OF AUTHORIZATIONS.
Amounts authorized to be appropriated by this Act
shall be derived from amounts authorized under the Na-
tional Institute of Standards and Technology Authoriza-
tion Act of 1997.
Æ