†
279
HR 5005 EAS
(2) serve as the United States Interdiction Coor-
dinator for the Director of National Drug Control
Policy.
SEC. 879. OFFICE OF INTERNATIONAL AFFAIRS.
(a) ESTABLISHMENT.—There is established within the
Office of the Secretary an Office of International Affairs.
The Office shall be headed by a Director, who shall be a
senior official appointed by the Secretary.
(b) DUTIES OF THE DIRECTOR.—The Director shall
have the following duties:
(1) To promote information and education ex-
change with nations friendly to the United States in
order to promote sharing of best practices and tech-
nologies relating to homeland security. Such exchange
shall include the following:
(A) Exchange of information on research
and development on homeland security tech-
nologies.
(B) Joint training exercises of first respond-
ers.
(C) Exchange of expertise on terrorism pre-
vention, response, and crisis management.
(2) To identify areas for homeland security in-
formation and training exchange where the United
States has a demonstrated weakness and another
†
280
HR 5005 EAS
friendly nation or nations have a demonstrated exper-
tise.
(3) To plan and undertake international con-
ferences, exchange programs, and training activities.
(4) To manage international activities within
the Department in coordination with other Federal
officials with responsibility for counter-terrorism
matters.
SEC. 880. PROHIBITION OF THE TERRORISM INFORMATION
AND PREVENTION SYSTEM.
Any and all activities of the Federal Government to
implement the proposed component program of the Citizen
Corps known as Operation TIPS (Terrorism Information
and Prevention System) are hereby prohibited.
SEC. 881. REVIEW OF PAY AND BENEFIT PLANS.
Notwithstanding any other provision of this Act, the
Secretary shall, in consultation with the Director of the Of-
fice of Personnel Management, review the pay and benefit
plans of each agency whose functions are transferred under
this Act to the Department and, within 90 days after the
date of enactment, submit a plan to the President of the
Senate and the Speaker of the House of Representatives and
the appropriate committees and subcommittees of Congress,
for ensuring, to the maximum extent practicable, the elimi-
nation of disparities in pay and benefits throughout the De-
†
281
HR 5005 EAS
partment, especially among law enforcement personnel, that
are inconsistent with merit system principles set forth in
section 2301 of title 5, United States Code.
SEC. 882. OFFICE FOR NATIONAL CAPITAL REGION COORDI-
NATION.
(a) ESTABLISHMENT.—
(1) IN GENERAL.—There is established within
the Office of the Secretary the Office of National Cap-
ital Region Coordination, to oversee and coordinate
Federal programs for and relationships with State,
local, and regional authorities in the National Cap-
ital Region, as defined under section 2674(f)(2) of
title 10, United States Code.
(2) DIRECTOR.—The Office established under
paragraph (1) shall be headed by a Director, who
shall be appointed by the Secretary.
(3) COOPERATION.—The Secretary shall cooper-
ate with the Mayor of the District of Columbia, the
Governors of Maryland and Virginia, and other
State, local, and regional officers in the National
Capital Region to integrate the District of Columbia,
Maryland, and Virginia into the planning, coordina-
tion, and execution of the activities of the Federal
Government for the enhancement of domestic pre-
†
282
HR 5005 EAS
paredness against the consequences of terrorist at-
tacks.
(b) RESPONSIBILITIES.—The Office established under
subsection (a)(1) shall—
(1) coordinate the activities of the Department
relating to the National Capital Region, including co-
operation with the Office for State and Local Govern-
ment Coordination;
(2) assess, and advocate for, the resources needed
by State, local, and regional authorities in the Na-
tional Capital Region to implement efforts to secure
the homeland;
(3) provide State, local, and regional authorities
in the National Capital Region with regular informa-
tion, research, and technical support to assist the ef-
forts of State, local, and regional authorities in the
National Capital Region in securing the homeland;
(4) develop a process for receiving meaningful
input from State, local, and regional authorities and
the private sector in the National Capital Region to
assist in the development of the homeland security
plans and activities of the Federal Government;
(5) coordinate with Federal agencies in the Na-
tional Capital Region on terrorism preparedness, to
ensure adequate planning, information sharing,
†
283
HR 5005 EAS
training, and execution of the Federal role in domes-
tic preparedness activities;
(6) coordinate with Federal, State, local, and re-
gional agencies, and the private sector in the National
Capital Region on terrorism preparedness to ensure
adequate planning, information sharing, training,
and execution of domestic preparedness activities
among these agencies and entities; and
(7) serve as a liaison between the Federal Gov-
ernment and State, local, and regional authorities,
and private sector entities in the National Capital
Region to facilitate access to Federal grants and other
programs.
(c) ANNUAL REPORT.—The Office established under
subsection (a) shall submit an annual report to Congress
that includes—
(1) the identification of the resources required to
fully implement homeland security efforts in the Na-
tional Capital Region;
(2) an assessment of the progress made by the
National Capital Region in implementing homeland
security efforts; and
(3) recommendations to Congress regarding the
additional resources needed to fully implement home-
land security efforts in the National Capital Region.
†
284
HR 5005 EAS
(d) LIMITATION.—Nothing contained in this section
shall be construed as limiting the power of State and local
governments.
SEC. 883. REQUIREMENT TO COMPLY WITH LAWS PRO-
TECTING 
EQUAL 
EMPLOYMENT 
OPPOR-
TUNITY AND PROVIDING WHISTLEBLOWER
PROTECTIONS.
Nothing in this Act shall be construed as exempting
the Department from requirements applicable with respect
to executive agencies—
(1) to provide equal employment protection for
employees of the Department (including pursuant to
the provisions in section 2302(b)(1) of title 5, United
States Code, and the Notification and Federal Em-
ployee Antidiscrimination and Retaliation Act of
2002 (Pub. L. 107–174)); or
(2) to provide whistleblower protections for em-
ployees of the Department (including pursuant to the
provisions in section 2302(b)(8) and (9) of such title
and the Notification and Federal Employee Anti-
discrimination and Retaliation Act of 2002).
SEC. 884. FEDERAL LAW ENFORCEMENT TRAINING CENTER.
(a) IN GENERAL.—The transfer of an authority or an
agency under this Act to the Department of Homeland Se-
curity does not affect training agreements already entered
†
285
HR 5005 EAS
into with the Federal Law Enforcement Training Center
with respect to the training of personnel to carry out that
authority or the duties of that transferred agency.
(b) CONTINUITY OF OPERATIONS.—All activities of the
Federal Law Enforcement Training Center transferred to
the Department of Homeland Security under this Act shall
continue to be carried out at the locations such activities
were carried out before such transfer.
SEC. 885. JOINT INTERAGENCY TASK FORCE.
(a) ESTABLISHMENT.—The Secretary may establish
and operate a permanent Joint Interagency Homeland Se-
curity Task Force composed of representatives from mili-
tary and civilian agencies of the United States Government
for the purposes of anticipating terrorist threats against the
United States and taking appropriate actions to prevent
harm to the United States.
(b) STRUCTURE.—It is the sense of Congress that the
Secretary should model the Joint Interagency Homeland
Security Task Force on the approach taken by the Joint
Interagency Task Forces for drug interdiction at Key West,
Florida and Alameda, California, to the maximum extent
feasible and appropriate.
†
286
HR 5005 EAS
SEC. 886. SENSE OF CONGRESS REAFFIRMING THE CONTIN-
UED IMPORTANCE AND APPLICABILITY OF
THE POSSE COMITATUS ACT.
(a) FINDINGS.—Congress finds the following:
(1) Section 1385 of title 18, United States Code
(commonly known as the ‘‘Posse Comitatus Act’’),
prohibits the use of the Armed Forces as a posse com-
itatus to execute the laws except in cases and under
circumstances expressly authorized by the Constitu-
tion or Act of Congress.
(2) Enacted in 1878, the Posse Comitatus Act
was expressly intended to prevent United States Mar-
shals, on their own initiative, from calling on the
Army for assistance in enforcing Federal law.
(3) The Posse Comitatus Act has served the Na-
tion well in limiting the use of the Armed Forces to
enforce the law.
(4) Nevertheless, by its express terms, the Posse
Comitatus Act is not a complete barrier to the use of
the Armed Forces for a range of domestic purposes,
including law enforcement functions, when the use of
the Armed Forces is authorized by Act of Congress or
the President determines that the use of the Armed
Forces is required to fulfill the President’s obligations
under the Constitution to respond promptly in time
of war, insurrection, or other serious emergency.
†
287
HR 5005 EAS
(5) Existing laws, including chapter 15 of title
10, United States Code (commonly known as the ‘‘In-
surrection Act’’), and the Robert T. Stafford Disaster
Relief and Emergency Assistance Act (42 U.S.C. 5121
et seq.), grant the President broad powers that may
be invoked in the event of domestic emergencies, in-
cluding an attack against the Nation using weapons
of mass destruction, and these laws specifically au-
thorize the President to use the Armed Forces to help
restore public order.
(b) SENSE OF CONGRESS.—Congress reaffirms the con-
tinued importance of section 1385 of title 18, United States
Code, and it is the sense of Congress that nothing in this
Act should be construed to alter the applicability of such
section to any use of the Armed Forces as a posse comitatus
to execute the laws.
SEC. 887. COORDINATION WITH THE DEPARTMENT OF
HEALTH AND HUMAN SERVICES UNDER THE
PUBLIC HEALTH SERVICE ACT.
(a) IN GENERAL.—The annual Federal response plan
developed by the Department shall be consistent with section
319 of the Public Health Service Act (42 U.S.C. 247d).
(b) DISCLOSURES AMONG RELEVANT AGENCIES.—
†
288
HR 5005 EAS
(1) IN
GENERAL.—Full disclosure among rel-
evant agencies shall be made in accordance with this
subsection.
(2) PUBLIC HEALTH EMERGENCY.—During the
period in which the Secretary of Health and Human
Services has declared the existence of a public health
emergency under section 319(a) of the Public Health
Service Act (42 U.S.C. 247d(a)), the Secretary of
Health and Human Services shall keep relevant agen-
cies, including the Department of Homeland Security,
the Department of Justice, and the Federal Bureau of
Investigation, fully and currently informed.
(3) POTENTIAL PUBLIC HEALTH EMERGENCY.—
In cases involving, or potentially involving, a public
health emergency, but in which no determination of
an emergency by the Secretary of Health and Human
Services under section 319(a) of the Public Health
Service Act (42 U.S.C. 247d(a)), has been made, all
relevant agencies, including the Department of Home-
land Security, the Department of Justice, and the
Federal Bureau of Investigation, shall keep the Sec-
retary of Health and Human Services and the Direc-
tor of the Centers for Disease Control and Prevention
fully and currently informed.
†
289
HR 5005 EAS
SEC. 888. PRESERVING COAST GUARD MISSION PERFORM-
ANCE.
(a) DEFINITIONS.—In this section:
(1) NON-HOMELAND
SECURITY
MISSIONS.—The
term ‘‘non-homeland security missions’’ means the
following missions of the Coast Guard:
(A) Marine safety.
(B) Search and rescue.
(C) Aids to navigation.
(D) Living marine resources (fisheries law
enforcement).
(E) Marine environmental protection.
(F) Ice operations.
(2) HOMELAND SECURITY MISSIONS.—The term
‘‘homeland security missions’’ means the following
missions of the Coast Guard:
(A) Ports, waterways and coastal security.
(B) Drug interdiction.
(C) Migrant interdiction.
(D) Defense readiness.
(E) Other law enforcement.
(b) TRANSFER.—There are transferred to the Depart-
ment the authorities, functions, personnel, and assets of the
Coast Guard, which shall be maintained as a distinct entity
within the Department, including the authorities and func-
tions of the Secretary of Transportation relating thereto.
†
290
HR 5005 EAS
(c) MAINTENANCE OF STATUS OF FUNCTIONS AND AS-
SETS.—Notwithstanding any other provision of this Act,
the authorities, functions, and capabilities of the Coast
Guard to perform its missions shall be maintained intact
and without significant reduction after the transfer of the
Coast Guard to the Department, except as specified in sub-
sequent Acts.
(d) CERTAIN TRANSFERS PROHIBITED.—No mission,
function, or asset (including for purposes of this subsection
any ship, aircraft, or helicopter) of the Coast Guard may
be diverted to the principal and continuing use of any other
organization, unit, or entity of the Department, except for
details or assignments that do not reduce the Coast Guard’s
capability to perform its missions.
(e) CHANGES TO MISSIONS.—
(1) PROHIBITION.—The Secretary may not sub-
stantially or significantly reduce the missions of the
Coast Guard or the Coast Guard’s capability to per-
form those missions, except as specified in subsequent
Acts.
(2) WAIVER.—The Secretary may waive the re-
strictions under paragraph (1) for a period of not to
exceed 90 days upon a declaration and certification
by the Secretary to Congress that a clear, compelling,
and immediate need exists for such a waiver. A cer-
†
292
HR 5005 EAS
(E) the Committee on Transportation and
Infrastructure of the House of Representatives.
(g) DIRECT REPORTING TO SECRETARY.—Upon the
transfer of the Coast Guard to the Department, the Com-
mandant shall report directly to the Secretary without
being required to report through any other official of the
Department.
(h) OPERATION AS A SERVICE IN THE NAVY.—None
of the conditions and restrictions in this section shall apply
when the Coast Guard operates as a service in the Navy
under section 3 of title 14, United States Code.
(i) REPORT
ON ACCELERATING
THE INTEGRATED
DEEPWATER SYSTEM.—Not later than 90 days after the
date of enactment of this Act, the Secretary, in consultation
with the Commandant of the Coast Guard, shall submit a
report to the Committee on Commerce, Science, and Trans-
portation of the Senate, the Committee on Transportation
and Infrastructure of the House of Representatives, and the
Committees on Appropriations of the Senate and the House
of Representatives that—
(1) analyzes the feasibility of accelerating the
rate of procurement in the Coast Guard’s Integrated
Deepwater System from 20 years to 10 years;
(2) includes an estimate of additional resources
required;
†
293
HR 5005 EAS
(3) describes the resulting increased capabilities;
(4) outlines any increases in the Coast Guard’s
homeland security readiness;
(5) describes any increases in operational effi-
ciencies; and
(6) provides a revised asset phase-in time line.
SEC. 889. HOMELAND SECURITY FUNDING ANALYSIS IN
PRESIDENT’S BUDGET.
(a) IN GENERAL.—Section 1105(a) of title 31, United
States Code, is amended by adding at the end the following:
‘‘(33)(A)(i) a detailed, separate analysis, by
budget function, by agency, and by initiative area (as
determined by the administration) for the prior fiscal
year, the current fiscal year, the fiscal years for which
the budget is submitted, and the ensuing fiscal year
identifying the amounts of gross and net appropria-
tions or obligational authority and outlays that con-
tribute to homeland security, with separate displays
for 
mandatory 
and 
discretionary 
amounts,
including—
‘‘(I) summaries of the total amount of such
appropriations or new obligational authority
and outlays requested for homeland security;
‘‘(II) an estimate of the current service lev-
els of homeland security spending;
†
294
HR 5005 EAS
‘‘(III) the most recent risk assessment and
summary of homeland security needs in each
initiative area (as determined by the adminis-
tration); and
‘‘(IV) an estimate of user fees collected by
the Federal Government on behalf of homeland
security activities;
‘‘(ii) with respect to subclauses (I) through (IV)
of clause (i), amounts shall be provided by account for
each program, project and activity; and
‘‘(iii) an estimate of expenditures for homeland
security activities by State and local governments and
the private sector for the prior fiscal year and the
current fiscal year.
‘‘(B) In this paragraph, consistent with the Of-
fice of Management and Budget’s June 2002 ‘Annual
Report to Congress on Combatting Terrorism’, the
term ‘homeland security’ refers to those activities that
detect, deter, protect against, and respond to terrorist
attacks occurring within the United States and its
territories.
‘‘(C) In implementing this paragraph, including
determining what Federal activities or accounts con-
stitute homeland security for purposes of budgetary
classification, the Office of Management and Budget
†
295
HR 5005 EAS
is directed to consult periodically, but at least annu-
ally, with the House and Senate Budget Committees,
the House and Senate Appropriations Committees,
and the Congressional Budget Office.’’.
(b) REPEAL
OF DUPLICATIVE REPORTS.—The fol-
lowing sections are repealed:
(1) Section 1051 of Public Law 105–85.
(2) Section 1403 of Public Law 105–261.
(c) EFFECTIVE DATE.—This section and the amend-
ment made by this section shall apply beginning with re-
spect to the fiscal year 2005 budget submission.
SEC. 890. AIR TRANSPORTATION SAFETY AND SYSTEM STA-
BILIZATION ACT.
The Air Transportation Safety and System Stabiliza-
tion Act (49 U.S.C. 40101 note) is amended—
(1) in section 408 by striking the last sentence
of subsection (c); and
(2) in section 402 by striking paragraph (1) and
inserting the following:
‘‘(1) AIR
CARRIER.—The term ‘air carrier’
means a citizen of the United States undertaking by
any means, directly or indirectly, to provide air
transportation and includes employees and agents
(including persons engaged in the business of pro-
viding air transportation security and their affili-
†
296
HR 5005 EAS
ates) of such citizen. For purposes of the preceding
sentence, the term ‘agent’, as applied to persons en-
gaged in the business of providing air transportation
security, shall only include persons that have con-
tracted directly with the Federal Aviation Adminis-
tration on or after and commenced services no later
than February 17, 2002, to provide such security, and
had not been or are not debarred for any period with-
in 6 months from that date.’’.
Subtitle I—Information Sharing
SEC. 891. SHORT TITLE; FINDINGS; AND SENSE OF CON-
GRESS.
(a) SHORT TITLE.—This subtitle may be cited as the
‘‘Homeland Security Information Sharing Act’’.
(b) FINDINGS.—Congress finds the following:
(1) The Federal Government is required by the
Constitution to provide for the common defense, which
includes terrorist attack.
(2) The Federal Government relies on State and
local personnel to protect against terrorist attack.
(3) The Federal Government collects, creates,
manages, and protects classified and sensitive but un-
classified information to enhance homeland security.
†
297
HR 5005 EAS
(4) Some homeland security information is need-
ed by the State and local personnel to prevent and
prepare for terrorist attack.
(5) The needs of State and local personnel to
have access to relevant homeland security information
to combat terrorism must be reconciled with the need
to preserve the protected status of such information
and to protect the sources and methods used to ac-
quire such information.
(6) Granting security clearances to certain State
and local personnel is one way to facilitate the shar-
ing of information regarding specific terrorist threats
among Federal, State, and local levels of government.
(7) Methods exist to declassify, redact, or other-
wise adapt classified information so it may be shared
with State and local personnel without the need for
granting additional security clearances.
(8) State and local personnel have capabilities
and opportunities to gather information on suspicious
activities and terrorist threats not possessed by Fed-
eral agencies.
(9) The Federal Government and State and local
governments and agencies in other jurisdictions may
benefit from such information.
†
298
HR 5005 EAS
(10) Federal, State, and local governments and
intelligence, law enforcement, and other emergency
preparation and response agencies must act in part-
nership to maximize the benefits of information gath-
ering and analysis to prevent and respond to terrorist
attacks.
(11) Information systems, including the National
Law Enforcement Telecommunications System and
the Terrorist Threat Warning System, have been es-
tablished for rapid sharing of classified and sensitive
but unclassified information among Federal, State,
and local entities.
(12) Increased efforts to share homeland security
information should avoid duplicating existing infor-
mation systems.
(c) SENSE OF CONGRESS.—It is the sense of Congress
that Federal, State, and local entities should share home-
land security information to the maximum extent prac-
ticable, with special emphasis on hard-to-reach urban and
rural communities.
SEC. 892. FACILITATING HOMELAND SECURITY INFORMA-
TION SHARING PROCEDURES.
(a) PROCEDURES
FOR DETERMINING EXTENT
OF
SHARING OF HOMELAND SECURITY INFORMATION.—
†
301
HR 5005 EAS
(3) The procedures prescribed under paragraph
(1) shall establish conditions on the use of informa-
tion shared under paragraph (1)—
(A) to limit the redissemination of such in-
formation to ensure that such information is not
used for an unauthorized purpose;
(B) to ensure the security and confiden-
tiality of such information;
(C) to protect the constitutional and statu-
tory rights of any individuals who are subjects
of such information; and
(D) to provide data integrity through the
timely removal and destruction of obsolete or er-
roneous names and information.
(4) The procedures prescribed under paragraph
(1) shall ensure, to the greatest extent practicable,
that the information sharing system through which
information is shared under such paragraph include
existing information sharing systems, including, but
not limited to, the National Law Enforcement Tele-
communications System, the Regional Information
Sharing System, and the Terrorist Threat Warning
System of the Federal Bureau of Investigation.
(5) Each appropriate Federal agency, as deter-
mined by the President, shall have access to each in-
†
302
HR 5005 EAS
formation sharing system through which information
is shared under paragraph (1), and shall therefore
have access to all information, as appropriate, shared
under such paragraph.
(6) The procedures prescribed under paragraph
(1) shall ensure that appropriate State and local per-
sonnel are authorized to use such information sharing
systems—
(A) to access information shared with such
personnel; and
(B) to share, with others who have access to
such information sharing systems, the homeland
security information of their own jurisdictions,
which shall be marked appropriately as per-
taining to potential terrorist activity.
(7) Under procedures prescribed jointly by the
Director of Central Intelligence and the Attorney Gen-
eral, each appropriate Federal agency, as determined
by the President, shall review and assess the informa-
tion shared under paragraph (6) and integrate such
information with existing intelligence.
(c) SHARING OF CLASSIFIED INFORMATION AND SEN-
SITIVE BUT UNCLASSIFIED INFORMATION WITH STATE AND
LOCAL PERSONNEL.—
†
303
HR 5005 EAS
(1) The President shall prescribe procedures
under which Federal agencies may, to the extent the
President considers necessary, share with appropriate
State and local personnel homeland security informa-
tion that remains classified or otherwise protected
after the determinations prescribed under the proce-
dures set forth in subsection (a).
(2) It is the sense of Congress that such proce-
dures may include 1 or more of the following means:
(A) Carrying out security clearance inves-
tigations with respect to appropriate State and
local personnel.
(B) With respect to information that is sen-
sitive but unclassified, entering into nondisclo-
sure agreements with appropriate State and
local personnel.
(C) Increased use of information-sharing
partnerships that include appropriate State and
local personnel, such as the Joint Terrorism
Task Forces of the Federal Bureau of Investiga-
tion, the Anti-Terrorism Task Forces of the De-
partment of Justice, and regional Terrorism
Early Warning Groups.
†
304
HR 5005 EAS
(d) RESPONSIBLE OFFICIALS.—For each affected Fed-
eral agency, the head of such agency shall designate an offi-
cial to administer this Act with respect to such agency.
(e) FEDERAL CONTROL OF INFORMATION.—Under pro-
cedures prescribed under this section, information obtained
by a State or local government from a Federal agency under
this section shall remain under the control of the Federal
agency, and a State or local law authorizing or requiring
such a government to disclose information shall not apply
to such information.
(f) DEFINITIONS.—As used in this section:
(1) The term ‘‘homeland security information’’
means any information possessed by a Federal, State,
or local agency that—
(A) relates to the threat of terrorist activity;
(B) relates to the ability to prevent, inter-
dict, or disrupt terrorist activity;
(C) would improve the identification or in-
vestigation of a suspected terrorist or terrorist
organization; or
(D) would improve the response to a ter-
rorist act.
(2) The term ‘‘intelligence community’’ has the
meaning given such term in section 3(4) of the Na-
tional Security Act of 1947 (50 U.S.C. 401a(4)).
†
305
HR 5005 EAS
(3) The term ‘‘State and local personnel’’ means
any of the following persons involved in prevention,
preparation, or response for terrorist attack:
(A) State Governors, mayors, and other lo-
cally elected officials.
(B) State and local law enforcement per-
sonnel and firefighters.
(C) Public health and medical professionals.
(D) Regional, State, and local emergency
management agency personnel, including State
adjutant generals.
(E) Other appropriate emergency response
agency personnel.
(F) Employees of private-sector entities that
affect critical infrastructure, cyber, economic, or
public health security, as designated by the Fed-
eral government in procedures developed pursu-
ant to this section.
(4) The term ‘‘State’’ includes the District of Co-
lumbia and any commonwealth, territory, or posses-
sion of the United States.
(g) CONSTRUCTION.—Nothing in this Act shall be con-
strued as authorizing any department, bureau, agency, offi-
cer, or employee of the Federal Government to request, re-
ceive, or transmit to any other Government entity or per-
†
306
HR 5005 EAS
sonnel, or transmit to any State or local entity or personnel
otherwise authorized by this Act to receive homeland secu-
rity information, any information collected by the Federal
Government solely for statistical purposes in violation of
any other provision of law relating to the confidentiality
of such information.
SEC. 893. REPORT.
(a) REPORT REQUIRED.—Not later than 12 months
after the date of the enactment of this Act, the President
shall submit to the congressional committees specified in
subsection (b) a report on the implementation of section
892. The report shall include any recommendations for ad-
ditional measures or appropriation requests, beyond the re-
quirements of section 892, to increase the effectiveness of
sharing of information between and among Federal, State,
and local entities.
(b) SPECIFIED CONGRESSIONAL COMMITTEES.—The
congressional committees referred to in subsection (a) are
the following committees:
(1) The Permanent Select Committee on Intel-
ligence and the Committee on the Judiciary of the
House of Representatives.
(2) The Select Committee on Intelligence and the
Committee on the Judiciary of the Senate.
†
307
HR 5005 EAS
SEC. 894. AUTHORIZATION OF APPROPRIATIONS.
There are authorized to be appropriated such sums as
may be necessary to carry out section 892.
SEC. 895. AUTHORITY TO SHARE GRAND JURY INFORMA-
TION.
Rule 6(e) of the Federal Rules of Criminal Procedure
is amended—
(1) in paragraph (2), by inserting ‘‘, or of guide-
lines jointly issued by the Attorney General and Di-
rector of Central Intelligence pursuant to Rule 6,’’
after ‘‘Rule 6’’; and
(2) in paragraph (3)—
(A) in subparagraph (A)(ii), by inserting
‘‘or of a foreign government’’ after ‘‘(including
personnel of a state or subdivision of a state’’;
(B) in subparagraph (C)(i)—
(i) in subclause (I), by inserting before
the semicolon the following: ‘‘or, upon a re-
quest by an attorney for the government,
when sought by a foreign court or pros-
ecutor for use in an official criminal inves-
tigation’’;
(ii) in subclause (IV)—
(I) by inserting ‘‘or foreign’’ after
‘‘may disclose a violation of State’’;
†
308
HR 5005 EAS
(II) by inserting ‘‘or of a foreign
government’’ after ‘‘to an appropriate
official of a State or subdivision of a
State’’; and
(III) by striking ‘‘or’’ at the end;
(iii) by striking the period at the end
of subclause (V) and inserting ‘‘; or’’; and
(iv) by adding at the end the following:
‘‘(VI) when matters involve a threat of
actual or potential attack or other grave
hostile acts of a foreign power or an agent
of a foreign power, domestic or inter-
national sabotage, domestic or international
terrorism, or clandestine intelligence gath-
ering activities by an intelligence service or
network of a foreign power or by an agent
of a foreign power, within the United States
or elsewhere, to any appropriate federal,
state, local, or foreign government official
for the purpose of preventing or responding
to such a threat.’’; and
(C) in subparagraph (C)(iii)—
(i) by striking ‘‘Federal’’;
(ii) by inserting ‘‘or clause (i)(VI)’’
after ‘‘clause (i)(V)’’; and
†
309
HR 5005 EAS
(iii) by adding at the end the fol-
lowing: ‘‘Any state, local, or foreign official
who receives information pursuant to clause
(i)(VI) shall use that information only con-
sistent with such guidelines as the Attorney
General and Director of Central Intelligence
shall jointly issue.’’.
SEC. 896. AUTHORITY TO SHARE ELECTRONIC, WIRE, AND
ORAL INTERCEPTION INFORMATION.
Section 2517 of title 18, United States Code, is amend-
ed by adding at the end the following:
‘‘(7) Any investigative or law enforcement officer, or
other Federal official in carrying out official duties as such
Federal official, who by any means authorized by this chap-
ter, has obtained knowledge of the contents of any wire, oral,
or electronic communication, or evidence derived therefrom,
may disclose such contents or derivative evidence to a for-
eign investigative or law enforcement officer to the extent
that such disclosure is appropriate to the proper perform-
ance of the official duties of the officer making or receiving
the disclosure, and foreign investigative or law enforcement
officers may use or disclose such contents or derivative evi-
dence to the extent such use or disclosure is appropriate
to the proper performance of their official duties.
†
310
HR 5005 EAS
‘‘(8) Any investigative or law enforcement officer, or
other Federal official in carrying out official duties as such
Federal official, who by any means authorized by this chap-
ter, has obtained knowledge of the contents of any wire, oral,
or electronic communication, or evidence derived therefrom,
may disclose such contents or derivative evidence to any
appropriate Federal, State, local, or foreign government of-
ficial to the extent that such contents or derivative evidence
reveals a threat of actual or potential attack or other grave
hostile acts of a foreign power or an agent of a foreign
power, domestic or international sabotage, domestic or
international terrorism, or clandestine intelligence gath-
ering activities by an intelligence service or network of a
foreign power or by an agent of a foreign power, within
the United States or elsewhere, for the purpose of preventing
or responding to such a threat. Any official who receives
information pursuant to this provision may use that infor-
mation only as necessary in the conduct of that person’s
official duties subject to any limitations on the unauthor-
ized disclosure of such information, and any State, local,
or foreign official who receives information pursuant to this
provision may use that information only consistent with
such guidelines as the Attorney General and Director of
Central Intelligence shall jointly issue.’’.
†
311
HR 5005 EAS
SEC. 897. FOREIGN INTELLIGENCE INFORMATION.
(a) DISSEMINATION AUTHORIZED.—Section 203(d)(1)
of the Uniting and Strengthening America by Providing
Appropriate Tools Required to Intercept and Obstruct Ter-
rorism (USA PATRIOT ACT) Act of 2001 (Public Law
107–56; 50 U.S.C. 403–5d) is amended by adding at the
end the following: ‘‘Consistent with the responsibility of the
Director of Central Intelligence to protect intelligence
sources and methods, and the responsibility of the Attorney
General to protect sensitive law enforcement information,
it shall be lawful for information revealing a threat of ac-
tual or potential attack or other grave hostile acts of a for-
eign power or an agent of a foreign power, domestic or
international sabotage, domestic or international terrorism,
or clandestine intelligence gathering activities by an intel-
ligence service or network of a foreign power or by an agent
of a foreign power, within the United States or elsewhere,
obtained as part of a criminal investigation to be disclosed
to any appropriate Federal, State, local, or foreign govern-
ment official for the purpose of preventing or responding
to such a threat. Any official who receives information pur-
suant to this provision may use that information only as
necessary in the conduct of that person’s official duties sub-
ject to any limitations on the unauthorized disclosure of
such information, and any State, local, or foreign official
who receives information pursuant to this provision may
†
312
HR 5005 EAS
use that information only consistent with such guidelines
as the Attorney General and Director of Central Intelligence
shall jointly issue.’’.
(b) CONFORMING AMENDMENTS.—Section 203(c) of
that Act is amended—
(1) by striking ‘‘section 2517(6)’’ and inserting
‘‘paragraphs (6) and (8) of section 2517 of title 18,
United States Code,’’; and
(2) by inserting ‘‘and (VI)’’ after ‘‘Rule
6(e)(3)(C)(i)(V)’’.
SEC. 898. INFORMATION ACQUIRED FROM AN ELECTRONIC
SURVEILLANCE.
Section 106(k)(1) of the Foreign Intelligence Surveil-
lance Act of 1978 (50 U.S.C. 1806) is amended by inserting
after ‘‘law enforcement officers’’ the following: ‘‘or law en-
forcement personnel of a State or political subdivision of
a State (including the chief executive officer of that State
or political subdivision who has the authority to appoint
or direct the chief law enforcement officer of that State or
political subdivision)’’.
SEC. 899. INFORMATION ACQUIRED FROM A PHYSICAL
SEARCH.
Section 305(k)(1) of the Foreign Intelligence Surveil-
lance Act of 1978 (50 U.S.C. 1825) is amended by inserting
after ‘‘law enforcement officers’’ the following: ‘‘or law en-
†
313
HR 5005 EAS
forcement personnel of a State or political subdivision of
a State (including the chief executive officer of that State
or political subdivision who has the authority to appoint
or direct the chief law enforcement officer of that State or
political subdivision)’’.
TITLE IX—NATIONAL HOMELAND
SECURITY COUNCIL
SEC. 901. NATIONAL HOMELAND SECURITY COUNCIL.
There is established within the Executive Office of the
President a council to be known as the ‘‘Homeland Security
Council’’ (in this title referred to as the ‘‘Council’’).
SEC. 902. FUNCTION.
The function of the Council shall be to advise the Presi-
dent on homeland security matters.
SEC. 903. MEMBERSHIP.
The members of the Council shall be the following:
(1) The President.
(2) The Vice President.
(3) The Secretary of Homeland Security.
(4) The Attorney General.
(5) The Secretary of Defense.
(6) Such other individuals as may be designated
by the President.
†
314
HR 5005 EAS
SEC. 904. OTHER FUNCTIONS AND ACTIVITIES.
For the purpose of more effectively coordinating the
policies and functions of the United States Government re-
lating to homeland security, the Council shall—
(1) assess the objectives, commitments, and risks
of the United States in the interest of homeland secu-
rity and to make resulting recommendations to the
President;
(2) oversee and review homeland security policies
of the Federal Government and to make resulting rec-
ommendations to the President; and
(3) perform such other functions as the President
may direct.
SEC. 905. STAFF COMPOSITION.
The Council shall have a staff, the head of which shall
be a civilian Executive Secretary, who shall be appointed
by the President. The President is authorized to fix the pay
of the Executive Secretary at a rate not to exceed the rate
of pay payable to the Executive Secretary of the National
Security Council.
SEC. 906. RELATION TO THE NATIONAL SECURITY COUNCIL.
The President may convene joint meetings of the
Homeland Security Council and the National Security
Council with participation by members of either Council
or as the President may otherwise direct.
†
315
HR 5005 EAS
TITLE X—INFORMATION
SECURITY
SEC. 1001. INFORMATION SECURITY.
(a) SHORT TITLE.—This title may be cited as the
‘‘Federal Information Security Management Act of 2002’’.
(b) INFORMATION SECURITY.—
(1) IN GENERAL.—Subchapter II of chapter 35 of
title 44, United States Code, is amended to read as
follows:
‘‘SUBCHAPTER II—INFORMATION
SECURITY
‘‘§ 3531. Purposes
‘‘The purposes of this subchapter are to—
‘‘(1) provide a comprehensive framework for en-
suring the effectiveness of information security con-
trols over information resources that support Federal
operations and assets;
‘‘(2) recognize the highly networked nature of the
current Federal computing environment and provide
effective governmentwide management and oversight
of the related information security risks, including co-
ordination of information security efforts throughout
the civilian, national security, and law enforcement
communities;
†
316
HR 5005 EAS
‘‘(3) provide for development and maintenance of
minimum controls required to protect Federal infor-
mation and information systems;
‘‘(4) provide a mechanism for improved oversight
of Federal agency information security programs;
‘‘(5) acknowledge that commercially developed
information security products offer advanced, dy-
namic, robust, and effective information security solu-
tions, reflecting market solutions for the protection of
critical information infrastructures important to the
national defense and economic security of the nation
that are designed, built, and operated by the private
sector; and
‘‘(6) recognize that the selection of specific tech-
nical hardware and software information security so-
lutions should be left to individual agencies from
among commercially developed products.’’.
‘‘§ 3532. Definitions
‘‘(a) IN GENERAL.—Except as provided under sub-
section (b), the definitions under section 3502 shall apply
to this subchapter.
‘‘(b) ADDITIONAL DEFINITIONS.—As used in this
subchapter—
‘‘(1) the term ‘information security’ means pro-
tecting information and information systems from
†
318
HR 5005 EAS
‘‘(C) involves command and control of mili-
tary forces;
‘‘(D) involves equipment that is an integral
part of a weapon or weapons system; or
‘‘(E) is critical to the direct fulfillment of
military or intelligence missions provided that
this definition does not apply to a system that
is used for routine administrative and business
applications (including payroll, finance, logis-
tics, and personnel management applications);
‘‘(3) the term ‘information technology’ has the
meaning given that term in section 11101 of title 40;
and
‘‘(4) the term ‘information system’ means any
equipment or interconnected system or subsystems of
equipment that is used in the automatic acquisition,
storage, manipulation, management, movement, con-
trol, display, switching, interchange, transmission, or
reception of data or information, and includes—
‘‘(A) computers and computer networks;
‘‘(B) ancillary equipment;
‘‘(C) software, firmware, and related proce-
dures;
‘‘(D) services, including support services;
and
†
319
HR 5005 EAS
‘‘(E) related resources.’’.
‘‘§ 3533. Authority and functions of the Director
‘‘(a) The Director shall oversee agency information se-
curity policies and practices, by—
‘‘(1) promulgating information security stand-
ards under section 11331 of title 40;
‘‘(2) overseeing the implementation of policies,
principles, standards, and guidelines on information
security;
‘‘(3) requiring agencies, consistent with the
standards promulgated under such section 11331 and
the requirements of this subchapter, to identify and
provide information security protections commensu-
rate with the risk and magnitude of the harm result-
ing from the unauthorized access, use, disclosure, dis-
ruption, modification, or destruction of—
‘‘(A) information collected or maintained by
or on behalf of an agency; or
‘‘(B) information systems used or operated
by an agency or by a contractor of an agency or
other organization on behalf of an agency;
‘‘(4) coordinating the development of standards
and guidelines under section 20 of the National Insti-
tute of Standards and Technology Act (15 U.S.C.
278g–3) with agencies and offices operating or exer-
†
321
HR 5005 EAS
‘‘(D) a summary of, and the views of the
Director on, the report prepared by the National
Institute of Standards and Technology under
section 20(d)(9) of the National Institute of
Standards and Technology Act (15 U.S.C. 278g–
3).’’.
‘‘(b) Except for the authorities described in paragraphs
(4) and (7) of subsection (a), the authorities of the Director
under this section shall not apply to national security sys-
tems.
‘‘§ 3534. Federal agency responsibilities
‘‘(a) The head of each agency shall—
‘‘(1) be responsible for—
‘‘(A) providing information security protec-
tions commensurate with the risk and magnitude
of the harm resulting from unauthorized access,
use, disclosure, disruption, modification, or de-
struction of—
‘‘(i) information collected or main-
tained by or on behalf of the agency; and
‘‘(ii) information systems used or oper-
ated by an agency or by a contractor of an
agency or other organization on behalf of an
agency;
†
322
HR 5005 EAS
‘‘(B) complying with the requirements of
this subchapter and related policies, procedures,
standards, and guidelines, including—
‘‘(i) information security standards
promulgated by the Director under section
11331 of title 40; and
‘‘(ii) information security standards
and guidelines for national security systems
issued in accordance with law and as di-
rected by the President; and
‘‘(C) ensuring that information security
management processes are integrated with agen-
cy strategic and operational planning processes;
‘‘(2) ensure that senior agency officials provide
information security for the information and infor-
mation systems that support the operations and assets
under their control, including through—
‘‘(A) assessing the risk and magnitude of
the harm that could result from the unauthorized
access, use, disclosure, disruption, modification,
or destruction of such information or informa-
tion systems;
‘‘(B) determining the levels of information
security appropriate to protect such information
and information systems in accordance with
†
323
HR 5005 EAS
standards promulgated under section 11331 of
title 40 for information security classifications
and related requirements;
‘‘(C) implementing policies and procedures
to cost-effectively reduce risks to an acceptable
level; and
‘‘(D) periodically testing and evaluating in-
formation security controls and techniques to en-
sure that they are effectively implemented;
‘‘(3) delegate to the agency Chief Information Of-
ficer established under section 3506 (or comparable
official in an agency not covered by such section) the
authority to ensure compliance with the requirements
imposed on the agency under this subchapter,
including—
‘‘(A) designating a senior agency informa-
tion security officer who shall—
‘‘(i) carry out the Chief Information
Officer’s responsibilities under this section;
‘‘(ii) possess professional qualifica-
tions, including training and experience, re-
quired to administer the functions described
under this section;
‘‘(iii) have information security duties
as that official’s primary duty; and
†
324
HR 5005 EAS
‘‘(iv) head an office with the mission
and resources to assist in ensuring agency
compliance with this section;
‘‘(B) developing and maintaining an agen-
cywide information security program as required
by subsection (b);
‘‘(C) developing and maintaining informa-
tion security policies, procedures, and control
techniques to address all applicable requirements,
including those issued under section 3533 of this
title, and section 11331 of title 40;
‘‘(D) training and overseeing personnel
with significant responsibilities for information
security with respect to such responsibilities; and
‘‘(E) assisting senior agency officials con-
cerning their responsibilities under paragraph
(2);
‘‘(4) ensure that the agency has trained per-
sonnel sufficient to assist the agency in complying
with the requirements of this subchapter and related
policies, procedures, standards, and guidelines; and
‘‘(5) ensure that the agency Chief Information
Officer, in coordination with other senior agency offi-
cials, reports annually to the agency head on the ef-
†
325
HR 5005 EAS
fectiveness of the agency information security pro-
gram, including progress of remedial actions.
‘‘(b) Each agency shall develop, document, and imple-
ment an agencywide information security program, ap-
proved by the Director under section 3533(a)(5), to provide
information security for the information and information
systems that support the operations and assets of the agen-
cy, including those provided or managed by another agency,
contractor, or other source, that includes—
‘‘(1) periodic assessments of the risk and mag-
nitude of the harm that could result from the unau-
thorized access, use, disclosure, disruption, modifica-
tion, or destruction of information and information
systems that support the operations and assets of the
agency;
‘‘(2) policies and procedures that—
‘‘(A) are based on the risk assessments re-
quired by paragraph (1);
‘‘(B) cost-effectively reduce information se-
curity risks to an acceptable level;
‘‘(C) ensure that information security is ad-
dressed throughout the life cycle of each agency
information system; and
‘‘(D) ensure compliance with—
†
326
HR 5005 EAS
‘‘(i) the requirements of this sub-
chapter;
‘‘(ii) policies and procedures as may be
prescribed by the Director, and information
security standards promulgated under sec-
tion 11331 of title 40;
‘‘(iii) minimally acceptable system
configuration requirements, as determined
by the agency; and
‘‘(iv) any other applicable require-
ments, including standards and guidelines
for national security systems issued in ac-
cordance with law and as directed by the
President;
‘‘(3) subordinate plans for providing adequate
information security for networks, facilities, and sys-
tems or groups of information systems, as appro-
priate;
‘‘(4) security awareness training to inform per-
sonnel, including contractors and other users of infor-
mation systems that support the operations and assets
of the agency, of—
‘‘(A) information security risks associated
with their activities; and
†
327
HR 5005 EAS
‘‘(B) their responsibilities in complying
with agency policies and procedures designed to
reduce these risks;
‘‘(5) periodic testing and evaluation of the effec-
tiveness of information security policies, procedures,
and practices, to be performed with a frequency de-
pending on risk, but no less than annually, of which
such testing—
‘‘(A) shall include testing of management,
operational, and technical controls of every in-
formation system identified in the inventory re-
quired under section 3505(c); and
‘‘(B) may include testing relied on in a
evaluation under section 3535;
‘‘(6) a process for planning, implementing, eval-
uating, and documenting remedial action to address
any deficiencies in the information security policies,
procedures, and practices of the agency;
‘‘(7) procedures for detecting, reporting, and re-
sponding to security incidents, including—
‘‘(A) mitigating risks associated with such
incidents before substantial damage is done; and
‘‘(B) notifying and consulting with, as
appropriate—
†
328
HR 5005 EAS
‘‘(i) law enforcement agencies and rel-
evant Offices of Inspector General;
‘‘(ii) an office designated by the Presi-
dent for any incident involving a national
security system; and
‘‘(iii) any other agency or office, in ac-
cordance with law or as directed by the
President; and
‘‘(8) plans and procedures to ensure continuity
of operations for information systems that support the
operations and assets of the agency.
‘‘(c) Each agency shall—
‘‘(1) report annually to the Director, the Com-
mittees on Government Reform and Science of the
House of Representatives, the Committees on Govern-
mental Affairs and Commerce, Science, and Trans-
portation of the Senate, the appropriate authorization
and appropriations committees of Congress, and the
Comptroller General on the adequacy and effectiveness
of information security policies, procedures, and prac-
tices, and compliance with the requirements of this
subchapter, including compliance with each require-
ment of subsection (b);
†
329
HR 5005 EAS
‘‘(2) address the adequacy and effectiveness of in-
formation security policies, procedures, and practices
in plans and reports relating to—
‘‘(A) annual agency budgets;
‘‘(B) information resources management
under subchapter 1 of this chapter;
‘‘(C) information technology management
under subtitle III of title 40;
‘‘(D) program performance under sections
1105 and 1115 through 1119 of title 31, and sec-
tions 2801 and 2805 of title 39;
‘‘(E) financial management under chapter
9 of title 31, and the Chief Financial Officers
Act of 1990 (31 U.S.C. 501 note; Public Law
101–576) (and the amendments made by that
Act);
‘‘(F) financial management systems under
the Federal Financial Management Improvement
Act (31 U.S.C. 3512 note); and
‘‘(G) internal accounting and administra-
tive controls under section 3512 of title 31,
United States Code, (known as the ‘Federal
Managers Financial Integrity Act’); and
†
330
HR 5005 EAS
‘‘(3) report any significant deficiency in a pol-
icy, procedure, or practice identified under paragraph
(1) or (2)—
‘‘(A) as a material weakness in reporting
under section 3512 of title 31; and
‘‘(B) if relating to financial management
systems, as an instance of a lack of substantial
compliance under the Federal Financial Man-
agement Improvement Act (31 U.S.C. 3512
note).
‘‘(d)(1) In addition to the requirements of subsection
(c), each agency, in consultation with the Director, shall
include as part of the performance plan required under sec-
tion 1115 of title 31 a description of—
‘‘(A) the time periods, and
‘‘(B) the resources, including budget, staffing,
and training,
that are necessary to implement the program required
under subsection (b).
‘‘(2) The description under paragraph (1) shall be
based on the risk assessments required under subsection
(b)(2)(1).
‘‘(e) Each agency shall provide the public with timely
notice and opportunities for comment on proposed informa-
tion security policies and procedures to the extent that such
†
331
HR 5005 EAS
policies and procedures affect communication with the pub-
lic.
‘‘§ 3535. Annual independent evaluation
‘‘(a)(1) Each year each agency shall have performed
an independent evaluation of the information security pro-
gram and practices of that agency to determine the effective-
ness of such program and practices.
‘‘(2) Each evaluation by an agency under this section
shall include—
‘‘(A) testing of the effectiveness of information se-
curity policies, procedures, and practices of a rep-
resentative subset of the agency’s information systems;
‘‘(B) an assessment (made on the basis of the re-
sults of the testing) of compliance with—
‘‘(i) the requirements of this subchapter;
and
‘‘(ii) related information security policies,
procedures, standards, and guidelines; and
‘‘(C) separate presentations, as appropriate, re-
garding information security relating to national se-
curity systems.
‘‘(b) Subject to subsection (c)—
‘‘(1) for each agency with an Inspector General
appointed under the Inspector General Act of 1978,
the annual evaluation required by this section shall be
†
332
HR 5005 EAS
performed by the Inspector General or by an inde-
pendent external auditor, as determined by the In-
spector General of the agency; and
‘‘(2) for each agency to which paragraph (1) does
not apply, the head of the agency shall engage an
independent external auditor to perform the evalua-
tion.
‘‘(c) For each agency operating or exercising control
of a national security system, that portion of the evaluation
required by this section directly relating to a national secu-
rity system shall be performed—
‘‘(1) only by an entity designated by the agency
head; and
‘‘(2) in such a manner as to ensure appropriate
protection for information associated with any infor-
mation security vulnerability in such system com-
mensurate with the risk and in accordance with all
applicable laws.
‘‘(d) The evaluation required by this section—
‘‘(1) shall be performed in accordance with gen-
erally accepted government auditing standards; and
‘‘(2) may be based in whole or in part on an
audit, evaluation, or report relating to programs or
practices of the applicable agency.
†
333
HR 5005 EAS
‘‘(e) Each year, not later than such date established
by the Director, the head of each agency shall submit to
the Director the results of the evaluation required under this
section.
‘‘(f) Agencies and evaluators shall take appropriate
steps to ensure the protection of information which, if dis-
closed, may adversely affect information security. Such pro-
tections shall be commensurate with the risk and comply
with all applicable laws and regulations.
‘‘(g)(1) The Director shall summarize the results of the
evaluations conducted under this section in the report to
Congress required under section 3533(a)(8).
‘‘(2) The Director’s report to Congress under this sub-
section shall summarize information regarding information
security relating to national security systems in such a
manner as to ensure appropriate protection for information
associated with any information security vulnerability in
such system commensurate with the risk and in accordance
with all applicable laws.
‘‘(3) Evaluations and any other descriptions of infor-
mation systems under the authority and control of the Di-
rector of Central Intelligence or of National Foreign Intel-
ligence Programs systems under the authority and control
of the Secretary of Defense shall be made available to Con-
†
334
HR 5005 EAS
gress only through the appropriate oversight committees of
Congress, in accordance with applicable laws.
‘‘(h) The Comptroller General shall periodically evalu-
ate and report to Congress on—
‘‘(1) the adequacy and effectiveness of agency in-
formation security policies and practices; and
‘‘(2) implementation of the requirements of this
subchapter.
‘‘§ 3536. National security systems
‘‘The head of each agency operating or exercising con-
trol of a national security system shall be responsible for
ensuring that the agency—
‘‘(1) provides information security protections
commensurate with the risk and magnitude of the
harm resulting from the unauthorized access, use, dis-
closure, disruption, modification, or destruction of the
information contained in such system;
‘‘(2) implements information security policies
and practices as required by standards and guidelines
for national security systems, issued in accordance
with law and as directed by the President; and
‘‘(3) complies with the requirements of this sub-
chapter.
†
335
HR 5005 EAS
‘‘§ 3537. Authorization of appropriations
‘‘There are authorized to be appropriated to carry out
the provisions of this subchapter such sums as may be nec-
essary for each of fiscal years 2003 through 2007.
‘‘§ 3538. Effect on existing law
‘‘Nothing in this subchapter, section 11331 of title 40,
or section 20 of the National Standards and Technology Act
(15 U.S.C. 278g–3) may be construed as affecting the au-
thority of the President, the Office of Management and
Budget or the Director thereof, the National Institute of
Standards and Technology, or the head of any agency, with
respect to the authorized use or disclosure of information,
including with regard to the protection of personal privacy
under section 552a of title 5, the disclosure of information
under section 552 of title 5, the management and disposi-
tion of records under chapters 29, 31, or 33 of title 44, the
management of information resources under subchapter I
of chapter 35 of this title, or the disclosure of information
to Congress or the Comptroller General of the United
States.’’.
(2) CLERICAL AMENDMENT.—The items in the
table of sections at the beginning of such chapter 35
under the heading ‘‘SUBCHAPTER II’’ are amended
to read as follows:
‘‘3531. Purposes.
‘‘3532. Definitions.
‘‘3533. Authority and functions of the Director.