IB
Union Calendar No. 208
107TH CONGRESS
2D SESSION
H. R. 3394
[Report No. 107–355, Part I]
To authorize funding for computer and network security research and
development and research fellowship programs, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
DECEMBER 4, 2001
Mr. BOEHLERT (for himself, Mr. HALL of Texas, Mr. SMITH of Texas, Mr.
BAIRD, Mr. SMITH of Michigan, and Ms. EDDIE BERNICE JOHNSON of
Texas) introduced the following bill; which was referred to the Committee
on Science, and in addition to the Committee on Education and the
Workforce, for a period to be subsequently determined by the Speaker,
in each case for consideration of such provisions as fall within the
jurisdicition of the committee concerned
FEBRUARY 4, 2002
Reported from the Committee on Science
FEBRUARY 4, 2002
Additional sponsors: Mr. FORBES, Mrs. MORELLA, and Ms. ESHOO
FEBRUARY 4, 2002
Referral to the Committee on Education and the Workforce extended for a
period ending not later than February 4, 2002
FEBRUARY 4, 2002
Committee discharged; committed to the Committee of the Whole House on
the State of the Union and ordered to be printed
HR 3394 RH
A BILL
To authorize funding for computer and network security
research and development and research fellowship pro-
grams, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Cyber Security Re-
search and Development Act’’.
SEC. 2. FINDINGS.
The Congress finds the following:
(1) Revolutionary advancements in computing
and communications technology have interconnected
government, commercial, scientific, and educational
infrastructures—including critical infrastructures for
electric power, natural gas and petroleum production
and distribution, telecommunications, transportation,
water supply, banking and finance, and emergency
and government services—in a vast, interdependent
physical and electronic network.
(2) Exponential increases in interconnectivity
have facilitated enhanced communications, economic
growth, and the delivery of services critical to the
public welfare, but have also increased the con-
sequences of temporary or prolonged failure.
HR 3394 RH
(3) A Department of Defense Joint Task Force
concluded after a 1997 United States information
warfare exercise that the results ‘‘clearly dem-
onstrated our lack of preparation for a coordinated
cyber and physical attack on our critical military
and civilian infrastructure’’.
(4) Computer security technology and systems
implementation lack—
(A) sufficient long term research funding;
(B) adequate coordination across Federal
and State government agencies and among gov-
ernment, academia, and industry;
(C) sufficient numbers of outstanding re-
searchers in the field; and
(D) market incentives for the design of
commercial and consumer security solutions.
(5) Accordingly, Federal investment in com-
puter and network security research and develop-
ment must be significantly increased to—
(A) improve vulnerability assessment and
technological and systems solutions;
(B) expand and improve the pool of infor-
mation security professionals, including re-
searchers, in the United States workforce; and
HR 3394 RH
(C) better coordinate information sharing
and collaboration among industry, government,
and academic research projects.
SEC. 3. DEFINITIONS.
For purposes of this Act—
(1) the term ‘‘Director’’ means the Director of
the National Science Foundation; and
(2) the term ‘‘institution of higher education’’
has the meaning given that term in section 101 of
the Higher Education Act of 1965 (20 U.S.C.
1001).
SEC. 4. NATIONAL SCIENCE FOUNDATION RESEARCH.
(a) COMPUTER AND NETWORK SECURITY RESEARCH
GRANTS.—
(1) IN
GENERAL.—The Director shall award
grants for basic research on innovative approaches
to the structure of computer and network hardware
and software that are aimed at enhancing computer
security. Research areas may include—
(A) authentication and cryptography;
(B) computer forensics and intrusion de-
tection;
(C) reliability of computer and network ap-
plications, middleware, operating systems, and
communications infrastructure; and
HR 3394 RH
(D) privacy and confidentiality.
(2) MERIT
REVIEW; 
COMPETITION.—Grants
shall be awarded under this section on a merit-re-
viewed competitive basis.
(3) AUTHORIZATION
OF
APPROPRIATIONS.—
There are authorized to be appropriated to the Na-
tional Science Foundation to carry out this
subsection—
(A) $35,000,000 for fiscal year 2003;
(B) $40,000,000 for fiscal year 2004;
(C) $46,000,000 for fiscal year 2005;
(D) $52,000,000 for fiscal year 2006; and
(E) $60,000,000 for fiscal year 2007.
(b) COMPUTER AND NETWORK SECURITY RESEARCH
CENTERS.—
(1) IN
GENERAL.—The Director shall award
multiyear grants, subject to the availability of appro-
priations, to institutions of higher education (or con-
sortia thereof) to establish multidisciplinary Centers
for Computer and Network Security Research. Insti-
tutions of higher education (or consortia thereof) re-
ceiving such grants may partner with one or more
government laboratories or for-profit institutions.
HR 3394 RH
(2) MERIT
REVIEW; 
COMPETITION.—Grants
shall be awarded under this subsection on a merit-
reviewed competitive basis.
(3) PURPOSE.—The purpose of the Centers
shall be to generate innovative approaches to com-
puter and network security by conducting cutting-
edge, multidisciplinary research in computer and
network security, including the research areas de-
scribed in subsection (a)(1).
(4) APPLICATIONS.—An institution of higher
education (or a consortium of such institutions)
seeking funding under this subsection shall submit
an application to the Director at such time, in such
manner, and containing such information as the Di-
rector may require. The application shall include, at
a minimum, a description of—
(A) the research projects that will be un-
dertaken by the Center and the contributions of
each of the participating entities;
(B) how the Center will promote active col-
laboration among scientists and engineers from
different disciplines, such as computer sci-
entists, engineers, mathematicians, and social
science researchers; and
HR 3394 RH
(C) how the Center will contribute to in-
creasing the number of computer and network
security researchers and other professionals.
(5) CRITERIA.—In evaluating the applications
submitted under paragraph (4), the Director shall
consider, at a minimum—
(A) the ability of the applicant to generate
innovative approaches to computer and network
security and effectively carry out the research
program;
(B) the experience of the applicant in con-
ducting research on computer and network se-
curity and the capacity of the applicant to fos-
ter new multidisciplinary collaborations;
(C) the capacity of the applicant to attract
and provide adequate support for under-
graduate 
and 
graduate 
students 
and
postdoctoral fellows to pursue computer and
network security research; and
(D) the extent to which the applicant will
partner with government laboratories or for-
profit entities, and the role the government lab-
oratories or for-profit entities will play in the
research undertaken by the Center.
HR 3394 RH
(6) ANNUAL
MEETING.—The Director shall
convene an annual meeting of the Centers in order
to foster collaboration and communication between
Center participants.
(7) AUTHORIZATION
OF
APPROPRIATIONS.—
There are authorized to be appropriated for the Na-
tional Science Foundation to carry out this
subsection—
(A) $12,000,000 for fiscal year 2003;
(B) $24,000,000 for fiscal year 2004;
(C) $36,000,000 for fiscal year 2005;
(D) $36,000,000 for fiscal year 2006; and
(E) $36,000,000 for fiscal year 2007.
SEC. 5. NATIONAL SCIENCE FOUNDATION COMPUTER AND
NETWORK SECURITY PROGRAMS.
(a) COMPUTER AND NETWORK SECURITY CAPACITY
BUILDING GRANTS.—
(1) IN GENERAL.—The Director shall establish
a program to award grants to institutions of higher
education (or consortia thereof) to establish or im-
prove undergraduate and master’s degree programs
in computer and network security, to increase the
number of students who pursue undergraduate or
master’s degrees in fields related to computer and
network security, and to provide students with expe-
HR 3394 RH
rience in government or industry related to their
computer and network security studies.
(2) MERIT REVIEW.—Grants shall be awarded
under this subsection on a merit-reviewed competi-
tive basis.
(3) USE
OF
FUNDS.—Grants awarded under
this subsection shall be used for activities that en-
hance the ability of an institution of higher edu-
cation (or consortium thereof) to provide high-qual-
ity undergraduate and master’s degree programs in
computer and network security and to recruit and
retain increased numbers of students to such pro-
grams. Activities may include—
(A) revising curriculum to better prepare
undergraduate and master’s degree students for
careers in computer and network security;
(B) establishing degree and certificate pro-
grams in computer and network security;
(C) creating opportunities for under-
graduate students to participate in computer
and network security research projects;
(D) acquiring equipment necessary for stu-
dent instruction in computer and network secu-
rity, including the installation of testbed net-
works for student use;
HR 3394 RH
(E) providing opportunities for faculty to
work with local or Federal Government agen-
cies, private industry, or other academic institu-
tions to develop new expertise or to formulate
new research directions in computer and net-
work security;
(F) establishing collaborations with other
academic institutions or departments that seek
to establish, expand, or enhance programs in
computer and network security;
(G) establishing student internships in
computer and network security at government
agencies or in private industry;
(H) establishing or enhancing bridge pro-
grams in computer and network security be-
tween community colleges and universities; and
(I) any other activities the Director deter-
mines will accomplish the goals of this sub-
section.
(4) SELECTION PROCESS.—
(A) APPLICATION.—An institution of high-
er education (or a consortium thereof) seeking
funding under this subsection shall submit an
application to the Director at such time, in such
manner, and containing such information as the
HR 3394 RH
Director may require. The application shall in-
clude, at a minimum—
(i) a description of the applicant’s
computer and network security research
and instructional capacity, and in the case
of an application from a consortium of in-
stitutions of higher education, a descrip-
tion of the role that each member will play
in implementing the proposal;
(ii) a comprehensive plan by which the
institution or consortium will build instruc-
tional capacity in computer and informa-
tion security;
(iii) a description of relevant collabo-
rations with government agencies or pri-
vate industry that inform the instructional
program in computer and network secu-
rity;
(iv) a survey of the applicant’s his-
toric student enrollment and placement
data in fields related to computer and net-
work security and a study of potential en-
rollment and placement for students en-
rolled in the proposed computer and net-
work security program; and
HR 3394 RH
(v) a plan to evaluate the success of
the proposed computer and network secu-
rity program, including post-graduation as-
sessment of graduate school and job place-
ment and retention rates as well as the rel-
evance of the instructional program to
graduate study and to the workplace.
(B) AWARDS.—(i) The Director shall en-
sure, to the extent practicable, that grants are
awarded under this subsection in a wide range
of geographic areas and categories of institu-
tions of higher education.
(ii) The Director shall award grants under
this subsection for a period not to exceed 5
years.
(5) ASSESSMENT
REQUIRED.—The Director
shall evaluate the program established under this
subsection no later than 6 years after the establish-
ment of the program. At a minimum, the Director
shall evaluate the extent to which the grants
achieved their objectives of increasing the quality
and quantity of students pursuing undergraduate or
master’s degrees in computer and network security.
(6) AUTHORIZATION
OF
APPROPRIATIONS.—
There are authorized to be appropriated to the Na-
HR 3394 RH
tional Science Foundation to carry out this
subsection—
(A) $15,000,000 for fiscal year 2003;
(B) $20,000,000 for fiscal year 2004;
(C) $20,000,000 for fiscal year 2005;
(D) $20,000,000 for fiscal year 2006; and
(E) $20,000,000 for fiscal year 2007.
(b) SCIENTIFIC AND ADVANCED TECHNOLOGY ACT
OF 1992.—
(1) 
GRANTS.—The 
Director 
shall 
provide
grants under the Scientific and Advanced Tech-
nology Act of 1992 for the purposes of section 3(a)
and (b) of that Act, except that the activities sup-
ported pursuant to this subsection shall be limited to
improving education in fields related to computer
and network security.
(2) AUTHORIZATION
OF
APPROPRIATIONS.—
There are authorized to be appropriated to the Na-
tional Science Foundation to carry out this
subsection—
(A) $1,000,000 for fiscal year 2003;
(B) $1,250,000 for fiscal year 2004;
(C) $1,250,000 for fiscal year 2005;
(D) $1,250,000 for fiscal year 2006; and
(E) $1,250,000 for fiscal year 2007.
HR 3394 RH
(c) GRADUATE TRAINEESHIPS IN COMPUTER AND
NETWORK SECURITY RESEARCH.—
(1) IN GENERAL.—The Director shall establish
a program to award grants to institutions of higher
education to establish traineeship programs for
graduate students who pursue computer and net-
work security research leading to a doctorate degree
by providing funding and other assistance, and by
providing graduate students with research experience
in government or industry related to the students’
computer and network security studies.
(2) MERIT REVIEW.—Grants shall be provided
under this subsection on a merit-reviewed competi-
tive basis.
(3) USE OF FUNDS.—An institution of higher
education shall use grant funds for the purposes
of—
(A) providing fellowships to students who
are citizens, nationals, or lawfully admitted per-
manent resident aliens of the United States and
are pursuing research in computer or network
security leading to a doctorate degree;
(B) paying tuition and fees for students
receiving fellowships under subparagraph (A);
HR 3394 RH
(C) establishing scientific internship pro-
grams for students receiving fellowships under
subparagraph (A) in computer and network se-
curity at for-profit institutions or government
laboratories; and
(D) other costs associated with the admin-
istration of the program.
(4) FELLOWSHIP
AMOUNT.—Fellowships pro-
vided under paragraph (3)(A) shall be in the amount
of $25,000 per year, or the level of the National
Science Foundation Graduate Research Fellowships,
whichever is greater, for up to 3 years.
(5) SELECTION
PROCESS.—An institution of
higher education seeking funding under this sub-
section shall submit an application to the Director at
such time, in such manner, and containing such in-
formation as the Director may require. The applica-
tion shall include, at a minimum, a description of—
(A) the instructional program and research
opportunities in computer and network security
available to graduate students at the applicant’s
institution; and
(B) the internship program to be estab-
lished, including the opportunities that will be
made available to students for internships at
HR 3394 RH
for-profit institutions and government labora-
tories.
(6) REVIEW OF APPLICATIONS.—In evaluating
the applications submitted under paragraph (5), the
Director shall consider—
(A) the ability of the applicant to effec-
tively carry out the proposed program;
(B) the quality of the applicant’s existing
research and education programs;
(C) the likelihood that the program will re-
cruit increased numbers of students to pursue
and earn doctorate degrees in computer and
network security;
(D) the nature and quality of the intern-
ship program established through collaborations
with government laboratories and for-profit in-
stitutions;
(E) the integration of internship opportu-
nities into graduate students’ research; and
(F) the relevance of the proposed program
to current and future computer and network se-
curity needs.
(7) AUTHORIZATION
OF
APPROPRIATIONS.—
There are authorized to be appropriated to the Na-
HR 3394 RH
tional Science Foundation to carry our this
subsection—
(A) $10,000,000 for fiscal year 2003;
(B) $20,000,000 for fiscal year 2004;
(C) $20,000,000 for fiscal year 2005;
(D) $20,000,000 for fiscal year 2006; and
(E) $20,000,000 for fiscal year 2007.
(d) GRADUATE RESEARCH FELLOWSHIPS PROGRAM
SUPPORT.—Computer and network security shall be in-
cluded among the fields of specialization supported by the
National Science Foundation’s Graduate Research Fellow-
ships program under section 10 of the National Science
Foundation Act of 1950 (42 U.S.C. 1869).
SEC. 6. CONSULTATION.
In carrying out sections 4 and 5, the Director shall
consult with other Federal agencies.
SEC. 7. FOSTERING RESEARCH AND EDUCATION IN COM-
PUTER AND NETWORK SECURITY.
Section 3(a) of the National Science Foundation Act
of 1950 (42 U.S.C. 1862(a)) is amended—
(1) by striking ‘‘and’’ at the end of paragraph
(6);
(2) by striking the period at the end of para-
graph (7) and inserting ‘‘; and’’; and
HR 3394 RH
(3) by adding at the end the following new
paragraph:
‘‘(8) to take a leading role in fostering and sup-
porting research and education activities to improve
the security of networked information systems.’’.
SEC. 8. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY RESEARCH PROGRAM.
The National Institute of Standards and Technology
Act is amended—
(1) by moving section 22 to the end of the Act
and redesignating it as section 32;
(2) by inserting after section 21 the following
new section:
‘‘RESEARCH PROGRAM ON SECURITY OF COMPUTER
SYSTEMS
‘‘SEC. 22. (a) ESTABLISHMENT.—The Director shall
establish a program of assistance to institutions of higher
education that enter into partnerships with for-profit enti-
ties to support research to improve the security of com-
puter systems. The partnerships may also include govern-
ment laboratories. The program shall—
‘‘(1) include multidisciplinary, long-term, high-
risk research;
‘‘(2) include research directed toward address-
ing needs identified through the activities of the
HR 3394 RH
‘‘(1) the term ‘computer system’ has the mean-
ing given that term in section 20(d)(1); and
‘‘(2) the term ‘institution of higher education’
has the meaning given that term in section 101 of
the Higher Education Act of 1965 (20 U.S.C.
1001).’’; and
(3) in section 20(d)(1)(B)(i) (15 U.S.C. 278g–
3(d)(1)(B)(i)), by inserting ‘‘and computer net-
works’’ after ‘‘computers’’.
SEC. 9. COMPUTER SECURITY REVIEW, PUBLIC MEETINGS,
AND INFORMATION.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3) is amended by adding
at the end the following new subsection:
‘‘(f) There are authorized to be appropriated to the
Secretary $1,060,000 for fiscal year 2003 and $1,090,000
for fiscal year 2004 to enable the Computer System Secu-
rity and Privacy Advisory Board, established by section
21, to identify emerging issues, including research needs,
related to computer security, privacy, and cryptography
and, as appropriate, to convene public meetings on those
subjects, receive presentations, and publish reports, di-
gests, and summaries for public distribution on those sub-
jects.’’.
HR 3394 RH
SEC. 10. INTRAMUTAL SECURITY RESEARCH.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3) is further amended—
(1) by redesignating subsection (d) as sub-
section (e); and
(2) by inserting after subsection (c) the fol-
lowing new subsection:
‘‘(d) As part of the research activities conducted in
accordance with subsection (b)(4), the Institute shall—
‘‘(1) conduct a research program to address
emerging technologies associated with assembling a
networked computer system from components while
ensuring it maintains desired security properties;
‘‘(2) carry out research and support standards
development activities associated with improving the
security of real-time computing and communications
systems for use in process control; and
‘‘(3) carry out multidisciplinary, long-term,
high-risk research on ways to improve the security
of computer systems.’’.
SEC. 11. AUTHORIZATION OF APPROPRIATIONS.
There are authorized to be appropriated to the Sec-
retary of Commerce for the National Institute of Stand-
ards and Technology—
HR 3394 RH
(1) for activities under section 22 of the Na-
tional Institute of Standards and Technology Act, as
added by section 8 of this Act—
(A) $25,000,000 for fiscal year 2003;
(B) $40,000,000 for fiscal year 2004;
(C) $55,000,000 for fiscal year 2005;
(D) $70,000,000 for fiscal year 2006;
(E) $85,000,000 for fiscal year 2007; and
(F) such sums as may be necessary for fis-
cal years 2008 through 2012; and
(2) for activities under section 20(d) of the Na-
tional Institute of Standards and Technology Act, as
added by section 10 of this Act—
(A) $6,000,000 for fiscal year 2003;
(B) $6,200,000 for fiscal year 2004;
(C) $6,400,000 for fiscal year 2005;
(D) $6,600,000 for fiscal year 2006; and
(E) $6,800,000 for fiscal year 2007.
SEC. 12. NATIONAL ACADEMY OF SCIENCES STUDY ON
COMPUTER AND NETWORK SECURITY IN
CRITICAL INFRASTRUCTURES.
(a) STUDY.—Not later than 3 months after the date
of the enactment of this Act, the Director of the National
Institute of Standards and Technology shall enter into an
arrangement with the National Research Council of the
HR 3394 RH
National Academy of Sciences to conduct a study of the
vulnerabilities of the Nation’s network infrastructure and
make recommendations for appropriate improvements.
The National Research Council shall—
(1) review existing studies and associated data
on the architectural, hardware, and software
vulnerabilities and interdependencies in United
States critical infrastructure networks;
(2) identify and assess gaps in technical capa-
bility for robust critical infrastructure network secu-
rity, and make recommendations for research prior-
ities and resource requirements; and
(3) review any and all other essential elements
of computer and network security, including security
of industrial process controls, to be determined in
the conduct of the study.
(b) REPORT.—The Director of the National Institute
of Standards and Technology shall transmit a report con-
taining the results of the study and recommendations re-
quired by subsection (a) to the Congress not later than
21 months after the date of enactment of this Act.
(c) SECURITY.—The Director of the National Insti-
tute of Standards and Technology shall ensure that no in-
formation that is classified is included in any publicly re-
leased version of the report required by this section.
HR 3394 RH
(d) AUTHORIZATION
OF APPROPRIATIONS.—There
are authorized to be appropriated to the Secretary of Com-
merce for the National Institute of Standards and Tech-
nology for the purposes of carrying out this section,
$700,000.
Union Calendar No. 208
107TH CONGRESS
2D SESSION
H. R. 3394
[Report No. 107–355, Part I]
A BILL
To authorize funding for computer and network se-
curity research and development and research
fellowship programs, and for other purposes.
FEBRUARY 4, 2002
Reported from the Committee on Science
FEBRUARY 4, 2002
Referral to the Committee on Education and the Work-
force extended for a period ending not later than Feb-
ruary 4, 2002
FEBRUARY 4, 2002
Committee discharged; committed to the Committee of
the Whole House on the State of the Union and or-
dered to be printed