124
(c) MAINTAINING THE ACCURACY AND INTEGRITY OF 
THE ‘‘NO FLY’’ AND ‘‘AUTOMATIC SELECTEE’’ LISTS.—
(1) WATCHLIST DATABASE.—The Secretary of 
Homeland Security, in consultation with the Direc-
tor of the Federal Bureau of Investigation, shall de-
sign guidelines, policies, and operating procedures 
for the collection, removal, and updating of data 
maintained, or to be maintained, in the watchlist 
database described in subsection (a)(1) that are de-
signed to ensure the accuracy and integrity of the 
database. 
(2) ACCURACY OF ENTRIES.—In developing the 
‘‘no fly’’ and ‘‘automatic selectee’’ lists under sub-
section (a)(2), the Secretary of Homeland Security 
shall establish a simple and timely method for cor-
recting erroneous entries, for clarifying information 
known to cause false hits or misidentification errors, 
and for updating relevant information that is dis-
positive in the passenger screening process. The Sec-
retary shall also establish a process to provide indi-
viduals whose names are confused with, or similar 
to, names in the database with a means of dem-
onstrating that they are not a person named in the 
database.
125
TITLE 
VIII—IMPROVING 
PRI-
VATE 
SECTOR 
PREPARED-
NESS 
SEC. 161. SHORT TITLE. 
This title may be cited as the ‘‘Private Sector Pre-
paredness Act of 2004’’. 
SEC. 162. FINDINGS. 
Congress finds the following: 
(1) Private sector organizations own 85 percent 
of the Nation‘‘s infrastructure facilities and employ 
the vast majority of the Nation’’s employees. The re-
sources of these organizations, including property 
and personnel, can be coordinated in an emergency 
situation more efficiently than the population in gen-
eral. 
(2) Private sector organizations are often un-
prepared for emergencies, whether resulting from a 
natural disaster or a terrorist incident. Although 
there have been exemplary efforts by select private 
sector organizations, emergency preparedness is not 
generally a priority for these organizations. 
(3) The hearings of and testimony before the 
National Commission on Terrorist Attacks Upon the 
United States demonstrated that the lack of emer-
gency preparedness and evacuation planning, train-
126
ing, and exercises by private sector organizations 
may have contributed to additional casualties at the 
World Trade Center on September 11, 2001. 
(4) Although there may be an interest in pro-
moting emergency preparedness within private sector 
organizations, there remains uncertainty and confu-
sion as to the definition of appropriate and adequate 
preparedness and what actions these organizations 
should take. 
(5) Identifying standards and best practices is 
necessary to promote emergency preparedness by 
private sector organizations, in addition to edu-
cational activities to effectively communicate such 
standards and best practices. 
SEC. 163. PRIVATE SECTOR EMERGENCY PREPAREDNESS 
PROGRAM. 
(a) ESTABLISHMENT
OF
PREPAREDNESS
PRO-
GRAM.—Title V of the Homeland Security Act of 2002 
(6 U.S.C. 311 et seq.) is amended by adding at the end 
the following: 
‘‘SEC. 510. PRIVATE SECTOR EMERGENCY PREPAREDNESS 
PROGRAM. 
‘‘(a) PREPAREDNESS PROGRAM.—Not later than 90 
days after the date of enactment of this section, the Sec-
retary shall develop and implement a program to enhance
127
private sector preparedness for emergencies and disasters, 
including emergencies resulting from acts of terrorism. 
‘‘(b) PROGRAM ELEMENTS.—In carrying out the pro-
gram, the Secretary shall develop guidance and identify 
best practices to assist or foster action by the private sec-
tor in 
‘‘(1) identifying hazards and assessing risks 
and impacts; 
‘‘(2) mitigating the impacts of a wide variety of 
hazards, including weapons of mass destruction; 
‘‘(3) managing necessary emergency prepared-
ness and response resources; 
‘‘(4) developing mutual aid agreements; 
‘‘(5) developing and maintaining emergency 
preparedness and response plans, as well as associ-
ated operational procedures; 
‘‘(6) developing and maintaining communica-
tions and warning systems; 
‘‘(7) developing and conducting training and ex-
ercises to support and evaluate emergency prepared-
ness and response plans and operational procedures; 
‘‘(8) developing and conducting training pro-
grams for security guards to implement emergency 
preparedness and response plans and operations pro-
cedures; and
128
‘‘(9) developing procedures to respond to exter-
nal requests for information from the media and the 
public. 
‘‘(c) STANDARDS.—
‘‘(1) IN GENERAL.—The Secretary shall sup-
port the development of, promulgate, and regularly 
update as necessary national voluntary consensus 
standards for private sector emergency preparedness 
that will enable private sector organizations to 
achieve optimal levels of emergency preparedness as 
soon as practicable. Such standards include the Na-
tional Fire Protection Association 1600 Standard on 
Disaster/Emergency Management and Business Con-
tinuity Programs. 
‘‘(2) CONSULTATION.—The Secretary shall 
carry out paragraph (1) in consultation with the 
Under Secretary for Emergency Preparedness and 
Response, the Under Secretary for Science and 
Technology, the Under Secretary for Information 
Analysis and Infrastructure Protection, and the Spe-
cial Assistant to the Secretary for the Private Sec-
tor. 
‘‘(d) COORDINATION.—The Secretary shall coordi-
nate the program with, and utilize to the maximum extent 
practicable
129
‘‘(1) the voluntary standards for disaster and 
emergency management and business continuity pro-
grams developed by the American National Stand-
ards Institute and the National Fire Protection As-
sociation; and 
‘‘(2) any existing private sector emergency pre-
paredness guidance or best practices developed by 
private sector industry associations or other organi-
zations.’’. 
(b) CONFORMING AMENDMENT.—The table of con-
tents contained in section 1(b) of such Act (116 Stat. 
2135) is amended by inserting after the item relating to 
section 509 the following:
‘‘Sec. 510. Private sector emergency preparedness program.’’.
TITLE IX—INCREASING 
INFORMATION SHARING 
SEC. 165. INFORMATION SHARING. 
(a) DEFINITIONS.—In this section: 
(1) EXECUTIVE COUNCIL.—The term ‘‘Execu-
tive Council’’ means the Executive Council on Infor-
mation Sharing established under subsection (h). 
(2) HOMELAND SECURITY INFORMATION.—The 
term ‘‘homeland security information’’ means all in-
formation, whether collected, produced, or distrib-
uted by intelligence, law enforcement, military, 
homeland security, or other activities relating to—
130
(A) the existence, organization, capabili-
ties, plans, intentions, vulnerabilities, means of 
finance or material support, or activities of for-
eign or international terrorist groups or individ-
uals, or of domestic groups or individuals in-
volved in transnational terrorism; 
(B) threats posed by such groups or indi-
viduals to the United States, United States per-
sons, or United States interests, or to those of 
other nations; 
(C) communications of or by such groups 
or individuals; or 
(D) groups or individuals reasonably be-
lieved to be assisting or associated with such 
groups or individuals. 
(3) NETWORK.—The term ‘‘Network’’ means 
the Information Sharing Network described under 
subsection (c). 
(b) FINDINGS.—Consistent with the report of the Na-
tional Commission on Terrorist Attacks upon the United 
States, Congress makes the following findings: 
(1) The effective use of information, from all 
available sources, is essential to the fight against 
terror and the protection of our homeland. The big-
gest impediment to all-source analysis, and to a
131
greater likelihood of ‘‘connecting the dots’’, is resist-
ance to sharing information. 
(2) The United States Government has access 
to a vast amount of information, including not only 
traditional intelligence but also other government 
databases, such as those containing customs or im-
migration information. However, the United States 
Government has a weak system for processing and 
using the information it has. 
(3) In the period preceding September 11, 
2001, there were instances of potentially helpful in-
formation that was available but that no person 
knew to ask for; information that was distributed 
only in compartmented channels, and information 
that was requested but could not be shared. 
(4) Current security requirements nurture over-
classification and excessive compartmentalization of 
information among agencies. Each agency″s incen-
tive structure opposes sharing, with risks, including 
criminal, civil, and administrative sanctions, but few 
rewards for sharing information. 
(5) The current system, in which each intel-
ligence agency has its own security practices, re-
quires a demonstrated ‘‘need to know’’ before shar-
ing. This approach assumes that it is possible to
132
know, in advance, who will need to use the informa-
tion. An outgrowth of the cold war, such a system 
implicitly assumes that the risk of inadvertent dis-
closure outweighs the benefits of wider sharing. 
Such assumptions are no longer appropriate. Al-
though counterintelligence concerns are still real, the 
costs of not sharing information are also substantial. 
The current ‘‘need-to-know’’ culture of information 
protection needs to be replaced with a ‘‘need-to-
share’’ culture of integration. 
(6) A new approach to the sharing of intel-
ligence and homeland security information is ur-
gently needed. An important conceptual model for a 
new ‘‘trusted information network’’ is the System-
wide Homeland Analysis and Resource Exchange 
(SHARE) Network proposed by a task force of lead-
ing professionals assembled by the Markle Founda-
tion and described in reports issued in October 2002 
and December 2003. 
(7) No single agency can create a meaningful 
information sharing system on its own. Alone, each 
agency can only modernize stovepipes, not replace 
them. Presidential leadership is required to bring 
about governmentwide change. 
(c) INFORMATION SHARING NETWORK.—
133
(1) ESTABLISHMENT.—The President shall es-
tablish a trusted information network and secure in-
formation sharing environment to promote sharing 
of intelligence and homeland security information in 
a manner consistent with national security and the 
protection of privacy and civil liberties, and based on 
clearly defined and consistently applied policies and 
procedures, and valid investigative, analytical or 
operational requirements. 
(2) ATTRIBUTES.—The Network shall promote 
coordination, communication and collaboration of 
people and information among all relevant Federal 
departments and agencies, State, tribal, and local 
authorities, and relevant private sector entities, in-
cluding owners and operators of critical infrastruc-
ture, by using policy guidelines and technologies that 
support—
(A) a decentralized, distributed, and co-
ordinated environment that connects existing 
systems where appropriate and allows users to 
share information among agencies, between lev-
els of government, and, as appropriate, with the 
private sector;
134
(B) the sharing of information in a form 
and manner that facilitates its use in analysis, 
investigations and operations; 
(C) building upon existing systems capa-
bilities currently in use across the Government; 
(D) utilizing industry best practices, in-
cluding minimizing the centralization of data 
and seeking to use common tools and capabili-
ties whenever possible; 
(E) employing an information access man-
agement approach that controls access to data 
rather than to just networks; 
(F) facilitating the sharing of information 
at and across all levels of security by using pol-
icy guidelines and technologies that support 
writing information that can be broadly shared; 
(G) providing directory services for locat-
ing people and information; 
(H) incorporating protections for individ-
uals’ privacy and civil liberties; 
(I) incorporating strong mechanisms for 
information security and privacy and civil lib-
erties guideline enforcement in order to enhance 
accountability and facilitate oversight, includ-
ing—
135
(i) multifactor authentication and ac-
cess control; 
(ii) strong encryption and data protec-
tion; 
(iii) immutable audit capabilities; 
(iv) automated policy enforcement; 
(v) perpetual, automated screening for 
abuses of network and intrusions; and 
(vi) uniform classification and han-
dling procedures; 
(J) compliance with requirements of appli-
cable law and guidance with regard to the plan-
ning, design, acquisition, operation, and man-
agement of information systems; and 
(K) permitting continuous system up-
grades to benefit from advances in technology 
while preserving the integrity of stored data. 
(d) IMMEDIATE ACTIONS.—Not later than 90 days 
after the date of the enactment of this Act, the Director 
of the Office of Management and Budget, in consultation 
with the Executive Council, shall—
(1) submit to the President and to Congress a 
description of the technological, legal, and policy 
issues presented by the creation of the Network de-
136
scribed in subsection (c), and the way in which these 
issues will be addressed; 
(2) establish electronic directory services to as-
sist in locating in the Federal Government intel-
ligence and homeland security information and peo-
ple with relevant knowledge about intelligence and 
homeland security information; and 
(3) conduct a review of relevant current Federal 
agency capabilities, including—
(A) a baseline inventory of current Federal 
systems that contain intelligence or homeland 
security information; 
(B) the money currently spent to maintain 
those systems; and 
(C) identification of other information that 
should be included in the Network. 
(e) GUIDELINES AND REQUIREMENTS.—As soon as 
possible, but in no event later than 180 days after the 
date of the enactment of this Act, the President shall—
(1) in consultation with the Executive Council, 
issue guidelines—
(A) for acquiring, accessing, sharing, and 
using information, including guidelines to en-
sure that information is provided in its most 
shareable form, such as by separating out data
137
from the sources and methods by which that 
data are obtained; and 
(B) on classification policy and handling 
procedures across Federal agencies, including 
commonly accepted processing and access con-
trols; 
(2) in consultation with the Privacy and Civil 
Liberties Oversight Board established under section 
226, that—
(A) protect privacy and civil liberties in the 
development and use of the Network; and 
(B) shall be made public, unless, and only 
to the extent that, nondisclosure is clearly nec-
essary to protect national security; and 
(3) require the heads of Federal departments 
and agencies to promote a culture of information 
sharing by—
(A) reducing disincentives to information 
sharing, including overclassification of informa-
tion and unnecessary requirements for origi-
nator approval; and 
(B) providing affirmative incentives for in-
formation sharing, such as the incorporation of 
information sharing performance measures into 
agency and managerial evaluations, and em-
138
ployee awards for promoting innovative infor-
mation sharing practices. 
(f) ENTERPRISE ARCHITECTURE AND IMPLEMENTA-
TION PLAN.—Not later than 270 days after the date of 
the enactment of this Act, the Director of Management 
and Budget shall submit to the President and to Congress 
an enterprise architecture and implementation plan for the 
Network. The enterprise architecture and implementation 
plan shall be prepared by the Director of Management and 
Budget, in consultation with the Executive Council, and 
shall include—
(1) a description of the parameters of the pro-
posed Network, including functions, capabilities, and 
resources; 
(2) a delineation of the roles of the Federal de-
partments and agencies that will participate in the 
development of the Network, including identification 
of any agency that will build the infrastructure need-
ed to operate and manage the Network (as distinct 
from the individual agency components that are to 
be part of the Network), with the delineation of roles 
to be consistent with—
(A) the authority of the National Intel-
ligence Director under this Act to set standards 
for information sharing and information tech-
139
nology throughout the intelligence community; 
and 
(B) the authority of the Secretary of 
Homeland Security and the role of the Depart-
ment of Homeland Security in coordinating 
with State, tribal, and local officials and the 
private sector; 
(3) a description of the technological require-
ments to appropriately link and enhance existing 
networks and a description of the system design that 
will meet these requirements; 
(4) an enterprise architecture that—
(A) is consistent with applicable laws and 
guidance with regard to planning, design, acqui-
sition, operation, and management of informa-
tion systems; 
(B) will be used to guide and define the 
development and implementation of the Net-
work; and 
(C) addresses the existing and planned en-
terprise architectures of the departments and 
agencies participating in the Network; 
(5) a description of how privacy and civil lib-
erties will be protected throughout the design and 
implementation of the Network;
140
(6) objective, systemwide performance measures 
to enable the assessment of progress toward achiev-
ing full implementation of the Network; 
(7) a plan, including a time line, for the devel-
opment and phased implementation of the Network; 
(8) total budget requirements to develop and 
implement the Network, including the estimated an-
nual cost for each of the 5 years following the date 
of the enactment of this Act; and 
(9) proposals for any legislation that the Direc-
tor of Management and Budget determines nec-
essary to implement the Network. 
(g) DIRECTOR OF MANAGEMENT AND BUDGET RE-
SPONSIBLE
FOR INFORMATION SHARING ACROSS
THE 
FEDERAL GOVERNMENT.—
(1) ADDITIONAL
DUTIES
AND
RESPONSIBIL-
ITIES.—
(A) IN GENERAL.—The Director of Man-
agement and Budget, in consultation with the 
Executive Council, shall—
(i) implement and manage the Net-
work; 
(ii) develop and implement policies, 
procedures, guidelines, rules, and stand-
ards as appropriate to foster the develop-
141
ment and proper operation of the Network; 
and 
(iii) assist, monitor, and assess the 
implementation of the Network by Federal 
departments and agencies to ensure ade-
quate progress, technological consistency 
and policy compliance; and regularly report 
the findings to the President and to Con-
gress. 
(B) CONTENT OF POLICIES, PROCEDURES, 
GUIDELINES, RULES, AND
STANDARDS.—The 
policies, procedures, guidelines, rules, and 
standards under subparagraph (A)(ii) shall—
(i) take into account the varying mis-
sions and security requirements of agencies 
participating in the Network; 
(ii) address development, implementa-
tion, and oversight of technical standards 
and requirements; 
(iii) address and facilitate information 
sharing between and among departments 
and agencies of the intelligence community, 
the Department of Defense, the homeland 
security community and the law enforce-
ment community;
142
(iv) address and facilitate information 
sharing between Federal departments and 
agencies and State, tribal and local govern-
ments; 
(v) address and facilitate, as appro-
priate, information sharing between Fed-
eral departments and agencies and the pri-
vate sector; 
(vi) address and facilitate, as appro-
priate, information sharing between Fed-
eral departments and agencies with foreign 
partners and allies; and 
(vii) ensure the protection of privacy 
and civil liberties. 
(2) APPOINTMENT OF PRINCIPAL OFFICER.—
Not later than 30 days after the date of the enact-
ment of this Act, the Director of Management and 
Budget shall appoint, with approval of the Presi-
dent, a principal officer in the Office of Management 
and Budget whose primary responsibility shall be to 
carry out the day-to-day duties of the Director speci-
fied in this section. The officer shall report directly 
to the Director of Management and Budget, have 
the rank of a Deputy Director and shall be paid at 
the rate of pay payable for a position at level III of
143
the Executive Schedule under section 5314 of title 
5, United States Code. 
(h) EXECUTIVE COUNCIL ON INFORMATION SHAR-
ING.—
(1) ESTABLISHMENT.—There is established an 
Executive Council on Information Sharing that shall 
assist the Director of Management and Budget in 
the execution of the Director’s duties under this Act 
concerning information sharing. 
(2) MEMBERSHIP.—The members of the Execu-
tive Council shall be—
(A) the Director of Management and 
Budget, who shall serve as Chairman of the Ex-
ecutive Council; 
(B) the Secretary of Homeland Security or 
his designee; 
(C) the Secretary of Defense or his des-
ignee; 
(D) the Attorney General or his designee; 
(E) the Secretary of State or his designee; 
(F) the Director of the Federal Bureau of 
Investigation or his designee; 
(G) the National Intelligence Director or 
his designee;
144
(H) such other Federal officials as the 
President shall designate; 
(I) representatives of State, tribal, and 
local governments, to be appointed by the Presi-
dent; and 
(J) individuals who are employed in private 
businesses or nonprofit organizations that own 
or operate critical infrastructure, to be ap-
pointed by the President. 
(3) RESPONSIBILITIES.—The Executive Council 
shall assist the Director of Management and Budget 
in—
(A) implementing and managing the Net-
work; 
(B) developing policies, procedures, guide-
lines, rules, and standards necessary to estab-
lish and implement the Network; 
(C) ensuring there is coordination among 
departments and agencies participating in the 
Network in the development and implementa-
tion of the Network; 
(D) reviewing, on an ongoing basis, poli-
cies, procedures, guidelines, rules, and stand-
ards related to the implementation of the Net-
work;
145
(E) establishing a dispute resolution proc-
ess to resolve disagreements among depart-
ments and agencies about whether particular 
information should be shared and in what man-
ner; and 
(F) considering such reports as are sub-
mitted by the Advisory Board on Information 
Sharing under subsection (i)(2). 
(4) REPORTS.—Not later than 1 year after the 
date of the enactment of this Act, and annually 
thereafter, the Director of Management and Budget, 
in the capacity of Chair of the Executive Council, 
shall submit a report to the President and to Con-
gress that shall include—
(A) a description of the activities and ac-
complishments of the Council in the preceding 
year; and 
(B) the number and dates of the meetings 
held by the Council and a list of attendees at 
each meeting. 
(5) INFORMING THE PUBLIC.—The Executive 
Council shall—
(A) make its reports to Congress available 
to the public to the greatest extent that is con-
146
sistent with the protection of classified informa-
tion and applicable law; and 
(B) otherwise inform the public of its ac-
tivities, as appropriate and in a manner con-
sistent with the protection of classified informa-
tion and applicable law. 
(i) REPORTS.—
(1) IN GENERAL.—Not later than 1 year after 
the date of the enactment of this Act, and semiannu-
ally thereafter, the President through the Director of 
Management and Budget shall submit a report to 
Congress on the state of the Network and of infor-
mation sharing across the Federal Government. 
(2) CONTENT.—Each report under this sub-
section shall include—
(A) a progress report on the extent to 
which the Network has been implemented, in-
cluding how the Network has fared on the gov-
ernment-wide and agency-specific performance 
measures and whether the performance goals 
set in the preceding year have been met; 
(B) 
objective 
systemwide 
performance 
goals for the following year; 
(C) an accounting of how much was spent 
on the Network in the preceding year;
147
(D) actions taken to ensure that agencies 
procure new technology that is consistent with 
the Network and information on whether new 
systems and technology are consistent with the 
Network; 
(E) the extent to which, in appropriate cir-
cumstances, all terrorism watch lists are avail-
able for combined searching in real time 
through the Network and whether there are 
consistent standards for placing individuals on, 
and removing individuals from, the watch lists, 
including the availability of processes for cor-
recting errors; 
(F) the extent to which unnecessary road-
blocks, impediments, or disincentives to infor-
mation sharing, including the inappropriate use 
of paper-only intelligence products and require-
ments for originator approval, have been elimi-
nated; 
(G) the extent to which positive incentives 
for information sharing have been implemented; 
(H) the extent to which classified informa-
tion is also made available through the Net-
work, in whole or in part, in unclassified form;
148
(I) the extent to which State, tribal, and 
local officials—
(i) are participating in the Network; 
(ii) have systems which have become 
integrated into the Network; 
(iii) are providing as well as receiving 
information; and 
(iv) are using the Network to commu-
nicate with each other; 
(J) the extent to which—
(i) private sector data, including infor-
mation from owners and operators of crit-
ical infrastructure, is incorporated in the 
Network; and 
(ii) the private sector is both pro-
viding and receiving information; 
(K) where private sector data has been 
used by the Government or has been incor-
porated into the Network—
(i) the measures taken to protect sen-
sitive business information; and 
(ii) where the data involves informa-
tion about individuals, the measures taken 
to ensure the accuracy of such data;
149
(L) the measures taken by the Federal 
Government to ensure the accuracy of other in-
formation on the Network and, in particular, 
the accuracy of information about individuals; 
(M) an assessment of the Network‘‘s pri-
vacy and civil liberties protections, including ac-
tions taken in the preceding year to implement 
or enforce privacy and civil liberties protections 
and a report of complaints received about inter-
ference with an individual’’s privacy or civil lib-
erties; and 
(N) an assessment of the security protec-
tions of the Network. 
(j) AGENCY RESPONSIBILITIES.—The head of each 
department or agency possessing or using intelligence or 
homeland security information or otherwise participating 
in the Network shall—
(1) ensure full department or agency compli-
ance with information sharing policies, procedures, 
guidelines, rules, and standards established for the 
Network under subsections (c) and (g); 
(2) ensure the provision of adequate resources 
for systems and activities supporting operation of 
and participation in the Network; and
150
(3) ensure full agency or department coopera-
tion in the development of the Network and associ-
ated enterprise architecture to implement govern-
mentwide information sharing, and in the manage-
ment and acquisition of information technology con-
sistent with applicable law. 
(k) AGENCY PLANS AND REPORTS.—Each Federal 
department or agency that possesses or uses intelligence 
and homeland security information, operates a system in 
the Network or otherwise participates, or expects to par-
ticipate, in the Network, shall submit to the Director of 
Management and Budget—
(1) not later than 1 year after the date of the 
enactment of this Act, a report including—
(A) a strategic plan for implementation of 
the Network’s requirements within the depart-
ment or agency; 
(B) objective performance measures to as-
sess the progress and adequacy of the depart-
ment or agency’s information sharing efforts; 
and 
(C) budgetary requirements to integrate 
the agency into the Network, including pro-
jected annual expenditures for each of the fol-
151
lowing 5 years following the submission of the 
report; and 
(2) annually thereafter, reports including—
(A) an assessment of the progress of the 
department or agency in complying with the 
Network’s requirements, including how well the 
agency has performed on the objective measures 
developed under paragraph (1)(B); 
(B) the agency’s expenditures to imple-
ment and comply with the Network’s require-
ments in the preceding year; and 
(C) the agency’s or department’s plans for 
further implementation of the Network in the 
year following the submission of the report. 
(l) PERIODIC ASSESSMENTS.—
(1) COMPTROLLER GENERAL.—
(A) IN GENERAL.—Not later than 1 year 
after the date of the enactment of this Act, and 
periodically thereafter, the Comptroller General 
shall evaluate the implementation of the Net-
work, both generally and, at the discretion of 
the Comptroller General, within specific depart-
ments and agencies, to determine the extent of 
compliance with the Network’s requirements 
and to assess the effectiveness of the Network
152
in improving information sharing and collabora-
tion and in protecting privacy and civil liberties, 
and shall report to Congress on the findings of 
the Comptroller General. 
(B) INFORMATION
AVAILABLE
TO
THE 
COMPTROLLER GENERAL.—Upon request by the 
Comptroller General, information relevant to an 
evaluation under subsection (a) shall be made 
available to the Comptroller General under sec-
tion 716 of title 31, United States Code. 
(C) CONSULTATION WITH CONGRESSIONAL 
COMMITTEES.—If a record is not made avail-
able to the Comptroller General within a rea-
sonable time, before the Comptroller General 
files a report under section 716(b)(1) of title 
31, United States Code, the Comptroller Gen-
eral shall consult with the Select Committee on 
Intelligence of the Senate, the Permanent Se-
lect Committee on Intelligence of the House of 
Representatives, the Committee on Govern-
mental Affairs of the Senate, and the Com-
mittee on Government Reform of the House of 
Representatives concerning the Comptroller’s 
intent to file a report.
153
(2) INSPECTORS
GENERAL.—The Inspector 
General in any Federal department or agency that 
possesses or uses intelligence or homeland security 
information or that otherwise participates in the 
Network shall, at the discretion of the Inspector 
General—
(A) conduct audits or investigations to—
(i) determine the compliance of that 
department or agency with the Network’s 
requirements; and 
(ii) assess the effectiveness of that de-
partment or agency in improving informa-
tion sharing and collaboration and in pro-
tecting privacy and civil liberties; and 
(B) issue reports on such audits and inves-
tigations. 
(3) CHIEF PRIVACY OFFICERS.—The Chief Pri-
vacy Officers established under section 5092 in any 
Federal department or agency that possesses or uses 
intelligence or homeland security information or that 
otherwise participates in the Network shall, at the 
discretion of the Chief Privacy Officer—
(A) conduct audits or investigations to en-
sure that the network, or the use of the net-
154
work by that department or agency, does not 
erode privacy protections; and 
(B) issue reports on such audits and inves-
tigations. 
(m) AUTHORIZATION OF APPROPRIATIONS.—There 
are authorized to be appropriated—
(1) $50,000,000 to the Director of Management 
and Budget to carry out this section for fiscal year 
2005; and 
(2) such sums as are necessary to carry out this 
section in each fiscal year thereafter, to be disbursed 
and allocated in accordance with the Network imple-
mentation plan required by subsection (f). 
(n) SECTION 1017.—Section 1017 of this Act shall 
have no force or effect. 
TITLE X—PROTECTING 
CRITICAL INFRASTRUCTURE 
SEC. 171. CRITICAL INFRASTRUCTURE EVALUATION AND 
PRIORITIZATION PROGRAM. 
(a) PROGRAM.—Not later than 90 days after the date 
of the enactment of this Act, the Secretary of Homeland 
Security shall develop, in cooperation with other relevant 
Federal agencies, State and local governments, and the 
private sector, as appropriate, a prioritized list of national 
critical infrastructure and key assets, based on the degree
155
to which destruction or significant disruption of such in-
frastructure or assets would result in—
(1) substantial human casualties; 
(2) a substantial adverse impact on the national 
economy; or 
(3) a substantial adverse impact on national se-
curity. 
(b) SECURITY PLAN.—
(1) REQUIREMENT.—Not later than 180 days 
after the date of the enactment of this Act, the Sec-
retary, in coordination with other relevant Federal 
agencies, State and local governments, and the pri-
vate sector, as appropriate, shall—
(A) review existing plans for securing the 
critical infrastructure and key assets included 
in the list under subsection (a); 
(B) recommend changes to existing plans 
and develop additional plans for securing such 
infrastructure and assets that the Secretary de-
termines necessary; and 
(C) coordinate or contribute to protective 
efforts of other agencies as directed in Home-
land Security Presidential Directive 7. 
(2) CONTENTS
OF
PLANS.—Recommendations 
under paragraph (1) shall include—
156
(A) recommendations on necessary protec-
tive measures to secure such infrastructure and 
assets, including suggested milestones and time-
frames for implementation; and 
(B) to the extent practicable, performance 
measures to evaluate the benefits to national 
and economic security from the implementation 
of such protective measures. 
(c) IMPLEMENTATION REPORT.—
(1) IN GENERAL.—Within one year after the 
date of the enactment of this Act, the Secretary 
shall submit a report to the appropriate congres-
sional committees (as that term is defined in section 
2 of the Homeland Security Act of 2002 (6 U.S.C. 
101)) on the implementation of subsection (b). Such 
report shall detail—
(A) the Secretary’s review, development, 
and coordination of security plans under such 
subsection; and 
(B) the Secretary’s oversight of the execu-
tion and effectiveness of such security plans 
(2) UPDATE.—The Secretary shall provide an 
updated report under this subsection to the appro-
priate congressional committees one year after the 
submission of the report under paragraph (1).
157
(d) PROTECTION
OF INFORMATION.—Information 
that is generated, compiled, or disseminated by the De-
partment of Homeland Security in carrying out this sec-
tion—
(1) is exempt from disclosure under section 552 
of title 5, United States Code; and 
(2) shall not, if provided by the Department to 
a State or local government or government agency—
(A) be made available pursuant to any 
State or local law requiring disclosure of infor-
mation or records; 
(B) otherwise be disclosed or distributed to 
any person by such State or local government 
or government agency without the written con-
sent of the Secretary; or 
(C) be used other than for the purpose of 
protecting critical infrastructure or protected 
systems, or in furtherance of an investigation or 
the prosecution of a criminal act. 
SEC. 172. DEADLINE FOR COMPREHENSIVE NATIONAL 
PLAN TO SECURE CRITICAL INFRASTRUC-
TURE AND KEY ASSETS. 
Within one year after the date of the enactment of 
this Act, the Secretary of Homeland Security shall develop 
a comprehensive national plan for securing critical infra-
158
structure and key assets and recommend protective meas-
ures for such infrastructures and assets, as required by 
paragraphs (5) and (6) of subsection 201(d) of the Home-
land Security Act of 2002 (6 U.S.C. 121(d)). 
SEC. 173. REGULATORY AUTHORITY. 
(a) IN GENERAL.—The Secretary of Homeland Secu-
rity may promulgate such regulations as the Secretary de-
termines to be necessary to enhance protection of critical 
infrastructure in accordance with the plans developed 
under the sections l171 and l172 of this Act and the 
requirements of paragraphs (5) and (6) of section 201(d) 
of the Homeland Security Act of 2002 (6 U.S.C. 121(d)). 
(b) CONFORMING AMENDMENT.—Section 877(a) of 
the Homeland Security Act of 2002 (6 U.S.C. 457(a)) is 
amended by inserting ‘‘paragraphs (5) and (6) of section 
201(d) and’’ after ‘‘Except as otherwise provided in’’. 
SEC. 174. BEST PRACTICES. 
Within one year after the date of the enactment of 
this Act, the Secretary of Homeland Security shall—
(1) develop, in collaboration with the heads of 
other appropriate Federal agencies and in consulta-
tion with the private sector, security-related best 
practices for each critical infrastructure sector iden-
tified by the President;
159
(2) ensure the broad dissemination of such best 
practices to appropriate public and private sector en-
tities and authorities; and 
(3) encourage the adoption of such best prac-
tices by such entities and authorities. 
TITLE XI—DEFENDING AGAINST 
BIOTERRORISM 
Subtitle A—National Biodefense 
Strategy 
SEC. 181. NATIONAL BIODEFENSE STRATEGY. 
(a) STRATEGY.—
(1) IN GENERAL.—Consistent with the provi-
sions of section 505 of the Homeland Security Act 
of 2002 (6 U.S.C. 315) and subsections (a) and (b) 
of section 304 of such Act (6 U.S.C. 184), the Sec-
retary of Homeland Security, in consultation with 
the heads of other appropriate Federal agencies, 
shall develop a comprehensive national biodefense 
strategy (in this section referred to as the ‘‘bio-
defense strategy’’) for meeting the requirements, re-
sponsibilities, and authorities of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 101 et seq.), including 
sections 201(d)(1), 302(2), and 502(3) of such Act, 
with respect to the biodefense mission of the Depart-
ment.
160
(2) DEADLINES.—The Secretary shall 
(A) develop the biodefense strategy not 
later than one year after the date of the enact-
ment of this Act; and 
(B) regularly update such strategy as nec-
essary, but not less than every four years. 
(b) CONTENTS.—The biodefense strategy shall set 
forth the following: 
(1) The objectives, missions, and priorities, in-
cluding how such objectives, missions, and priorities 
were established and will be updated. 
(2) A description of the biological threats to 
and vulnerabilities of the Nation, including a 
prioritization of such threats in terms of risk. 
(3) A specification of each Federal agency with 
research and development responsibilities regarding 
such objectives, missions, and priorities, and a de-
scription of such responsibilities. 
(4) A specification of each Federal agency with 
other responsibilities regarding such objectives, mis-
sions, and priorities (including surveillance, threat 
and risk analysis, and incident response), and a de-
scription of such responsibilities.
161
(5) The mechanisms by which coordination 
among the Federal agencies described in paragraphs 
(3) and (4) will be achieved. 
(6) The role of State and local governments and 
private sector institutions in the biodefense strategy, 
as identified by the Federal agencies described in 
paragraphs (3) and (4) with the responsibility and 
mission to coordinate and communicate with State 
and local governments and private sector institu-
tions. 
(7) The mechanisms by which the Federal 
agencies referred to in paragraph (6) coordinate and 
communicate with State and local governments and 
private sector institutions. 
(8) 
Performance 
benchmarks 
to 
measure 
progress in achieving the objectives of the biodefense 
strategy, including a specification of expected time-
frames for implementation. 
(c) OTHER AGENCY RESPONSIBILITIES.—The Sec-
retary shall obtain the concurrence of the relevant Federal 
agency head with respect to such other agency’s respon-
sibilities or activities covered by this section. 
(d) SUBMISSION.—Upon its completion, the Sec-
retary shall transmit a copy of the biodefense strategy to
162
the Congress in an unclassified form with a classified 
annex as appropriate. 
Subtitle B—Development of 
Medical Countermeasures 
SEC. 184. SHORT TITLE. 
This subtitle may be cited as the ‘‘Rapid Pathogen 
Identification to Delivery of Cures Act’’. 
SEC. 185. FINDINGS AND POLICY. 
(a) FINDINGS.—The Congress finds as follows: 
(1) The possibility exists today that terrorists 
or others who intend harm to United States forces 
deployed abroad or to the homeland will use tech-
niques in biotechnology to enhance the trans-
missibility, stability, virulence, or host range of a bi-
ological agent, or to render existing diagnostic, 
therapeutic, and vaccine strategies or innate immune 
responses against a biological agent less effective. 
(2) This possibility will likely grow over time as 
such techniques develop, improve, and spread as an 
inevitable result of biotechnology innovation. 
(3) Natural processes can also lead to the emer-
gence of previously unknown and harmful pathogens 
or render known pathogens resistant to existing di-
agnostic, therapeutic, or adaptive immune ap-
proaches.
163
(4) Long delays in developing new and effective 
responses to pathogens are typical. The discovery, 
development, and approval process for new drugs 
and vaccines typically requires 10 to 20 years and 
costs an average of $800 million. These constraints 
reflect the long, costly research and development 
process, including the failure of most drug or vac-
cine candidates to demonstrate favorable characteris-
tics in pre-clinical testing, as well as the expensive, 
time-consuming clinical trials required to prove the 
safety and effectiveness of new treatments. 
(5) Congress has already authorized the 
abridgement of the long testing and approval process 
required to ensure safety and efficacy under the 
emergency conditions of a severe outbreak of a 
harmful pathogen. However, it will likely still take 
years for even an experimental treatment or vaccine 
to become available. 
(6) There is no coordinated, focused research 
and development program or overall national strat-
egy to achieve significant and dramatic reductions in 
the timeframe from the identification of a pathogen 
to the development and emergency approval for 
human use of reasonably safe and effective new bio-
164
defense medical countermeasures against a pre-
viously unknown or engineered pathogen or toxin. 
(7) Even utilizing existing technologies, there is 
no organized capability in the public or private sec-
tor to rapidly screen drug candidates for potential 
therapeutic activity against pathogens, develop and 
manufacture drug, biological, or medical device prod-
ucts, or test already approved treatments for efficacy 
against a previously unknown or engineered biologi-
cal threat that puts our deployed armed forces or 
the homeland at risk. 
(8) In the area of infectious disease in par-
ticular, private sector firms are abandoning all types 
of innovation and research and development in favor 
of investments in more profitable medical markets. 
(9) Tremendous potential exists for benefits to 
health by concerted, targeted public-private invest-
ment to dramatically reduce the timeframe for the 
development of new countermeasures. The pharma-
ceutical and biotechnology industries are fundamen-
tally innovative and are quick to integrate new tech-
nologies. Useful and important discoveries and tech-
nological advances will be rapidly absorbed by the 
private sector, leading to faster delivery of new
165
medicines and reductions in the costs of drug devel-
opment. 
(b) POLICY.—The Congress hereby declares it to be 
the national policy of the United States to promote techno-
logical advancements that will dramatically reduce the 
timeframe for the development of new medical counter-
measures to treat or prevent disease caused by infectious 
disease agents or toxins that, through natural processes 
or intentional introduction, may pose a significant risk to 
public health now or in the future. 
SEC. 186. RAPID BIODEFENSE COUNTERMEASURES DEVEL-
OPMENT NATIONAL STRATEGY. 
Title III of the Homeland Security Act of 2002 (6 
U.S.C. 181 et seq.) (Public Law 107–296) is amended by 
inserting after section 304 the following section: 
‘‘SEC. 304A. RAPID BIODEFENSE COUNTERMEASURES DE-
VELOPMENT NATIONAL STRATEGY. 
‘‘(a) NATIONAL STRATEGY FOR SHORTENING THE 
MEDICAL
COUNTERMEASURE
DEVELOPMENT
TIME-
FRAME.—Not later than 180 days after the date of the 
enactment of the Rapid Pathogen Identification to Deliv-
ery of Cures Act, the Secretaries of Homeland Security, 
Health and Human Services, and Defense shall submit to 
Congress a report setting forth a strategy to achieve dra-
matic reductions in the timeframe from pathogen identi-
166
fication to the development and emergency approval for 
human use of reasonably safe and effective priority coun-
termeasure against a novel or unknown pathogen or toxin. 
‘‘(b) ELEMENTS.—The report under subsection (a) 
shall include the following: 
‘‘(1) The identification of the technical impedi-
ments to reductions in the timeframe from pathogen 
identification to priority countermeasure develop-
ment and approval under emergency conditions. 
‘‘(2) The identification of the research, develop-
ment, and technology needs and clinical research 
needs to address these impediments. 
‘‘(3) The identification of existing research and 
development efforts in Federal agencies, academia 
and industry that are addressing the needs identified 
in subsection (c)(2). 
‘‘(4) The identification of facilities, programs 
and resources that can be utilized to address these 
research, development, and technology needs and 
clinical research needs among—
‘‘(A) Federal agencies; 
‘‘(B) colleges and universities; 
‘‘(C) not-for-profit institutions; 
‘‘(D) industry, including information tech-
nology, software, robotics, pharmaceutical and
167
biotechnology companies and their consortia; 
and 
‘‘(E) foreign research and technological in-
stitutions. 
‘‘(5) A proposal for the establishment of a co-
ordinated and integrated federal program to address 
these research, development, and technology needs, 
including—
‘‘(A) the application of Federal Govern-
ment resources, including recommendations for 
the allocation and prioritization of Federal 
funds; 
‘‘(B) interagency management and coordi-
nation mechanisms; 
‘‘(C) the establishment of partnerships be-
tween private corporations and Federal agencies 
or Federally funded entities; 
‘‘(D) information and technology sharing 
and coordination mechanisms among public, 
private, academic, not-for-profit, and inter-
national institutions; 
‘‘(E) the use of incentives to promote pri-
vate sector participation; and
168
‘‘(F) the adjustment of Federal regulatory 
requirements to promote private sector innova-
tion. 
‘‘(6) The identification of potential liability con-
cerns stemming from distribution of rapidly-devel-
oped priority countermeasures under emergency con-
ditions and a proposal for regulatory or legislative 
approaches to eliminating these concerns. 
‘‘(7) A proposal for managing the transfer of 
new technologies and associated intellectual property 
rights. 
‘‘(c) CONSIDERATIONS.—In developing the national 
strategy under subsection (a), the Secretaries shall con-
sider—
‘‘(1) The research, development, and technology 
needs and clinical research needs of the entire 
pathogen identification to priority countermeasures 
discovery, development, production, and Approval 
process, including—
‘‘(A) initial identification and characteriza-
tion of a pathogen or toxin, including the iden-
tification of any genetic or other manipulations; 
‘‘(B) priority countermeasures discovery; 
‘‘(C) pre-clinical testing and evaluation of 
priority countermeasures;
169
‘‘(D) safety and efficacy animal testing, in-
cluding the needs for approval under emergency 
conditions and accelerated approval of new pri-
ority countermeasure under the final rule ‘New 
Drug and Biological Drug Products; Evidence 
Needed to Demonstrate Effectiveness of New 
Drugs When Human Efficacy Studies Are Not 
Ethical or Feasible’ published in the Federal 
Register on May 31, 2002 (67 Fed. Reg. 
37988); 
‘‘(E) safety and efficacy human testing, in-
cluding mechanisms for the conduct of clinical 
trials under emergency conditions; 
‘‘(F) research-scale and full production-
scale manufacturing, including biologics manu-
facturing sciences; and 
‘‘(G) the approval of priority counter-
measure under emergency conditions; 
‘‘(2) the potential importance of advanced tech-
nologies such as automation, computer modeling and 
simulation, bioinformatics, pharmacogenomics, and 
bioengineering techniques for manufacturing; 
‘‘(3) the availability of sufficient manufacturing 
capacity for priority countermeasures production to
170
meet potential public demand under emergency con-
ditions; and 
‘‘(4) the current state of national and inter-
national collaborative research networks and applica-
tions to facilitate and encourage the rapid and co-
ordinated development and sharing of laboratory and 
clinical research planning and results. 
‘‘(d) AUTHORITY TO CONTRACT.—The Secretary of 
Homeland Security, after consultation with the Secre-
taries of Health and Human Services and Defense and 
the working group established under section 319F(a) of 
the Public Health Service Act, may contract with any one 
or more for-profit or non-profit firm or institution to con-
duct the necessary research and analysis needed to com-
plete any one or more of the elements described in sub-
section (b) of the report required in this section, provided 
the considerations described in subsection (c) are met. 
‘‘(e) DEFINITIONS.—In this section: 
‘‘(1) The term ‘emergency conditions’ refers to 
a declaration of emergency under section 564 of the 
Federal Food, Drug, and Cosmetic Act. 
‘‘(2) The term ‘pathogen identification’ means 
the point in time in which a specific agent that can 
be reasonably assumed to be the cause of (or has the 
potential to be the cause of) an infectious disease or
171
toxin-induced syndrome has been identified and par-
tially or wholly characterized scientifically. 
‘‘(3) The term ‘priority countermeasure’ has 
the same meaning given such term in section 
319F(h) of the Public Health Service Act. 
‘‘(f) AUTHORIZATION OF APPROPRIATIONS.—For the 
purpose of carrying out this section, there is authorized 
to be appropriated $10,000,000 for fiscal year 2005.’’. 
SEC. 187. CLINICAL RESEARCH UNDER EMERGENCY CONDI-
TIONS. 
(a) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act, the Secretary of Health 
and Human Services shall establish a system for the rapid 
establishment of clinical research programs to examine the 
safety and efficacy of new or existing treatments for novel, 
unknown, or bioengineered pathogens or toxins. The Sec-
retary shall also provide the means for rapid dissemination 
of results and recommendations to clinicians nationwide. 
(b) EMERGENCY FUND.—A fund is authorized to be 
established for use, at the discretion of the Secretary, sole-
ly for the support of clinical research as described in sub-
section (a). 
SEC. 188. INTERAGENCY WORKING GROUP. 
Section 319F(a) of the Public Health Service Act, as 
amended by Public Law 107–188, is amended—
172
(1) by inserting ‘‘the Secretary of Homeland 
Security,’’ after ‘‘in coordination with the’’; 
(2) 
by 
redesignating 
subparagraphs 
(D) 
through (L) as subparagraphs (E) through (M), re-
spectively; and 
(3) by inserting after subparagraph (C) the fol-
lowing subparagraph: 
‘‘(D) development of a national strategy to 
achieve dramatic reductions in the timeframe 
from the identification of a pathogen to the de-
velopment and approval for human use under 
emergency 
conditions 
of 
priority 
counter-
measures against a novel, unknown, or engi-
neered pathogen or toxin;’’. 
SEC. 189. DEVELOPING THE CAPABILITY FOR RAPID BIO-
DEFENSE 
COUNTERMEASURE 
DEVELOP-
MENT. 
(a) RESEARCH.—Section 319F(h)(1) of the Public 
Health Service Act, as amended by Public Law 107–188, 
is amended 
(1) in subparagraph (C), by striking ‘‘and’’ 
after the semicolon; 
(2) by redesignating subparagraph (D) as sub-
paragraph (E); and
173
(3) by inserting after subparagraph (C) the fol-
lowing subparagraph: 
‘‘(D) the development of a capability to 
rapidly identify, develop, produce, and approve 
for human use under emergency conditions pri-
ority countermeasures against a novel, un-
known, or engineered pathogen or toxin; and’’. 
(b) RESEARCH AND DEVELOPMENT AT THE DEPART-
MENT OF DEFENSE.—Section 1601(a) of the National 
Defense Authorization Act for Fiscal Year 2004 (Public 
Law 108–136) is amended by adding at the end the fol-
lowing: ‘‘The program shall also include research, develop-
ment, and procurement to provide the Federal Govern-
ment with the capability to rapidly identify, develop, 
produce, and approve for human use under emergency 
conditions priority countermeasures against a novel, un-
known, or engineered pathogen or toxin, and for which no 
existing countermeasure has been determined to be safe 
or efficacious.’’. 
(c) RESEARCH AND DEVELOPMENT AT THE DEPART-
MENT OF HOMELAND SECURITY.—Title III of the Home-
land Security Act of 2002, as amended by section 186 of 
this Act, is amended by inserting after section 304A the 
following section:
174
‘‘SEC. 304B. DEVELOPING THE CAPABILITY FOR RAPID BIO-
DEFENSE 
COUNTERMEASURE 
DEVELOP-
MENT. 
‘‘The Secretary, in collaboration with the Secretaries 
of Defense and Health and Human Services, shall carry 
out a program for research, development, and procure-
ment to provide the Federal Government with the capa-
bility to rapidly identify, develop, produce, and approve for 
human use under emergency conditions priority counter-
measures against a novel, unknown, or engineered patho-
gen or toxin, and for which no existing countermeasure 
has been determined to be safe or efficacious.’’. 
TITLE XII—CHEMICAL SECURITY 
IMPROVEMENT 
SEC. 191. SHORT TITLE. 
This title may be cited as the ‘‘Chemical Security Im-
provement Act of 2004’’. 
SEC. 192. DEFINITIONS. 
In this title: 
(1) ALTERNATIVE
APPROACHES.—The term 
‘‘alternative approach’’ means an approach that sig-
nificantly reduces or eliminates the threat or con-
sequences of a terrorist release from a chemical 
source, including an approach that—
175
(A) uses smaller quantities, nonhazardous 
forms, or less hazardous forms of dangerous 
substances; 
(B) replaces a dangerous substance with a 
nonhazardous or less hazardous substance; or 
(C) uses nonhazardous or less hazardous 
conditions or processes. 
(2) CHEMICAL SOURCE.—The term ‘‘chemical 
source’’ means a non-Federal facility listed by the 
Secretary under section 193(e) as a chemical source. 
(3) DANGEROUS SUBSTANCE.—The term ‘‘dan-
gerous substance’’ means a substance present at a 
chemical source that—
(A) can cause death, injury, or serious ad-
verse effects to human health or the environ-
ment; or 
(B) could harm critical infrastructure or 
national security. 
(4) DEPARTMENT.—The term ‘‘Department’’ 
means the Department of Homeland Security. 
(5) ENVIRONMENT.—The term ‘‘environment’’ 
means—
(A) the navigable waters, the waters of the 
contiguous zone, and the ocean waters of which 
the natural resources are under the exclusive
176
management authority of the United States; 
and 
(B) any other surface water, ground water, 
drinking water supply, land surface or sub-
surface strata, or ambient air within the United 
States or under the jurisdiction of the United 
States. 
(6) FULL
CONSIDERATION.—The term ‘‘full 
consideration’’ includes an analysis of—
(A) alternative approaches, including the 
benefits and risks of such approaches; 
(B) the potential of the alternative ap-
proaches to prevent or reduce the threat or con-
sequences of a terrorist release; 
(C) the cost and technical feasibility of al-
ternative approaches; and 
(D) the effect of alternative approaches on 
product quality, product cost, and employee 
safety. 
(7) OWNER OR OPERATOR.—The term ‘‘owner 
or operator’’ means any person who owns, leases, op-
erates, controls, or supervises a chemical source. 
(8) RELEASE.—The term ‘‘release’’ means any 
spilling, 
leaking, 
pumping, 
pouring, 
emitting, 
emptying, discharging, injecting, escaping, leaching,
177
dumping, or disposing into the environment (includ-
ing the abandonment or discarding of barrels, con-
tainers, and other closed receptacles containing any 
hazardous substance or pollutant or contaminant), 
but excludes—
(A) any release which results in exposure 
to persons solely within a workplace, with re-
spect to a claim which such persons may assert 
against the employer of such persons; 
(B) emissions from the engine exhaust of 
a motor vehicle, rolling stock, aircraft, vessel, or 
pipeline pumping station engine; or 
(C) the normal application of fertilizer. 
(9) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of Homeland Security. 
(10) SECURITY MEASURE.—
(A) IN
GENERAL.—The term ‘‘security 
measure’’ means an action carried out to ensure 
or enhance the security of a chemical source. 
(B) INCLUSIONS.—The term ‘‘security 
measure’’, with respect to a chemical source, in-
cludes measures such as—
(i) employee training and background 
checks;
178
(ii) the limitation and prevention of 
access to controls of the chemical source; 
(iii) the protection of the perimeter of 
the chemical source, including the deploy-
ment of armed physical security personnel; 
(iv) the installation and operation of 
intrusion detection sensors; 
(v) the implementation of measures to 
increase computer or computer network se-
curity; 
(vi) the installation of measures to 
protect against long-range weapons; 
(vii) the installation of measures and 
controls to protect against or reduce the 
consequences of a terrorist attack; and 
(viii) the implementation of any other 
security-related measures or the conduct of 
any similar security-related activity, as de-
termined by the Secretary. 
(11) TERRORISM.—The term ‘‘terrorism’’ has 
the meaning given to that term in section 2 of the 
Homeland Security Act of 2002 (6 U.S.C. 101). 
(12) TERRORIST
RELEASE.—The term ‘‘ter-
rorist release’’ means—
179
(A) a release from a chemical source into 
the environment of a dangerous substance that 
is caused by an act of terrorism; and 
(B) the theft of a dangerous substance by 
a person for off-site release in furtherance of an 
act of terrorism. 
SEC. 193. VULNERABILITY ASSESSMENTS AND SITE SECU-
RITY PLANS. 
(a) REQUIREMENT.—
(1) IN GENERAL.—Not later than 1 year after 
the date of the enactment of this subtitle, the Sec-
retary shall promulgate regulations that—
(A) require the owner or operator of each 
chemical source—
(i) to conduct an assessment of the 
vulnerability of the chemical source to a 
terrorist release; and 
(ii) to prepare and implement a site 
security plan that addresses the results of 
the vulnerability assessment; and 
(B) establish procedures, protocols, and 
standards for vulnerability assessments and site 
security plans. 
(2) CONTENTS
OF
VULNERABILITY
ASSESS-
MENT.—A vulnerability assessment required under
180
the regulations promulgated under paragraph (1) or 
any assessment determined substantially equivalent 
by the Secretary under subsection (c) shall include 
the identification and evaluation of—
(A) critical assets and infrastructures; 
(B) hazards that may result from a ter-
rorist release; and 
(C) weaknesses in—
(i) physical security; 
(ii) structural integrity of contain-
ment, processing, and other critical infra-
structure; 
(iii) protection systems; 
(iv) procedural and employment poli-
cies; 
(v) communication systems; 
(vi) transportation infrastructure in 
the proximity of the chemical source; 
(vii) utilities; 
(viii) contingency response; and 
(ix) other areas as determined by the 
Secretary. 
(3) CONTENTS
OF
SITE
SECURITY
PLAN.—A 
site security plan required under the regulations pro-
181
mulgated under paragraph (1) or any plan sub-
mitted to the Secretary under subsection (c)—
(A) shall include security measures to sig-
nificantly reduce the vulnerability of the chem-
ical source covered by the plan to a terrorist re-
lease; 
(B) shall describe, at a minimum, par-
ticular equipment, plans, and procedures that 
could be implemented or used by or at the 
chemical source in the event of a terrorist re-
lease; 
(C) shall include full consideration and, 
where practicable in the judgment of the owner 
or operator of the chemical source, implementa-
tion of options to reduce the threat of a ter-
rorist release through the use of alternative ap-
proaches; and 
(D) shall be developed in consultation with 
local law enforcement and first responders. 
(4) SECURITY EXERCISES.—Not later than 1 
year after the date of the enactment of this subtitle, 
the Secretary shall promulgate regulations estab-
lishing procedures, protocols, and standards for the 
conduct of security exercises, including—
182
(A) the performance of force-on-force exer-
cises that—
(i) involve physical security personnel 
employed by the owner or operator of the 
chemical source to act as the force des-
ignated to defend the facility; 
(ii) involve personnel designated by 
the Secretary to act as the force des-
ignated to simulate a terrorist attempt to 
attack the chemical source to cause a ter-
rorist release; 
(iii) are designed, overseen, and evalu-
ated by the Department; and 
(iv) are conducted at least once every 
3 years; and 
(B) the performance of all other such exer-
cises at periodic intervals necessary to ensure 
the optimal performance of security measures. 
(5) GUIDANCE TO SMALL ENTITIES.—Not later 
than 1 year after the date of the enactment of this 
Act, the Secretary shall publish guidance to assist 
small entities in complying with paragraphs (2) and 
(3). 
(6) THREAT INFORMATION.—To the maximum 
extent practicable under applicable authority and in
183
the interests of national security, the Secretary shall 
provide to an owner or operator of a chemical source 
required to prepare a vulnerability assessment and 
site security plan threat information that is relevant 
to the chemical source. 
(7) COORDINATED ASSESSMENTS AND PLANS.—
The regulations promulgated under paragraph (1) 
shall permit the development and implementation of 
coordinated vulnerability assessments and site secu-
rity plans in any case in which more than 1 chemical 
source is operating at a single location or at contig-
uous locations, including cases in which a chemical 
source is under the control of more than 1 owner or 
operator. 
(b) CERTIFICATION AND SUBMISSION.—
(1) IN GENERAL.—Except as provided in sub-
section (c), each owner or operator of a chemical 
source shall certify in writing to the Secretary that 
the owner or operator has completed a vulnerability 
assessment and has developed and implemented (or 
is implementing) a site security plan in accordance 
with this title, including—
(A) regulations promulgated under sub-
section (a)(1); and
184
(B) any existing vulnerability assessment 
or security plan endorsed by the Secretary 
under subsection (c)(1). 
(2) SUBMISSION.—
(A) IN
GENERAL.—Not later than 18 
months after the date of the promulgation of 
regulations under subsection (a)(1), an owner 
or operator of a chemical source shall provide to 
the Secretary copies of the vulnerability assess-
ment and site security plan of the chemical 
source for review. 
(B) CERTIFICATION.—
(i) IN GENERAL.—Not later than 2 
years after the date on which the Secretary 
receives copies of the vulnerability assess-
ment and site security plan of a chemical 
source under subparagraph (A), the Sec-
retary shall determine whether the chem-
ical source is in compliance with the re-
quirements of this title, including—
(I) paragraph (1); 
(II) 
regulations 
promulgated 
under subsections (a)(1) and (a)(3); 
and
185
(III) any existing vulnerability 
assessment or site security plan en-
dorsed by the Secretary under sub-
section (c)(1). 
(ii) CERTIFICATE.—If the Secretary 
determines that the chemical source is in 
compliance with the requirements of this 
title, the Secretary shall provide to the 
chemical source and make available for 
public inspection a certificate of approval 
that contains the following statement (in 
which statement the bracketed space shall 
be the name of the chemical source): 
‘‘[llll] is in compliance with the 
Chemical Security Improvement Act of 
2004.’’. 
(iii) DETERMINATION OF NONCOMPLI-
ANCE.—If the Secretary determines under 
clause (i) that a chemical source is not in 
compliance with the requirements of this 
title, the Secretary shall exercise the au-
thority provided in section 195. 
(iv) REPORT
TO
CONGRESS.—Not 
later than 1 year after the promulgation of 
regulations in subsection (a)(1) and for
186
every year afterwards, the Secretary shall 
submit to the Congress a report outlining 
the number of facilities that have provided 
vulnerability assessments and site security 
plans to the Secretary, what portion of 
these submissions have been reviewed by 
the Secretary, and what portion of these 
submissions are in compliance with clause 
(i). 
(3) OVERSIGHT.—
(A) IN GENERAL.—The Secretary shall, at 
such times and places as the Secretary deter-
mines to be appropriate, conduct or require the 
conduct of vulnerability assessments and other 
activities (including qualified third-party audits) 
to ensure and evaluate compliance with this 
title (including regulations promulgated under 
subsection (a)(1) and (c)(1)). 
(B) RIGHT
OF
ENTRY.—In carrying out 
this title, the Secretary (or a designee), on pres-
entation of credentials, shall have a right of 
entry to, on, or through any premises of an 
owner or operator of a chemical source. 
(C) REQUESTS
FOR
RECORDS.—In car-
rying out this title, the Secretary (or a des-
187
ignee) may require the submission of, or, on 
presentation of credentials, may at reasonable 
times seek access to and copy any documenta-
tion necessary for—
(i) review or analysis of a vulnerability 
assessment or site security plan; or 
(ii) implementation of a site security 
plan. 
(D) COMPLIANCE.—If the Secretary deter-
mines that an owner or operator of a chemical 
source is not maintaining, producing, or permit-
ting access to the premises of a chemical source 
or records as required by this paragraph, the 
Secretary may issue an order requiring compli-
ance with the relevant provisions of this section. 
(E) QUALIFIED
THIRD-PARTY
AUDITS.—
The Secretary shall establish standards as to 
the qualifications of third-party auditors. Such 
standards shall ensure the qualifications of the 
third-party auditor provide sufficient expertise 
in—
(i) 
chemical 
site 
security 
vulnerabilities; 
(ii) chemical site security measures; 
and
188
(iv) such other areas as the Secretary 
determines to be appropriate and nec-
essary. 
(4) SUBMISSION OF CHANGES.—The owner or 
operator of a chemical source shall provide to the 
Secretary a description of any significant change 
that is made to the vulnerability assessment or site 
security plan required for the chemical source under 
this section, not later than 90 days after the date 
the change is made. 
(c) EXISTING VULNERABILITY ASSESSMENTS AND 
SECURITY PLANS.—Upon submission of a petition by an 
owner or operator of a chemical source to the Secretary 
in conjunction with a submission under subsection 
(b)(2)(A), the Secretary—
(1) may endorse any vulnerability assessment or 
security plan—
(A) that was conducted, developed, or re-
quired by—
(i) industry; 
(ii) State or local authorities; or 
(iii) other applicable law; 
(B) that was conducted before, on, or after 
the date of enactment of this title; and
189
(C) the contents of which the Secretary de-
termines meet the standards established under 
the requirements of subsections (a)(1), (a)(2), 
and (a)(3); and 
(2) may make an endorsement of an existing 
vulnerability assessment or security plan under para-
graph (1) contingent on modification of the vulner-
ability assessment or security plan to address—
(A) a particular threat or type of threat; or 
(B) a requirement under (a)(2) or (a)(3). 
(d) REGULATORY CRITERIA.—In exercising the au-
thority under subsections (a), (b), (c), or (e) with respect 
to a chemical source, the Secretary shall consider—
(1) the likelihood that a chemical source will be 
the target of terrorism; 
(2) the potential extent of death, injury, or seri-
ous adverse effects to human health or the environ-
ment that would result from a terrorist release; 
(3) the potential harm to critical infrastructure 
and national security from a terrorist release; and 
(4) such other security-related factors as the 
Secretary determines to be appropriate and nec-
essary to protect the public health and welfare, crit-
ical infrastructure, and national security. 
(e) LIST OF CHEMICAL SOURCES.—
190
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this title, the Sec-
retary shall develop a list of chemical sources in ex-
istence as of that date. 
(2) CONSIDERATIONS.—In developing the list 
under paragraph (1), the Secretary shall take into 
consideration the criteria specified in subsection (d). 
(3) PRIORITIZATION.—In developing the list 
under paragraph (1), the Secretary shall determine 
the potential extent of death, injury, or severe ad-
verse effects to human health that would result from 
a terrorist release of dangerous substances from a 
chemical source. 
(4) SCOPE.—In developing the list under para-
graph (1), the Secretary shall include at least those 
facilities that pose a risk of potential death, injury, 
or severe adverse effects to not fewer than 1000 in-
dividuals. 
(5) FUTURE DETERMINATIONS.—Not later than 
3 years after the date of the promulgation of regula-
tions under subsection (a)(1), and every 3 years 
thereafter, the Secretary shall, after considering the 
criteria described in subsection (d)—
(A) determine whether additional facilities 
(including, as of the date of the determination,
191
facilities that are operational and facilities that 
will become operational in the future) shall be 
considered to be a chemical source under this 
title; 
(B) determine whether any chemical source 
identified on the most recent list under para-
graph (1) no longer presents a risk sufficient to 
justify retention of classification as a chemical 
source under this title; and 
(C) update the list as appropriate. 
(f) 5-YEAR REVIEW.—Not later than 5 years after 
the date of the certification of a vulnerability assessment 
and a site security plan under subsection (b)(1), and not 
less often than every 5 years thereafter (or on such a 
schedule as the Secretary may establish by regulation), the 
owner or operator of the chemical source covered by the 
vulnerability assessment or site security plan shall—
(1) ensure the vulnerability assessment and site 
security plan meet the most recent regulatory stand-
ards issued under subsection (a)(1); and 
(2)(A) certify to the Secretary that the chemical 
source has completed the review and implemented 
any modifications to the site security plan; and
192
(B) submit to the Secretary a description of 
any changes to the vulnerability assessment or site 
security plan. 
(g) PROTECTION OF INFORMATION.—
(1) 
CRITICAL
INFRASTRUCTURE
INFORMA-
TION.—Except with respect to certifications specified 
in subsections (b)(1), (b)(2), and (f)(2)(A), vulner-
ability assessments and site security plans obtained 
in accordance with this title, and all information de-
rived from those vulnerability assessments and site 
security plans that could pose a risk to a particular 
chemical source, shall be deemed critical infrastruc-
ture information as defined in section 212 of the 
Homeland Security Act of 2002 (6 U.S.C. 101 et 
seq.), and subject to all protections under sections 
213 and 214 of that Act. 
(2) 
EXCEPTIONS
TO
PENALTIES.—Section 
214(f) of the Homeland Security Act of 2002 (6 
U.S.C. 133(f)) shall not apply to a person described 
in that section that discloses information described 
in paragraph (1)—
(A) for use in any administrative or judi-
cial proceeding to impose a penalty for failure 
to comply with a requirement of this title; or
193
(B) for the purpose of making a disclosure 
evidencing government, owner or operator, or 
employee activities that threaten the security of 
a chemical source or are inconsistent with the 
requirements of this title. 
(3) RULE OF CONSTRUCTION.—Nothing in this 
subsection shall be construed to authorize the with-
holding of information from members of Congress 
acting in their official capacity. 
SEC. 194. WHISTLEBLOWER PROTECTION. 
(a) IN GENERAL.—No person employed at a chemical 
source may be discharged, demoted, suspended, threat-
ened, harassed, or in any other manner discriminated 
against because of any lawful act done by the person—
(1) to provide information, cause information to 
be provided, or otherwise assist in an investigation 
regarding any conduct which the person reasonably 
believes constitutes a violation of any law, rule or 
regulation related to the security of the chemical 
source, or any other threat to the security of the 
chemical source, when the information or assistance 
is provided to or the investigation is conducted by—
(A) a Federal regulatory or law enforce-
ment agency;
194
(B) any member or committee of the Con-
gress; or 
(C) a person with supervisory authority 
over the person (or such other person who has 
the authority to investigate, discover, or termi-
nate misconduct); or 
(2) to file, cause to be filed, testify in, partici-
pate in, or otherwise assist in a proceeding or action 
filed or about to be filed relating to a violation of 
any law, rule, or regulation related to the security of 
a chemical source or any other threat to the security 
of a chemical source; or 
(3) to refuse to violate or assist in the violation 
of any law, rule, or regulation related to the security 
of chemical sources. 
(b) ENFORCEMENT ACTION.—
(1) IN GENERAL.—A person who alleges dis-
charge or other discrimination by any person in vio-
lation of subsection (a) may seek relief under sub-
section (c) by—
(A) filing a complaint with the Secretary of 
Labor; or 
(B) if the Secretary of Labor has not 
issued a final decision within 180 days of the 
filing of the complaint and there is no showing
195
that such delay is due to the bad faith of the 
claimant, bringing an action at law or equity 
for de novo review in the appropriate district 
court of the United States, which shall have ju-
risdiction over such an action without regard to 
the amount in controversy. 
(2) PROCEDURE.—
(A) IN GENERAL.—An action under para-
graph (1)(A) shall be governed under the rules 
and procedures set forth in section 42121(b) of 
title 49, United States Code. 
(B) EXCEPTION.—Notification made under 
section 42121(b)(1) of title 49, United States 
Code, shall be made to the person named in the 
complaint and to the person’s employer. 
(C) BURDENS
OF
PROOF.—An action 
brought under paragraph (1)(B) shall be gov-
erned by the legal burdens of proof set forth in 
section 42121(b) of title 49, United States 
Code. 
(D) STATUTE OF LIMITATIONS.—An action 
under paragraph (1) shall be commenced not 
later than 90 days after the date on which the 
violation occurs. 
(c) REMEDIES.—
196
(1) IN GENERAL.—A person prevailing in any 
action under subsection (b)(1) shall be entitled to all 
relief necessary to make the person whole. 
(2) COMPENSATORY DAMAGES.—Relief for any 
action under paragraph (1) shall include—
(A) reinstatement with the same seniority 
status that the person would have had, but for 
the discrimination; 
(B) the amount of back pay, with interest; 
and 
(C) compensation for any special damages 
sustained as a result of the discrimination, in-
cluding litigation costs, expert witness fees, and 
reasonable attorney fees. 
(d) RIGHTS RETAINED BY PERSON.—Nothing in this 
section shall be deemed to diminish the rights, privileges, 
or remedies of any person under any Federal or State law, 
or under any collective bargaining agreement. 
SEC. 195. ENFORCEMENT. 
(a) FAILURE TO COMPLY.—If an owner or operator 
of a chemical source fails to certify or submit a vulner-
ability assessment or site security plan in accordance with 
this title, the Secretary may issue an order requiring the 
certification and submission of a vulnerability assessment 
or site security plan in accordance with section 193(b).
197
(b) DISAPPROVAL.—The Secretary may disapprove 
under subsection (a) a vulnerability assessment or site se-
curity plan submitted under section 193(b) or (c) if the 
Secretary determines that—
(1) the vulnerability assessment or site security 
plan does not comply with regulations promulgated 
under section 193(a)(1), or the procedure, protocol, 
or standard endorsed or recognized under section 
193(c); or 
(2) the site security plan, or the implementation 
of the site security plan, is insufficient to address—
(A) the results of a vulnerability assess-
ment of a chemical source; or 
(B) a threat of a terrorist release. 
(c) COMPLIANCE.—If the Secretary disapproves a 
vulnerability assessment or site security plan of a chemical 
source under subsection (b), the Secretary shall—
(1) provide the owner or operator of the chem-
ical source a written notification of the determina-
tion that includes a clear explanation of deficiencies 
in the vulnerability assessment, site security plan, or 
implementation of the assessment or plan; 
(2) consult with the owner or operator of the 
chemical source to identify appropriate steps to 
achieve compliance; and
198
(3) if, following that consultation, the owner or 
operator of the chemical source does not achieve 
compliance by such date as the Secretary determines 
to be appropriate under the circumstances, issue an 
order requiring the owner or operator to correct 
specified deficiencies. 
(d) PROTECTION OF INFORMATION.—Any determina-
tion of disapproval or order made or issued under this sec-
tion shall be exempt from disclosure—
(1) under section 552 of title 5, United States 
Code; 
(2) under any State or local law providing for 
public access to information; and 
(3) except as provided in section 193(g)(2), in 
any Federal or State civil or administrative pro-
ceeding. 
SEC. 196. INTERAGENCY TECHNICAL SUPPORT AND CO-
OPERATION. 
The Secretary—
(1) in addition to such consultation as is re-
quired in this title, shall consult with Federal agen-
cies with relevant expertise, and may request those 
Federal agencies to provide technical and analytical 
support, in implementing this title; and
199
(2) may provide reimbursement for such tech-
nical and analytical support received as the Sec-
retary determines to be appropriate. 
SEC. 197. PENALTIES. 
(a) JUDICIAL RELIEF.—In a civil action brought in 
United States district court, any owner or operator of a 
chemical source that violates or fails to comply with any 
order issued by the Secretary under this subtitle or a site 
security plan submitted to the Secretary under this sub-
title or recognized by the Secretary, for each day on which 
the violation occurs or the failure to comply continues, 
may be subject to—
(1) an order for injunctive relief; and 
(2) a civil penalty of not more than $50,000. 
(b) ADMINISTRATIVE PENALTIES.—
(1) PENALTY
ORDERS.—The Secretary may 
issue an administrative penalty of not more than 
$250,000 for failure to comply with an order issued 
by the Secretary under this subtitle. 
(2) NOTICE AND HEARING.—Before issuing an 
order described in paragraph (1), the Secretary shall 
provide to the person against whom the penalty is to 
be assessed—
(A) written notice of the proposed order; 
and
200
(B) the opportunity to request, not later 
than 30 days after the date on which the per-
son receives the notice, a hearing on the pro-
posed order. 
(3) PROCEDURES.—The Secretary may promul-
gate regulations outlining the procedures for admin-
istrative hearings and appropriate review under this 
subsection, including necessary deadlines. 
SEC. 198. NO EFFECT ON REQUIREMENTS UNDER OTHER 
LAW. 
Nothing in this subtitle affects any duty or other re-
quirement imposed under any other Federal or State law. 
TITLE XIII—IMPROVING 
CYBERSECURITY 
SEC. 201. CYBERSECURITY TRAINING PROGRAMS AND 
EQUIPMENT. 
(a) IN GENERAL.—The Secretary of Homeland Secu-
rity, 
acting 
through 
the 
Assistant 
Secretary 
for 
Cybersecurity, may establish, in conjunction with the Na-
tional Science Foundation, a program to award grants to 
institutions of higher education (and consortia thereof) 
for—
(1) 
the 
establishment 
or 
expansion 
of 
cybersecurity professional development programs;
201
(2) the establishment or expansion of associate 
degree programs in cybersecurity; and 
(3) the purchase of equipment to provide train-
ing in cybersecurity for either professional develop-
ment programs or degree programs. 
(b) ROLES.—
(1) DEPARTMENT OF HOMELAND SECURITY.—
The Secretary, acting through the Assistant Sec-
retary for Cybersecurity and in consultation with the 
Director of the National Science Foundation, shall 
establish the goals for the program under this sec-
tion and the criteria for awarding grants under the 
program. 
(2) NATIONAL SCIENCE FOUNDATION.—The Di-
rector of the National Science Foundation shall op-
erate the program established under this section 
consistent with the goals and criteria established 
under paragraph (1), including soliciting applicants, 
reviewing applications, and making and admin-
istering grant awards. The Director may consult 
with the Assistant Secretary for Cybersecurity in se-
lecting awardees. 
(3) FUNDING.—The Secretary shall transfer to 
the National Science Foundation the funds nec-
essary to carry out this section.
202
(c) GRANT AWARDS.—
(1) PEER
REVIEW.—All grant awards under 
this section shall be made on a competitive, merit re-
viewed basis. 
(2) FOCUS.—In making grant awards under 
this section, the Director shall, to the extent prac-
ticable, ensure geographic diversity and the partici-
pation of women and underrepresented minorities. 
(3) PREFERENCE.—In making grant awards 
under this section, the Director shall give preference 
to applications submitted by consortia of institutions 
to encourage as many students and professionals as 
possible to benefit from this program. 
(d) AUTHORIZATION OF APPROPRIATIONS.—There is 
authorized to be appropriated to the Secretary for car-
rying out this section $3,700,000 for fiscal year 2005. 
(e) DEFINITIONS.—In this section, the term institu-
tion of higher education has the meaning given that term 
in section 101(a) of the Higher Education Act of 1965 
(20 U.S.C. 1001(a)). 
SEC. 202. ASSISTANT SECRETARY FOR CYBERSECURITY. 
(a) IN GENERAL.—Subtitle A of title II of the Home-
land Security Act of 2002 (6 U.S.C. 121 et seq.) is amend-
ed by adding at the end the following:
203
‘‘SEC. 203. ASSISTANT SECRETARY FOR CYBERSECURITY. 
‘‘(a) IN GENERAL.—There shall be in the Directorate 
for Information Analysis and Infrastructure Protection a 
National Cybersecurity Office headed by an Assistant Sec-
retary for Cybersecurity (in this section referred to as the 
‘Assistant Secretary’), who shall assist the Secretary in 
promoting cybersecurity for the Nation. 
‘‘(b) GENERAL AUTHORITY.—The Assistant Sec-
retary, subject to the direction and control of the Sec-
retary, shall have primary authority within the Depart-
ment for all cybersecurity-related critical infrastructure 
protection programs of the Department, including with re-
spect to policy formulation and program management. 
‘‘(c) RESPONSIBILITIES.—The responsibilities of the 
Assistant Secretary shall include the following: 
‘‘(1) To establish and manage—
‘‘(A) a national cybersecurity response sys-
tem that includes the ability to—
‘‘(i) analyze the effect of cybersecurity 
threat information on national critical in-
frastructure; and 
‘‘(ii) aid in the detection and warning 
of attacks on, and in the restoration of, 
cybersecurity infrastructure in the after-
math of such attacks;
204
‘‘(B) a national cybersecurity threat and 
vulnerability reduction program that identifies 
cybersecurity vulnerabilities that would have a 
national effect on critical infrastructure, per-
forms vulnerability assessments on information 
technologies, and coordinates the mitigation of 
such vulnerabilities; 
‘‘(C) a national cybersecurity awareness 
and 
training 
program 
that 
promotes 
cybersecurity awareness among the public and 
the private sectors and promotes cybersecurity 
training and education programs; 
‘‘(D) a government cybersecurity program 
to coordinate and consult with Federal, State, 
and 
local 
governments 
to 
enhance 
their 
cybersecurity programs; and 
‘‘(E) a national security and international 
cybersecurity cooperation program to help fos-
ter Federal efforts to enhance international 
cybersecurity awareness and cooperation. 
‘‘(2) To coordinate with the private sector on 
the program under paragraph (1) as appropriate, 
and to promote cybersecurity information sharing, 
vulnerability assessment, and threat warning regard-
ing critical infrastructure.
205
‘‘(3) To coordinate with other directorates and 
offices within the Department on the cybersecurity 
aspects of their missions. 
‘‘(4) To coordinate with the Under Secretary 
for Emergency Preparedness and Response to en-
sure that the National Response Plan developed pur-
suant to section 502(6) of the Homeland Security 
Act of 2002 (6 U.S.C. 312(6)) includes appropriate 
measures for the recovery of the cybersecurity ele-
ments of critical infrastructure. 
‘‘(5) To develop processes for information shar-
ing with the private sector, consistent with section 
214, that—
‘‘(A) promote voluntary cybersecurity best 
practices, standards, and benchmarks that are 
responsive to rapid technology changes and to 
the security needs of critical infrastructure; and 
‘‘(B) consider roles of Federal, State, local, 
and foreign governments and the private sector, 
including the insurance industry and auditors. 
‘‘(6) To coordinate with the Chief Information 
Officer of the Department in establishing a secure 
information sharing architecture and information 
sharing processes, including with respect to the De-
partment’s operation centers.
265
shall designate a senior official within the Office of Inspec-
tor General who is a career member of the civil service 
at the equivalent to the GS–15 level or a career member 
of the Senior Executive Service, to perform the functions 
described in subsection (b). 
‘‘(b) FUNCTIONS.—The senior official designated 
under subsection (a) shall–—
‘‘(1) coordinate the activities of the Office of 
Inspector General with respect to investigations of 
abuses of civil rights or civil liberties; 
‘‘(2) receive and review complaints and infor-
mation from any source alleging abuses of civil 
rights and civil liberties by employees or officials of 
the Department of Homeland Security or by employ-
ees or officials of independent contractors or grant-
ees of the Department; 
‘‘(3) initiate investigations of alleged abuses of 
civil rights or civil liberties by employees or officials 
of the Department of Homeland Security or by em-
ployees or officials of independent contractors or 
grantees of the Department; 
‘‘(4) ensure that personnel within the Office of 
Inspector General receive sufficient training to con-
duct effective civil rights and civil liberties investiga-
tions;