In the Senate of the United States,
October 16, 2002.
Resolved, That the bill from the House of Representa-
tives (H.R. 3394) entitled ‘‘An Act to authorize funding for
computer and network security research and development and
research fellowship programs, and for other purposes.’’, do
pass with the following
AMENDMENT:
Strike out all after the enacting clause and insert:
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Cyber Security Research
and Development Act’’.
†
HR 3394 EAS
SEC. 2. FINDINGS.
The Congress finds the following:
(1) Revolutionary advancements in computing
and communications technology have interconnected
government, commercial, scientific, and educational
infrastructures—including critical infrastructures for
electric power, natural gas and petroleum production
and distribution, telecommunications, transportation,
water supply, banking and finance, and emergency
and government services—in a vast, interdependent
physical and electronic network.
(2) Exponential increases in interconnectivity
have facilitated enhanced communications, economic
growth, and the delivery of services critical to the
public welfare, but have also increased the con-
sequences of temporary or prolonged failure.
(3) A Department of Defense Joint Task Force
concluded after a 1997 United States information
warfare exercise that the results ‘‘clearly demonstrated
our lack of preparation for a coordinated cyber and
physical attack on our critical military and civilian
infrastructure’’.
(4) Computer security technology and systems
implementation lack—
(A) sufficient long term research funding;
†
HR 3394 EAS
(B) adequate coordination across Federal
and State government agencies and among gov-
ernment, academia, and industry; and
(C) sufficient numbers of outstanding re-
searchers in the field.
(5) Accordingly, Federal investment in computer
and network security research and development must
be significantly increased to—
(A) improve vulnerability assessment and
technological and systems solutions;
(B) expand and improve the pool of infor-
mation security professionals, including re-
searchers, in the United States workforce; and
(C) better coordinate information sharing
and collaboration among industry, government,
and academic research projects.
(6) While African-Americans, Hispanics, and
Native Americans constitute 25 percent of the total
United States workforce and 30 percent of the college-
age population, members of these minorities comprise
less than 7 percent of the United States computer and
information science workforce.
SEC. 3. DEFINITIONS.
In this Act:
†
HR 3394 EAS
(1) DIRECTOR.—The term ‘‘Director’’ means the
Director of the National Science Foundation.
(2) INSTITUTION OF HIGHER EDUCATION.—The
term ‘‘institution of higher education’’ has the mean-
ing given that term in section 101(a) of the Higher
Education Act of 1965 (20 U.S.C. 1001(a)).
SEC. 4. NATIONAL SCIENCE FOUNDATION RESEARCH.
(a) COMPUTER AND NETWORK SECURITY RESEARCH
GRANTS.—
(1) IN
GENERAL.—The Director shall award
grants for basic research on innovative approaches to
the structure of computer and network hardware and
software that are aimed at enhancing computer secu-
rity. Research areas may include—
(A) authentication, cryptography, and other
secure data communications technology;
(B) computer forensics and intrusion detec-
tion;
(C) reliability of computer and network ap-
plications, middleware, operating systems, con-
trol systems, and communications infrastructure;
(D) privacy and confidentiality;
(E) network security architecture, including
tools for security administration and analysis;
(F) emerging threats;
†
HR 3394 EAS
(G) vulnerability assessments and tech-
niques for quantifying risk;
(H) remote access and wireless security; and
(I) enhancement of law enforcement ability
to detect, investigate, and prosecute cyber-crimes,
including those that involve piracy of intellectual
property.
(2) MERIT REVIEW; COMPETITION.—Grants shall
be awarded under this section on a merit-reviewed
competitive basis.
(3) AUTHORIZATION
OF
APPROPRIATIONS.—
There are authorized to be appropriated to the Na-
tional 
Science 
Foundation 
to 
carry 
out 
this
subsection—
(A) $35,000,000 for fiscal year 2003;
(B) $40,000,000 for fiscal year 2004;
(C) $46,000,000 for fiscal year 2005;
(D) $52,000,000 for fiscal year 2006; and
(E) $60,000,000 for fiscal year 2007.
(b) COMPUTER AND NETWORK SECURITY RESEARCH
CENTERS.—
(1) IN
GENERAL.—The Director shall award
multiyear grants, subject to the availability of appro-
priations, to institutions of higher education, non-
profit research institutions, or consortia thereof to es-
†
HR 3394 EAS
tablish multidisciplinary Centers for Computer and
Network Security Research. Institutions of higher
education, nonprofit research institutions, or con-
sortia thereof receiving such grants may partner with
1 or more government laboratories or for-profit insti-
tutions, or other institutions of higher education or
nonprofit research institutions.
(2) MERIT REVIEW; COMPETITION.—Grants shall
be awarded under this subsection on a merit-reviewed
competitive basis.
(3) PURPOSE.—The purpose of the Centers shall
be to generate innovative approaches to computer and
network security by conducting cutting-edge, multi-
disciplinary research in computer and network secu-
rity, including the research areas described in sub-
section (a)(1).
(4) APPLICATIONS.—An institution of higher
education, nonprofit research institution, or consortia
thereof seeking funding under this subsection shall
submit an application to the Director at such time,
in such manner, and containing such information as
the Director may require. The application shall in-
clude, at a minimum, a description of—
†
HR 3394 EAS
(A) the research projects that will be under-
taken by the Center and the contributions of each
of the participating entities;
(B) how the Center will promote active col-
laboration among scientists and engineers from
different disciplines, such as computer scientists,
engineers, mathematicians, and social science re-
searchers;
(C) how the Center will contribute to in-
creasing the number and quality of computer
and network security researchers and other pro-
fessionals, including individuals from groups
historically underrepresented in these fields; and
(D) how the center will disseminate research
results quickly and widely to improve cyber secu-
rity in information technology networks, prod-
ucts, and services.
(5) CRITERIA.—In evaluating the applications
submitted under paragraph (4), the Director shall
consider, at a minimum—
(A) the ability of the applicant to generate
innovative approaches to computer and network
security and effectively carry out the research
program;