as added by section 4 of this Act, the following new sub-
section:
‘‘(d)(1) The Institute shall solicit the recommenda-
tions of the Computer System Security and Privacy Advi-
sory Board, established by section 21, regarding standards
and guidelines that are being considered for submittal to
the Secretary in accordance with subsection (a)(4). The
recommendations of the Board shall accompany standards
and guidelines submitted to the Secretary.
‘‘(2) There are authorized to be appropriated to the
Secretary $1,030,000 for fiscal year 2002 and $1,060,000
for fiscal year 2003 to enable the Computer System Secu-
rity and Privacy Advisory Board, established by section
21, to identify emerging issues related to computer secu-
rity, privacy, and cryptography and to convene public
meetings on those subjects, receive presentations, and
publish reports, digests, and summaries for public dis-
tribution on those subjects.’’.
SEC. 6. LIMITATION ON PARTICIPATION IN REQUIRING
ENCRYPTION 
AND 
ELECTRONIC 
AUTHEN-
TICATION STANDARDS.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this
Act, is further amended by adding at the end the following
new subsection:
‘‘(g) The Institute shall not promulgate, enforce, or
otherwise adopt standards or policies for the Federal es-
tablishment of encryption and electronic authentication
standards required for use in computer systems other than
Federal Government computer systems.’’.
SEC. 7. MISCELLANEOUS AMENDMENTS.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this
Act, is further amended—
(1) in subsection (b)(8), as so redesignated by
section 3(1) of this Act, by inserting ‘‘to the extent
that such coordination will improve computer secu-
rity and to the extent necessary for improving such
security for Federal computer systems’’ after ‘‘Man-
agement and Budget)’’;
(2) in subsection (e), as so redesignated by sec-
tion 4(1) of this Act, by striking ‘‘shall draw upon’’
and inserting in lieu thereof ‘‘may draw upon’’;
(3) in subsection (e)(2), as so redesignated by
section 4(1) of this Act, by striking ‘‘(b)(5)’’ and in-
serting in lieu thereof ‘‘(b)(7)’’; and
(4) in subsection (f)(1)(B)(i), as so redesig-
nated by section 4(1) of this Act, by inserting ‘‘and
computer networks’’ after ‘‘computers’’.
SEC. 8. FEDERAL COMPUTER SYSTEM SECURITY TRAINING.
Section 5(b) of the Computer Security Act of 1987
(40 U.S.C. 759 note) is amended—
(1) by striking ‘‘and’’ at the end of paragraph
(1);
(2) by striking the period at the end of para-
graph (2) and inserting in lieu thereof ‘‘; and’’; and
(3) by adding at the end the following new
paragraph:
‘‘(3) to include emphasis on protecting informa-
tion in Federal databases and Federal computer
sites that are accessible through public networks.’’.
SEC. 9. COMPUTER SECURITY FELLOWSHIP PROGRAM.
There are authorized to be appropriated to the Sec-
retary of Commerce $5,000,000 for fiscal year 2002 and
$5,000,000 for fiscal year 2003 for the Director of the
National Institute of Standards and Technology for fellow-
ships, subject to the provisions of section 18 of the Na-
tional Institute of Standards and Technology Act (15
U.S.C. 278g–1), to support students at institutions of
higher learning in computer security. Amounts authorized
by this section shall not be subject to the percentage limi-
tation stated in such section 18.
SEC. 10. STUDY OF ELECTRONIC AUTHENTICATION TECH-
NOLOGIES BY THE NATIONAL RESEARCH
COUNCIL.
(a) REVIEW BY NATIONAL RESEARCH COUNCIL.—
Not later than 90 days after the date of the enactment
of this Act, the Secretary of Commerce shall enter into
a contract with the National Research Council of the Na-
tional Academy of Sciences to conduct a study of elec-
tronic authentication technologies for use by individuals,
businesses, and government.
(b) CONTENTS.—The study referred to in subsection
(a) shall—
(1) assess technology needed to support elec-
tronic authentication technologies;
(2) assess current public and private plans for
the deployment of electronic authentication tech-
nologies;
(3) assess interoperability, scalability, and in-
tegrity of private and public entities that are ele-
ments of electronic authentication technologies; and
(4) address such other matters as the National
Research Council considers relevant to the issues of
electronic authentication technologies.
(c) INTERAGENCY COOPERATION WITH STUDY.—All
agencies of the Federal Government shall cooperate fully
with the National Research Council in its activities in car-
rying out the study under this section, including access
by properly cleared individuals to classified information if
necessary.
(d) REPORT.—Not later than 18 months after the
date of the enactment of this Act, the Secretary of Com-
merce shall transmit to the Committee on Science of the
House of Representatives and the Committee on Com-
merce, Science, and Transportation of the Senate a report
setting forth the findings, conclusions, and recommenda-
tions of the National Research Council for public policy
related to electronic authentication technologies for use by
individuals, businesses, and government. The National Re-
search Council shall not recommend the implementation
or application of a specific electronic authentication tech-
nology or electronic authentication technical specification
for use by the Federal Government. Such report shall be
submitted in unclassified form.
(e) AUTHORIZATION
OF APPROPRIATIONS.—There
are authorized to be appropriated to the Secretary of Com-
merce $450,000 for fiscal year 2002, to remain available
until expended, for carrying out this section.
SEC. 11. PROMOTION OF NATIONAL INFORMATION SECU-
RITY.
The Under Secretary of Commerce for Technology
shall—
(1) promote an increased use of security tech-
niques, such as risk assessment, and security tools,
such as cryptography, to enhance the protection of
the Nation’s information infrastructure;
(2) establish a central repository of information
for dissemination to the public to promote awareness
of information security vulnerabilities and risks; and
(3) in a manner consistent with section 12(d) of
the National Technology Transfer and Advancement
Act of 1995 (15 U.S.C. 272 nt), promote the devel-
opment of national standards-based infrastructures
needed to support government, commercial, and pri-
vate uses of encryption technologies for confiden-
tiality and authentication.
SEC. 12. ELECTRONIC AUTHENTICATION INFRASTRUC-
TURES.
(a) ELECTRONIC
AUTHENTICATION
INFRASTRUC-
TURES.—
(1) TECHNOLOGY-NEUTRAL
GUIDELINES
AND
STANDARDS.—Not later than 18 months after the
date of the enactment of this Act, the Director, in
consultation with industry and appropriate Federal
agencies, shall develop technology-neutral guidelines
and standards, or adopt existing technology-neutral
industry guidelines and standards, for electronic au-