Cyber-Security Enhancement and Consumer Data Protection Act of 2006

Bill: 109-hr-5318
Sponsor: Rep. Sensenbrenner, F. James, Jr. [R-WI-5]
Introduced: 2006-05-09 in the House
Policy area: Crime and Law Enforcement
Subjects: Administrative procedure
Armed Forces and National Security
Civil Rights and Liberties, Minority Issues
Classified defense information
Commerce
Computer crimes
Computer hackers
Computer industry
Computer security measures
Conspiracy
Consumer education
Counterintelligence
Criminal investigation
Criminal justice information
Data banks
Department of Homeland Security
Department of Justice
Electronic government information
Espionage
Federal Bureau of Investigation (FBI)
Federal employees
Federal law enforcement officers
Fines (Penalties)
Forfeiture
Fraud
Government Operations and Politics
Government contractors
Government paperwork
Identification devices
Identity theft
Information technology
Internet
Labor and Employment
Larceny
Law
Obstruction of justice
Official secrets
Organized crime
Personnel records
Police training
Prosecution
Recruiting of employees
Right of privacy
Science, Technology, Communications
Secret service
Sentencing guidelines
U.S. Sentencing Commission

Summary:
action_date: 2006-05-09
text: 
Cyber-Security Enhancement and Consumer Data Protection Act of 2006 - Amends the federal criminal code to: (1) prohibit accessing or remotely controlling a protected computer without authorization to obtain identification information; (2) revise the definition of &quot;protected computer&quot; to include computers affecting interstate or foreign commerce or communication; (3) expand the definition of racketeering to include computer fraud; (4) redefine the crime of computer-related extortion to include threats to access without authorization (or to exceed authorized access of) a protected computer; (5) impose criminal penalties for conspiracy to commit computer fraud; (6) impose a fine and/or five year prison term for failure to notify the U.S. Secret Service or Federal Bureau of Investigation (FBI) of a major security breach in a computer system, with the intent to thwart an investigation of such breach, if such breach causes a significant risk of identity theft; and (7) increase to 30 years the maximum term of imprisonment for computer fraud and require forfeiture of property used to commit computer fraud. 
 
Directs the U.S. Sentencing Commission to review and amend its guidelines and policy statements to reflect congressional intent to increase criminal penalties for computer fraud. 
 
Authorizes additional appropriations in FY2007-FY2011 to the U.S. Secret Service, the Department of Justice, and the FBI to investigate and prosecute criminal activity involving computers.

action_date: 2006-06-22
text: 
Cyber-Security Enhancement and Consumer Data Protection Act of 2006 - (Sec. 2) Amends the federal criminal code to prohibit obtaining without authorization: (1) a means of identification from a protected computer (a computer exclusively for the use of a financial institution or the federal government); or (2) the capability to gain access to or remotely control a protected computer. 
 
(Sec. 3) Revises the definition of &quot;protected computer&quot; to include a computer the use of which affects interstate or foreign commerce or communication. Eliminates the criminal law requirement that conduct constituting computer fraud involve an interstate or foreign communication. 
 
(Sec. 4) Includes computer fraud within the definition of racketeering for purposes of the Racketeer Influenced and Corrupt Organizations Act (RICO).

(Sec. 5) Includes threats to access a protected computer without authorization or to exceed such authorized access within the definition of computer-related extortion. 

(Sec. 6) Expands the crime of computer fraud to include conspiracy to commit computer fraud.

(Sec. 7) Imposes a fine and/or prison term of up to five years for failure to notify the U.S. Secret Service or Federal Bureau of Investigation (FBI) of a major security breach in a database containing identification information with the intent to prevent, obstruct, or impede a lawful investigation of such breach. Defines &quot;major security breach&quot; as any security breach that involves: (1) the acquisition of the identification information of 10,000 or more individuals causing a significant risk of identity theft; (2) databases owned by the federal government; and (3) data containing identification information of federal employees or contractors involved in national security matters or law enforcement.

Directs the Attorney General and the Secretary of Homeland Security to jointly issue regulations on the form, content, and timing of notices of major security breaches. Requires that such regulations provide that notice of a security breach be provided to the Secret Service or FBI before notice is provided to consumers and within 14 days after discovery of such breach.
 
Grants immunity to law enforcement entities or to any person who notifies law enforcement of a security breach. 
 
Imposes a civil penalty of $50,000 for each day any individual fails to provide notice of a major security breach (not to exceed $1 million).

(Sec. 8) Increases the prison term for computer fraud to a maximum of 30 years. Requires forfeiture of any personal property used to commit computer fraud.

(Sec. 9) Directs the U.S. Sentencing Commission to review and amend its guidelines and policy statements to reflect congressional intent to increase criminal penalties for computer fraud. 

(Sec. 10) Imposes criminal penalties for damage affecting ten or more protected computers during any one-year period.

(Sec. 11) Authorizes additional funding in FY2007-FY2011 to the Director of the Secret Service, the Attorney General for the Criminal Division of the Department of Justice, and the Director of the FBI to investigate and prosecute crimes committed through the use of computers.


Legislative actions:
action_date: 2006-06-22
text: Placed on the Union Calendar, Calendar No. 292.
action_date: 2006-06-22
text: Reported (Amended) by the Committee on Judiciary. H. Rept. 109-522.
action_date: 2006-06-22
text: Reported (Amended) by the Committee on Judiciary. H. Rept. 109-522.
action_date: 2006-05-25
text: Ordered to be Reported (Amended) by Voice Vote.
action_date: 2006-05-25
text: Committee Consideration and Mark-up Session Held.
action_date: 2006-05-18
text: Forwarded by Subcommittee to Full Committee by Voice Vote .
action_date: 2006-05-18
text: Subcommittee Consideration and Mark-up Session Held.
action_date: 2006-05-11
text: Subcommittee Hearings Held.
action_date: 2006-05-09
text: Referred to the House Committee on the Judiciary.
action_date: 2006-05-09
text: Referred to the Subcommittee on Crime, Terrorism, and Homeland Security.
action_date: 2006-05-09
text: Introduced in House
action_date: 2006-05-09
text: Introduced in House