Better Cybercrime Metrics Act

Bill: 117-s-2629
Sponsor: full_name: Sen. Schatz, Brian [D-HI]
Introduced: 2021-08-05
Policy area: Crime and Law Enforcement
Subjects: Computer security and identity theft

Congressional oversight

Crime victims

Criminal investigation, prosecution, interrogation

Criminal justice information and records

Government information and archives

Government studies and investigations
Latest action: action_date: 2022-05-05
text: Became Public Law No: 117-116.

Summaries:
action_date: 2021-08-05
action_desc: Introduced in Senate
text: <p><strong>Better Cybercrime Metrics Act</strong></p> <p>This bill establishes various requirements to improve the collection of data related to cybercrime and cyber-enabled crime (cybercrime). Among the requirements</p> <ul> <li>the Department of Justice (DOJ) must enter into an agreement with the National Academy of Sciences to develop a taxonomy for categorizing different types of cybercrime faced by individuals and businesses; </li> <li>DOJ must establish a category in the National Incident-Based Reporting System for collecting cybercrime reports from federal, state, and local officials; </li> <li>DOJ's Bureau of Justice Statistics and the Bureau of the Census must include questions about cybercrime in the annual National Crime Victimization Survey; and </li> <li>the Government Accountability Office must assess the effectiveness of reporting mechanisms for cybercrime and disparities in reporting cybercrime data and other types of crime data.</li></ul>

action_date: 2021-12-01
action_desc: Reported to Senate
text: <p><strong>Better Cybercrime Metrics Act</strong></p> <p>This bill establishes various requirements to improve the collection of data related to cybercrime and cyber-enabled crime (cybercrime). Among the requirements</p> <ul> <li>the Department of Justice (DOJ) must enter into an agreement with the National Academy of Sciences to develop a taxonomy for categorizing different types of cybercrime faced by individuals and businesses; </li> <li>DOJ must establish a category in the National Incident-Based Reporting System for collecting cybercrime reports from federal, state, and local officials; </li> <li>DOJ's Bureau of Justice Statistics and the Bureau of the Census must include questions about cybercrime in the annual National Crime Victimization Survey; and </li> <li>the Government Accountability Office must assess the effectiveness of reporting mechanisms for cybercrime and disparities in reporting cybercrime data and other types of crime data.</li></ul>

action_date: 2021-12-07
action_desc: Passed Senate
text: <p><strong>Better Cybercrime Metrics Act</strong></p> <p>This bill establishes various requirements to improve the collection of data related to cybercrime and cyber-enabled crime (cybercrime). Among the requirements</p> <ul> <li>the Department of Justice (DOJ) must enter into an agreement with the National Academy of Sciences to develop a taxonomy for categorizing different types of cybercrime faced by individuals and businesses; </li> <li>DOJ must establish a category in the National Incident-Based Reporting System for collecting cybercrime reports from federal, state, and local officials; </li> <li>DOJ's Bureau of Justice Statistics and the Bureau of the Census must include questions about cybercrime in the annual National Crime Victimization Survey; and </li> <li>the Government Accountability Office must assess the effectiveness of reporting mechanisms for cybercrime and disparities in reporting cybercrime data and other types of crime data.</li></ul>

action_date: 2022-03-29
action_desc: Passed House
text: <p><strong>Better Cybercrime Metrics Act</strong></p> <p>This bill establishes various requirements to improve the collection of data related to cybercrime and cyber-enabled crime (cybercrime). Among the requirements</p> <ul> <li>the Department of Justice (DOJ) must enter into an agreement with the National Academy of Sciences to develop a taxonomy for categorizing different types of cybercrime faced by individuals and businesses;</li> <li>DOJ must establish a category in the National Incident-Based Reporting System for collecting cybercrime reports from federal, state, and local officials;</li> <li>DOJ's Bureau of Justice Statistics and the Bureau of the Census must include questions about cybercrime in the annual National Crime Victimization Survey; and</li> <li>the Government Accountability Office must assess the effectiveness of reporting mechanisms for cybercrime and disparities in reporting cybercrime data and other types of crime data.</li></ul>

action_date: 2022-05-05
action_desc: Public Law
text: <p><strong>Better Cybercrime Metrics Act</strong></p> <p>This bill establishes various requirements to improve the collection of data related to cybercrime and cyber-enabled crime (cybercrime). Among the requirements</p> <ul> <li>the Department of Justice (DOJ) must enter into an agreement with the National Academy of Sciences to develop a taxonomy for categorizing different types of cybercrime faced by individuals and businesses;</li> <li>DOJ must establish a category in the National Incident-Based Reporting System for collecting cybercrime reports from federal, state, and local officials;</li> <li>DOJ's Bureau of Justice Statistics and the Bureau of the Census must include questions about cybercrime in the annual National Crime Victimization Survey; and</li> <li>the Government Accountability Office must assess the effectiveness of reporting mechanisms for cybercrime and disparities in reporting cybercrime data and other types of crime data.</li></ul>

tv_txt: II 117th CONGRESS 1st Session S. 2629 IN THE SENATE OF THE UNITED STATES August 5, 2021 Mr. Schatz (for himself, Mr. Tillis , Mr. Cornyn , and Mr. Blumenthal ) introduced the following bill; which was read twice and referred to the Committee on the Judiciary A BILL To establish cybercrime reporting mechanisms, and for other purposes.

1. Short title This Act may be cited as the Better Cybercrime Metrics Act . 2. Findings Congress finds the following: (1) Public polling indicates that cybercrime could be the most common crime in the United States. (2) The United States lacks comprehensive cybercrime data and monitoring, leaving the country less prepared to combat cybercrime that threatens national and economic security. (3) In addition to existing cybercrime vul­ner­a­bil­i­ties, the people of the United States and the United States have faced a heightened risk of cybercrime during the COVID–19 pandemic. (4) Subsection (c) of the Uniform Federal Crime Reporting Act of 1988 ( 34 U.S.C. 41303(c) ) requires the Attorney General to acquire, collect, classify, and preserve national data on Federal criminal offenses as part of the Uniform Crime Reports and requires all Federal departments and agencies that investigate criminal activity to report details about crime within their respective jurisdiction to the Attorney General in a uniform matter and on a form prescribed by the Attorney General . 3. Cybercrime taxonomy (a) In general Not later than 90 days after the date of enactment of this Act, the Attorney General shall seek to enter into an agreement with the National Academy of Sciences to develop a taxonomy for the purpose of categorizing different types of cybercrime and cyber-enabled crime faced by individuals and businesses. (b) Development In developing the taxonomy under subsection (a), the National Academy of Sciences shall— (1) ensure the taxonomy is useful for the Federal Bureau of Investigation to classify cybercrime in the National Incident-Based Reporting System, or any successor system; (2) consult relevant stakeholders, including— (A) the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security; (B) Federal, State, and local law enforcement agencies; (C) criminologists and academics; (D) cybercrime experts; and (E) business leaders; and (3) take into consideration relevant taxonomies developed by non-governmental organizations, international organizations, academies, or other entities. (c) Report Not later than 1 year after the date on which the Attorney General enters into an agreement under subsection (a), the National Academy of Sciences shall submit to the appropriate committees of Congress a report detailing and summarizing— (1) the taxonomy developed under subsection (a); and (2) any findings from the process of developing the taxonomy under subsection (a). (d) Authorization of appropriations There are authorized to be appropriated to carry out this section $1,000,000. 4. Cybercrime reporting (a) In general Not later than 2 years after the date of enactment of this Act, the Attorney General shall establish a category in the National Incident-Based Reporting System, or any successor system, for the collection of cybercrime and cyber-enabled crime reports from Federal, State, and local officials. (b) Recommendations In establishing the category required under subsection (a), the Attorney General shall, as appropriate, incorporate recommendations from the taxonomy developed under section 3(a). 5. National Crime Victimization Survey (a) In general Not later than 540 days after the date of enactment of this Act, the Director of the Bureau of Justice Statistics, in coordination with the Director of the Bureau of the Census, shall include questions relating to cybercrime victimization in the National Crime Victimization Survey. (b) Authorization of appropriations There are authorized to be appropriated to carry out this section $2,000,000. 6. GAO Study on cybercrime metrics Not later than 180 days after the date of enactment of this Act, the Comptroller General of the United States shall submit to Congress a report that assesses— (1) the effectiveness of reporting mechanisms for cybercrime and cyber-enabled crime in the United States; and (2) disparities in reporting data between— (A) data relating to cybercrime and cyber-enabled crime; and (B) other types of crime data.

tv_txt: II Calendar No. 173 117th CONGRESS 1st Session S. 2629 IN THE SENATE OF THE UNITED STATES August 5, 2021 Mr. Schatz (for himself, Mr. Tillis , Mr. Cornyn , Mr. Blumenthal , and Mr. Durbin ) introduced the following bill; which was read twice and referred to the Committee on the Judiciary December 1, 2021 Reported by Mr. Durbin , without amendment A BILL To establish cybercrime reporting mechanisms, and for other purposes.

1. Short title This Act may be cited as the Better Cybercrime Metrics Act . 2. Findings Congress finds the following: (1) Public polling indicates that cybercrime could be the most common crime in the United States. (2) The United States lacks comprehensive cybercrime data and monitoring, leaving the country less prepared to combat cybercrime that threatens national and economic security. (3) In addition to existing cybercrime vul­ner­a­bil­i­ties, the people of the United States and the United States have faced a heightened risk of cybercrime during the COVID–19 pandemic. (4) Subsection (c) of the Uniform Federal Crime Reporting Act of 1988 ( 34 U.S.C. 41303(c) ) requires the Attorney General to acquire, collect, classify, and preserve national data on Federal criminal offenses as part of the Uniform Crime Reports and requires all Federal departments and agencies that investigate criminal activity to report details about crime within their respective jurisdiction to the Attorney General in a uniform matter and on a form prescribed by the Attorney General . 3. Cybercrime taxonomy (a) In general Not later than 90 days after the date of enactment of this Act, the Attorney General shall seek to enter into an agreement with the National Academy of Sciences to develop a taxonomy for the purpose of categorizing different types of cybercrime and cyber-enabled crime faced by individuals and businesses. (b) Development In developing the taxonomy under subsection (a), the National Academy of Sciences shall— (1) ensure the taxonomy is useful for the Federal Bureau of Investigation to classify cybercrime in the National Incident-Based Reporting System, or any successor system; (2) consult relevant stakeholders, including— (A) the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security; (B) Federal, State, and local law enforcement agencies; (C) criminologists and academics; (D) cybercrime experts; and (E) business leaders; and (3) take into consideration relevant taxonomies developed by non-governmental organizations, international organizations, academies, or other entities. (c) Report Not later than 1 year after the date on which the Attorney General enters into an agreement under subsection (a), the National Academy of Sciences shall submit to the appropriate committees of Congress a report detailing and summarizing— (1) the taxonomy developed under subsection (a); and (2) any findings from the process of developing the taxonomy under subsection (a). (d) Authorization of appropriations There are authorized to be appropriated to carry out this section $1,000,000. 4. Cybercrime reporting (a) In general Not later than 2 years after the date of enactment of this Act, the Attorney General shall establish a category in the National Incident-Based Reporting System, or any successor system, for the collection of cybercrime and cyber-enabled crime reports from Federal, State, and local officials. (b) Recommendations In establishing the category required under subsection (a), the Attorney General shall, as appropriate, incorporate recommendations from the taxonomy developed under section 3(a). 5. National Crime Victimization Survey (a) In general Not later than 540 days after the date of enactment of this Act, the Director of the Bureau of Justice Statistics, in coordination with the Director of the Bureau of the Census, shall include questions relating to cybercrime victimization in the National Crime Victimization Survey. (b) Authorization of appropriations There are authorized to be appropriated to carry out this section $2,000,000. 6. GAO Study on cybercrime metrics Not later than 180 days after the date of enactment of this Act, the Comptroller General of the United States shall submit to Congress a report that assesses— (1) the effectiveness of reporting mechanisms for cybercrime and cyber-enabled crime in the United States; and (2) disparities in reporting data between— (A) data relating to cybercrime and cyber-enabled crime; and (B) other types of crime data.

December 1, 2021 Reported without amendment

tv_txt: 117th CONGRESS 1st Session S. 2629 IN THE SENATE OF THE UNITED STATES AN ACT To establish cybercrime reporting mechanisms, and for other purposes.

1. Short title This Act may be cited as the Better Cybercrime Metrics Act . 2. Findings Congress finds the following: (1) Public polling indicates that cybercrime could be the most common crime in the United States. (2) The United States lacks comprehensive cybercrime data and monitoring, leaving the country less prepared to combat cybercrime that threatens national and economic security. (3) In addition to existing cybercrime vul­ner­a­bil­i­ties, the people of the United States and the United States have faced a heightened risk of cybercrime during the COVID–19 pandemic. (4) Subsection (c) of the Uniform Federal Crime Reporting Act of 1988 ( 34 U.S.C. 41303(c) ) requires the Attorney General to acquire, collect, classify, and preserve national data on Federal criminal offenses as part of the Uniform Crime Reports and requires all Federal departments and agencies that investigate criminal activity to report details about crime within their respective jurisdiction to the Attorney General in a uniform matter and on a form prescribed by the Attorney General . 3. Cybercrime taxonomy (a) In general Not later than 90 days after the date of enactment of this Act, the Attorney General shall seek to enter into an agreement with the National Academy of Sciences to develop a taxonomy for the purpose of categorizing different types of cybercrime and cyber-enabled crime faced by individuals and businesses. (b) Development In developing the taxonomy under subsection (a), the National Academy of Sciences shall— (1) ensure the taxonomy is useful for the Federal Bureau of Investigation to classify cybercrime in the National Incident-Based Reporting System, or any successor system; (2) consult relevant stakeholders, including— (A) the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security; (B) Federal, State, and local law enforcement agencies; (C) criminologists and academics; (D) cybercrime experts; and (E) business leaders; and (3) take into consideration relevant taxonomies developed by non-governmental organizations, international organizations, academies, or other entities. (c) Report Not later than 1 year after the date on which the Attorney General enters into an agreement under subsection (a), the National Academy of Sciences shall submit to the appropriate committees of Congress a report detailing and summarizing— (1) the taxonomy developed under subsection (a); and (2) any findings from the process of developing the taxonomy under subsection (a). (d) Authorization of appropriations There are authorized to be appropriated to carry out this section $1,000,000. 4. Cybercrime reporting (a) In general Not later than 2 years after the date of enactment of this Act, the Attorney General shall establish a category in the National Incident-Based Reporting System, or any successor system, for the collection of cybercrime and cyber-enabled crime reports from Federal, State, and local officials. (b) Recommendations In establishing the category required under subsection (a), the Attorney General shall, as appropriate, incorporate recommendations from the taxonomy developed under section 3(a). 5. National Crime Victimization Survey (a) In general Not later than 540 days after the date of enactment of this Act, the Director of the Bureau of Justice Statistics, in coordination with the Director of the Bureau of the Census, shall include questions relating to cybercrime victimization in the National Crime Victimization Survey. (b) Authorization of appropriations There are authorized to be appropriated to carry out this section $2,000,000. 6. GAO Study on cybercrime metrics Not later than 180 days after the date of enactment of this Act, the Comptroller General of the United States shall submit to Congress a report that assesses— (1) the effectiveness of reporting mechanisms for cybercrime and cyber-enabled crime in the United States; and (2) disparities in reporting data between— (A) data relating to cybercrime and cyber-enabled crime; and (B) other types of crime data.

Passed the Senate December 7, 2021. Secretary

tv_txt: One Hundred Seventeenth Congress of the United States of America 2d Session Begun and held at the City of Washington on Monday, the third day of January, two thousand and twenty two S. 2629 IN THE SENATE OF THE UNITED STATES AN ACT To establish cybercrime reporting mechanisms, and for other purposes.

1. Short title This Act may be cited as the Better Cybercrime Metrics Act . 2. Findings Congress finds the following: (1) Public polling indicates that cybercrime could be the most common crime in the United States. (2) The United States lacks comprehensive cybercrime data and monitoring, leaving the country less prepared to combat cybercrime that threatens national and economic security. (3) In addition to existing cybercrime vul­ner­a­bil­i­ties, the people of the United States and the United States have faced a heightened risk of cybercrime during the COVID–19 pandemic. (4) Subsection (c) of the Uniform Federal Crime Reporting Act of 1988 ( 34 U.S.C. 41303(c) ) requires the Attorney General to acquire, collect, classify, and preserve national data on Federal criminal offenses as part of the Uniform Crime Reports and requires all Federal departments and agencies that investigate criminal activity to report details about crime within their respective jurisdiction to the Attorney General in a uniform matter and on a form prescribed by the Attorney General . 3. Cybercrime taxonomy (a) In general Not later than 90 days after the date of enactment of this Act, the Attorney General shall seek to enter into an agreement with the National Academy of Sciences to develop a taxonomy for the purpose of categorizing different types of cybercrime and cyber-enabled crime faced by individuals and businesses. (b) Development In developing the taxonomy under subsection (a), the National Academy of Sciences shall— (1) ensure the taxonomy is useful for the Federal Bureau of Investigation to classify cybercrime in the National Incident-Based Reporting System, or any successor system; (2) consult relevant stakeholders, including— (A) the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security; (B) Federal, State, and local law enforcement agencies; (C) criminologists and academics; (D) cybercrime experts; and (E) business leaders; and (3) take into consideration relevant taxonomies developed by non-governmental organizations, international organizations, academies, or other entities. (c) Report Not later than 1 year after the date on which the Attorney General enters into an agreement under subsection (a), the National Academy of Sciences shall submit to the appropriate committees of Congress a report detailing and summarizing— (1) the taxonomy developed under subsection (a); and (2) any findings from the process of developing the taxonomy under subsection (a). (d) Authorization of appropriations There are authorized to be appropriated to carry out this section $1,000,000. 4. Cybercrime reporting (a) In general Not later than 2 years after the date of enactment of this Act, the Attorney General shall establish a category in the National Incident-Based Reporting System, or any successor system, for the collection of cybercrime and cyber-enabled crime reports from Federal, State, and local officials. (b) Recommendations In establishing the category required under subsection (a), the Attorney General shall, as appropriate, incorporate recommendations from the taxonomy developed under section 3(a). 5. National Crime Victimization Survey (a) In general Not later than 540 days after the date of enactment of this Act, the Director of the Bureau of Justice Statistics, in coordination with the Director of the Bureau of the Census, shall include questions relating to cybercrime victimization in the National Crime Victimization Survey. (b) Authorization of appropriations There are authorized to be appropriated to carry out this section $2,000,000. 6. GAO Study on cybercrime metrics Not later than 180 days after the date of enactment of this Act, the Comptroller General of the United States shall submit to Congress a report that assesses— (1) the effectiveness of reporting mechanisms for cybercrime and cyber-enabled crime in the United States; and (2) disparities in reporting data between— (A) data relating to cybercrime and cyber-enabled crime; and (B) other types of crime data.

Speaker of the House of Representatives Vice President of the United States and President of the Senate