[Congressional Bills 106th Congress]
[From the U.S. Government Publishing Office]
[S. 2430 Introduced in Senate (IS)]







106th CONGRESS
  2d Session
                                S. 2430

  To combat computer hacking through enhanced law enforcement and to 
  protect the privacy and constitutional rights of Americans, and for 
                            other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                             April 13, 2000

   Mr. Leahy introduced the following bill; which was read twice and 
               referred to the Committee on the Judiciary

_______________________________________________________________________

                                 A BILL


 
  To combat computer hacking through enhanced law enforcement and to 
  protect the privacy and constitutional rights of Americans, and for 
                            other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Internet Security Act of 2000''.

SEC. 2. AMENDMENTS TO THE COMPUTER FRAUD AND ABUSE ACT.

    Section 1030 of title 18, United States Code, is amended--
            (1) in subsection (a)--
                    (A) in paragraph (5)--
                            (i) by inserting ``(i)'' after ``(A)'' and 
                        redesignating subparagraphs (B) and (C) as 
                        clauses (ii) and (iii), respectively;
                            (ii) in subparagraph (A)(iii), as 
                        redesignated, by adding ``and'' at the end; and
                            (iii) by adding at the end the following:
                    ``(B) the conduct described in clause (i), (ii), or 
                (iii) of subparagraph (A)--
                            ``(i) caused loss aggregating at least 
                        $5,000 in value during a 1-year period to 1 or 
                        more individuals;
                            ``(ii) modified or impaired, or potentially 
                        modified or impaired, the medical examination, 
                        diagnosis, treatment, or care of 1 or more 
                        individuals;
                            ``(iii) caused physical injury to any 
                        person; or
                            ``(iv) threatened public health or 
                        safety;''; and
                    (B) in paragraph (6), by adding ``or'' at the end;
            (2) in subsection (c)--
                    (A) in paragraph (2)--
                            (i) in subparagraph (A), by striking 
                        ``and'' at the end; and
                            (ii) in subparagraph (B), by inserting ``or 
                        an attempted offense'' after ``in the case of 
                        an offense''; and
                    (B) by adding at the end the following:
            ``(4) forfeiture to the United States in accordance with 
        subsection (i) of the interest of the offender in--
                    ``(A) any personal property used or intended to be 
                used to commit or to facilitate the commission of the 
                offense; and
                    ``(B) any property, real or personal, that 
                constitutes or that is derived from proceeds traceable 
                to any violation of this section.'';
            (3) in subsection (d)--
                    (A) by striking ``subsections (a)(2)(A), (a)(2)(B), 
                (a)(3), (a)(4), (a)(5), and (a)(6) of''; and
                    (B) by striking ``which shall be entered into by'' 
                and inserting ``between'';
            (4) in subsection (e)--
                    (A) in paragraph (2)(B), by inserting ``, including 
                computers located outside the United States'' before 
                the semicolon;
                    (B) in paragraph (4), by striking the period at the 
                end and inserting a semicolon;
                    (C) in paragraph (7), by striking ``and'' at the 
                end;
                    (D) in paragraph (8), by striking ``, that'' and 
                all that follows through ``; and'' and inserting a 
                semicolon;
                    (E) in paragraph (9), by striking the period at the 
                end and inserting ``; and''; and
                    (F) by adding at the end the following:
            ``(10) the term `loss' includes--
                    ``(A) the reasonable costs to any victim of--
                            ``(i) responding to the offense;
                            ``(ii) conducting a damage assessment; and
                            ``(iii) restoring the system and data to 
                        their condition prior to the offense; and
                    ``(B) any lost revenue or costs incurred by the 
                victim as a result of interruption of service.'';
            (5) in subsection (g), by striking ``Damages for violations 
        involving damage as defined in subsection (c)(8)(A)'' and 
        inserting ``losses specified in subsection (a)(5)(B)(i)''; and
            (6) by adding at the end the following:
    ``(i) Provisions Governing Forfeiture.--Property subject to 
forfeiture under this section, any seizure and disposition thereof, and 
any administrative or judicial proceeding in relation thereto, shall be 
governed by subsection (c) and subsections (e) through (p) of section 
413 of the Comprehensive Drug Abuse Prevention and Control Act of 1970 
(21 U.S.C. 853).''.

SEC. 3. SENSE OF CONGRESS.

    It is the sense of Congress that--
            (1) acts that damage or attempt to damage computers used in 
        the delivery of critical infrastructure services such as 
        telecommunications, energy, transportation, banking and 
        financial services, and emergency and government services pose 
        a serious threat to public health and safety and cause or have 
        the potential to cause losses to victims that include costs of 
        responding to offenses, conducting damage assessments, and 
        restoring systems and data to their condition prior to the 
        offense, as well as lost revenue and costs incurred as a result 
        of interruptions of service; and
            (2) the Federal Government should have jurisdiction to 
        investigate acts affecting protected computers, as defined in 
        section 1030(e)(2)(B) of title 18, United States Code, as 
        amended by this Act, even if the effects of such acts occur 
        wholly outside the United States, as in such instances a 
        sufficient Federal nexus is conferred through the 
        interconnected and interdependent nature of computers used in 
        interstate or foreign commerce or communication.

SEC. 4. MODIFICATION OF SENTENCING COMMISSION DIRECTIVE.

    Pursuant to its authority under section 994(p) of title 28, United 
States Code, the United States Sentencing Commission shall amend the 
Federal sentencing guidelines to ensure that any individual convicted 
of a violation of paragraph (4) or (5) of section 1030(a) of title 18, 
United States Code, can be subjected to appropriate penalties, without 
regard to any mandatory minimum term of imprisonment.

SEC. 5. FORFEITURE OF DEVICES USED IN COMPUTER SOFTWARE COUNTERFEITING.

    Section 2318(d) of title 18, United States Code, is amended by--
            (1) inserting ``(1)'' before ``When'';
            (2) inserting ``, and any replicator or other device or 
        thing used to copy or produce the computer program or other 
        item to which the counterfeit label was affixed, or was 
        intended to be affixed'' before the period; and
            (3) by adding at the end the following:
    ``(2) The forfeiture of property under this section, including any 
seizure and disposition of the property, and any related judicial or 
administrative proceeding, shall be governed by the provisions of 
section 413 (other than subsection (d) of that section) of the 
Comprehensive Drug Abuse Prevention and Control Act of 1970 (21 U.S.C. 
853).''.

SEC. 6. CONFORMING AMENDMENT.

    Section 492 of title 18, United States Code, is amended by striking 
``or 1720,'' and inserting ``, 1720, or 2318''.

SEC. 7. PEN REGISTERS AND TRAP AND TRACE DEVICES.

    Section 3123 of title 18, United States Code is amended--
            (1) by striking subsection (a) and inserting the following:
    ``(a) Issuance of Order.--
            ``(1) Requests from attorneys for the government.--Upon an 
        application made under section 3122(a)(1), the court may enter 
        an ex parte order authorizing the installation and use of a pen 
        register or a trap and trace device if the court finds, based 
        on the certification by the attorney for the Government, that 
        the information likely to be obtained by such installation and 
        use is relevant to an ongoing criminal investigation. Such 
        order shall apply to any entity providing wire or electronic 
        communication service in the United States whose assistance is 
        necessary to effectuate the order.
            ``(2) Requests from state investigative or law enforcement 
        officers.--Upon an application made under section 3122(a)(2), 
        the court may enter an ex parte order authorizing the 
        installation and use of a pen register or a trap and trace 
        device within the jurisdiction of the court, if the court 
        finds, based on the certification by the State law enforcement 
        or investigative officer, that the information likely to be 
        obtained by such installation and use is relevant to an ongoing 
        criminal investigation.''; and
            (2) in subsection (b)--
                    (A) in paragraph (1)--
                            (i) in subparagraph (C), by inserting 
                        ``authorized under subsection (a)(2)'' after 
                        ``in the case of a trap and trace device''; and
                            (ii) in subparagraph (D), by striking 
                        ``and'' at the end;
                    (B) in paragraph (2), by striking the period at the 
                end and inserting ``; and''; and
                    (C) by adding at the end the following:
            ``(3) shall direct that the use of the pen register or trap 
        and trace device be conducted in such a way as to minimize the 
        recording or decoding of any electronic or other impulses that 
        are not related to the dialing and signaling information 
        utilized in processing by the service provider upon whom the 
        order is served.''.

SEC. 8. TECHNICAL AMENDMENTS TO PEN REGISTER AND TRAP AND TRACE 
              PROVISIONS.

    (a) Issuance of an Order.--Section 3123 of title 18, United States 
Code, is amended--
            (1) by inserting ``or other facility'' after ``line'' each 
        place that term appears;
            (2) by inserting ``or applied'' after ``attached'' each 
        place that term appears;
            (3) in subsection (b)(1)(C), by inserting ``or other 
        identifier'' after ``the number''; and
            (4) in subsection (d)(2), by striking ``who has been 
        ordered by the court'' and inserting ``who is obligated by the 
        order''.
    (b) Definitions.--Section 3127 of title 18, United States Code is 
amended--
            (1) by striking paragraph (3) and inserting the following:
            ``(3) the term `pen register'--
                    ``(A) means a device or process that records or 
                decodes electronic or other impulses that identify the 
                telephone numbers or electronic addresses dialed or 
                otherwise transmitted by an instrument or facility from 
                which a wire or electronic communication is transmitted 
                and used for purposes of identifying the destination or 
                termination of such communication by the service 
                provider upon which the order is served; and
                    ``(B) does not include any device or process used 
                by a provider or customer of a wire or electronic 
                communication service for billing, or recording as an 
                incident to billing, for communications services 
                provided by such provider or any device or process by a 
                provider or customer of a wire communication service 
                for cost accounting or other like purposes in the 
                ordinary course of its business;''; and
            (2) in paragraph (4)--
                    (A) by inserting ``or process'' after ``means a 
                device'';
                    (B) by inserting ``or other identifier'' after 
                ``number''; and
                    (C) by striking ``or device'' and inserting ``or 
                other facility''.

SEC. 9. PEN REGISTER AND TRAP AND TRACE REPORTS.

    Section 3126 of title 18, United States Code, is amended by 
inserting before the period at the end the following: ``, which report 
shall include information concerning--
            ``(1) the period of interceptions authorized by the order, 
        and the number and duration of any extensions of the order;
            ``(2) the offense specified in the order or application, or 
        extension of an order;
            ``(3) the number of investigations involved;
            ``(4) the number and nature of the facilities affected; and
            ``(5) the identity, including district, of the applying 
        investigative or law enforcement agency making the application 
        and the person authorizing the order''.

SEC. 10. ENHANCED DENIAL OF SERVICE INVESTIGATIONS.

    Section 2511(2)(c) of title 18, United States Code, is amended to 
read as follows:
    ``(c)(i) It shall not be unlawful under this chapter for a person 
acting under color of law to intercept a wire, oral, or electronic 
communication, if such person is a party to the communication or 1 of 
the parties to the communication has given prior consent to such 
interception.
    ``(ii) It shall not be unlawful under this chapter for a person 
acting under color of law to intercept a wire or electronic 
communication, if--
            ``(I) the transmission of the wire or electronic 
        communication is causing harmful interference to a lawfully 
        operating computer system;
            ``(II) any person who is not a provider of service to the 
        public and who is authorized to use the facility from which the 
        wire or electronic communication is to be intercepted has given 
        prior consent to the interception; and
            ``(III) the interception is conducted only to the extent 
        necessary to identify the source of the harmful interference 
        described in subclause (I).''.

SEC. 11. ENCRYPTION REPORTING REQUIREMENTS.

    Section 2519(2)(b) of title 18, United States Code, is amended by 
striking ``and (iv)'' and inserting ``(iv) the number of orders in 
which encryption was encountered and whether such encryption prevented 
law enforcement from obtaining the plain text of communications 
intercepted pursuant to such order, and (v)''.

SEC. 12. STATE AND LOCAL COMPUTER CRIME ENFORCEMENT.

    (a) In General.--Subject to the availability of amounts provided in 
advance in appropriations Acts, the Assistant Attorney General for the 
Office of Justice Programs of the Department of Justice shall make a 
grant to each State, which shall be used by the State, in conjunction 
with units of local government, State and local courts, other States, 
or combinations thereof, to--
            (1) assist State and local law enforcement in enforcing 
        State and local criminal laws relating to computer crime;
            (2) assist State and local law enforcement in educating the 
        public to prevent and identify computer crime;
            (3) assist in educating and training State and local law 
        enforcement officers and prosecutors to conduct investigations 
        and forensic analyses of evidence and prosecutions of computer 
        crime;
            (4) assist State and local law enforcement officers and 
        prosecutors in acquiring computer and other equipment to 
        conduct investigations and forensic analysis of evidence of 
        computer crimes; and
            (5) facilitate and promote the sharing of Federal law 
        enforcement expertise and information about the investigation, 
        analysis, and prosecution of computer crimes with State and 
        local law enforcement officers and prosecutors, including the 
        use of multijurisdictional task forces.
    (b) Use of Grant Amounts.--Grants under this section may be used to 
establish and develop programs to--
            (1) assist State and local law enforcement agencies in 
        enforcing State and local criminal laws relating to computer 
        crime;
            (2) assist State and local law enforcement agencies in 
        educating the public to prevent and identify computer crime;
            (3) educate and train State and local law enforcement 
        officers and prosecutors to conduct investigations and forensic 
        analyses of evidence and prosecutions of computer crime;
            (4) assist State and local law enforcement officers and 
        prosecutors in acquiring computer and other equipment to 
        conduct investigations and forensic analysis of evidence of 
        computer crimes; and
            (5) facilitate and promote the sharing of Federal law 
        enforcement expertise and information about the investigation, 
        analysis, and prosecution of computer crimes with State and 
        local law enforcement officers and prosecutors, including the 
        use of multijurisdictional task forces.
    (c) Assurances.--To be eligible to receive a grant under this 
section, a State shall provide assurances to the Attorney General that 
the State--
            (1) has in effect laws that penalize computer crime, such 
        as penal laws prohibiting--
                    (A) fraudulent schemes executed by means of a 
                computer system or network;
                    (B) the unlawful damaging, destroying, altering, 
                deleting, removing of computer software, or data 
                contained in a computer, computer system, computer 
                program, or computer network; or
                    (C) the unlawful interference with the operation of 
                or denial of access to a computer, computer program, 
                computer system, or computer network;
            (2) an assessment of the State and local resource needs, 
        including criminal justice resources being devoted to the 
        investigation and enforcement of computer crime laws; and
            (3) a plan for coordinating the programs funded under this 
        section with other federally funded technical assistant and 
        training programs, including directly funded local programs 
        such as the Local Law Enforcement Block Grant program 
        (described under the heading ``Violent Crime Reduction 
        Programs, State and Local Law Enforcement Assistance'' of the 
        Departments of Commerce, Justice, and State, the Judiciary, and 
        Related Agencies Appropriations Act, 1998 (Public Law 105-
        119)).
    (d) Matching Funds.--The Federal share of a grant received under 
this section may not exceed 90 percent of the total cost of a program 
or proposal funded under this section unless the Attorney General 
waives, wholly or in part, the requirements of this subsection.
    (e) Authorization of Appropriations.--
            (1) In general.--There is authorized to be appropriated to 
        carry out this section $25,000,000 for each of fiscal years 
        2000 through 2003.
            (2) Limitations.--Of the amount made available to carry out 
        this section in any fiscal year not more than 3 percent may be 
        used by the Attorney General for salaries and administrative 
        expenses.
            (3) Minimum amount.--Unless all eligible applications 
        submitted by any State or units of local government within a 
        State for a grant under this section have been funded, the 
        State, together with grantees within the State (other than 
        Indian tribes), shall be allocated in each fiscal year under 
        this section not less than 0.75 percent of the total amount 
        appropriated in the fiscal year for grants pursuant to this 
        section, except that the United States Virgin Islands, American 
        Samoa, Guam, and the Northern Mariana Islands each shall be 
        allocated 0.25 percent.
    (f) Grants to Indian Tribes.--Notwithstanding any other provision 
of this section, the Attorney General may use amounts made available 
under this section to make grants to Indian tribes for use in 
accordance with this section.
                                 <all>