[Congressional Bills 107th Congress]
[From the U.S. Government Publishing Office]
[H.R. 2458 Reported in House (RH)]
Union Calendar No. 489
107th CONGRESS
2d Session
H. R. 2458
[Report No. 107-787, Part I]
To enhance the management and promotion of electronic Government
services and processes by establishing a Federal Chief Information
Officer within the Office of Management and Budget, and by establishing
a broad framework of measures that require using Internet-based
information technology to enhance citizen access to Government
information and services, and for other purposes.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
July 11, 2001
Mr. Turner, (for himself, Ms. Harman, Mr. Sandlin, Mrs. McCarthy of
New York, Mrs. Tauscher, Mr. Schiff, Mr. Moran of Virginia, Mrs. Capps,
Mr. Dooley of California, Mr. McIntyre, Mr. Kind, Mr. Cramer, Mr.
Tanner, Mr. Stenholm, Mr. Thompson of California, Mr. Ford, Mr. Moore,
Mr. Carson of Oklahoma, Mr. Ross, Mr. Davis of Florida, Mr. Smith of
Washington, Ms. Eshoo, Mr. Etheridge, Mr. Boswell, Mr. Boyd, Mr.
Bentsen, Mr. Edwards, Mr. Wu, Ms. Hooley of Oregon, Mr. Hill, Mr.
Lampson, Mr. Price of North Carolina, Mr. Doggett, Mr. Holt, Mr. Larson
of Connecticut, Mrs. Thurman, and Mr. Green of Texas) introduced the
following bill; which was referred to the Committee on Government
Reform
November 14, 2002
Additional sponsors: Mr. Matheson, Ms. Baldwin, Mrs. Maloney of New
York, and Mr. Tom Davis of Virginia
November 14, 2002
Reported with an amendment and referred to the Committee on the
Judiciary for a period ending not later than Novermber 14, 2002 for
consideration of such provisions of the bill and amendment as fall
within the jurisdiction of that committee pursuant to clause 1(k), rule
X
[Strike out all after the enacting clause and insert the part printed
in italic]
November 14, 2002
Committee on the Judiciary discharged; committed to the Committee of
the Whole House on the State of the Union and ordered to be printed
[For text of introduced bill, see copy of bill as introduced on July
11, 2001]
_______________________________________________________________________
A BILL
To enhance the management and promotion of electronic Government
services and processes by establishing a Federal Chief Information
Officer within the Office of Management and Budget, and by establishing
a broad framework of measures that require using Internet-based
information technology to enhance citizen access to Government
information and services, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``E-Government Act
of 2002''.
(b) Table of Contents.--The table of contents for this Act is as
follows:
Sec. 1. Short title; table of contents.
Sec. 2. Findings and purposes.
TITLE I--OFFICE OF MANAGEMENT AND BUDGET ELECTRONIC GOVERNMENT SERVICES
Sec. 101. Management and promotion of electronic government services.
Sec. 102. Conforming amendments.
TITLE II--FEDERAL MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT
SERVICES
Sec. 201. Definitions.
Sec. 202. Federal agency responsibilities.
Sec. 203. Compatibility of executive agency methods for use and
acceptance of electronic signatures.
Sec. 204. Federal Internet portal.
Sec. 205. Federal courts.
Sec. 206. Regulatory agencies.
Sec. 207. Accessibility, usability, and preservation of government
information.
Sec. 208. Privacy provisions.
Sec. 209. Federal information technology workforce development.
Sec. 210. Share-in-savings initiatives.
Sec. 211. Authorization for acquisition of information technology by
State and local governments through Federal
supply schedules.
Sec. 212. Integrated reporting study and pilot projects.
Sec. 213. Community technology centers.
Sec. 214. Enhancing crisis management through advanced information
technology.
Sec. 215. Disparities in access to the Internet.
TITLE III--INFORMATION SECURITY
Sec. 301. Information security.
Sec. 302. Management of information technology.
Sec. 303. National Institute of Standards and Technology.
Sec. 304. Information Security and Privacy Advisory Board.
Sec. 305. Technical and conforming amendments.
Sec. 306. Construction.
TITLE IV--AUTHORIZATION OF APPROPRIATIONS AND EFFECTIVE DATES
Sec. 401. Authorization of appropriations.
Sec. 402. Effective dates.
TITLE V--CONFIDENTIAL INFORMATION PROTECTION AND STATISTICAL EFFICIENCY
Sec. 501. Short title.
Sec. 502. Definitions.
Sec. 503. Coordination and oversight of policies.
Sec. 504. Effect on other laws.
Subtitle A--Confidential Information Protection
Sec. 511. Findings and purposes.
Sec. 512. Limitations on use and disclosure of data and information.
Sec. 513. Fines and penalties.
Subtitle B--Statistical Efficiency
Sec. 521. Findings and purposes.
Sec. 522. Designation of statistical agencies.
Sec. 523. Responsibilities of designated statistical agencies.
Sec. 524. Sharing of business data among designated statistical
agencies.
Sec. 525. Limitations on use of business data provided by designated
statistical agencies.
Sec. 526. Conforming amendments.
SEC. 2. FINDINGS AND PURPOSES.
(a) Findings.--Congress finds the following:
(1) The use of computers and the Internet is rapidly
transforming societal interactions and the relationships among
citizens, private businesses, and the Government.
(2) The Federal Government has had uneven success in
applying advances in information technology to enhance
governmental functions and services, achieve more efficient
performance, increase access to Government information, and
increase citizen participation in Government.
(3) Most Internet-based services of the Federal Government
are developed and presented separately, according to the
jurisdictional boundaries of an individual department or
agency, rather than being integrated cooperatively according to
function or topic.
(4) Internet-based Government services involving
interagency cooperation are especially difficult to develop and
promote, in part because of a lack of sufficient funding
mechanisms to support such interagency cooperation.
(5) Electronic Government has its impact through improved
Government performance and outcomes within and across agencies.
(6) Electronic Government is a critical element in the
management of Government, to be implemented as part of a
management framework that also addresses finance, procurement, human
capital, and other challenges to improve the performance of Government.
(7) To take full advantage of the improved Government
performance that can be achieved through the use of Internet-
based technology requires strong leadership, better
organization, improved interagency collaboration, and more
focused oversight of agency compliance with statutes related to
information resource management.
(b) Purposes.--The purposes of this Act are the following:
(1) To provide effective leadership of Federal Government
efforts to develop and promote electronic Government services
and processes by establishing an Administrator of a new Office
of Electronic Government within the Office of Management and
Budget.
(2) To promote use of the Internet and other information
technologies to provide increased opportunities for citizen
participation in Government.
(3) To promote interagency collaboration in providing
electronic Government services, where this collaboration would
improve the service to citizens by integrating related
functions, and in the use of internal electronic Government
processes, where this collaboration would improve the
efficiency and effectiveness of the processes.
(4) To improve the ability of the Government to achieve
agency missions and program performance goals.
(5) To promote the use of the Internet and emerging
technologies within and across Government agencies to provide
citizen-centric Government information and services.
(6) To reduce costs and burdens for businesses and other
Government entities.
(7) To promote better informed decisionmaking by policy
makers.
(8) To promote access to high quality Government
information and services across multiple channels.
(9) To make the Federal Government more transparent and
accountable.
(10) To transform agency operations by utilizing, where
appropriate, best practices from public and private sector
organizations.
(11) To provide enhanced access to Government information
and services in a manner consistent with laws regarding
protection of personal privacy, national security, records
retention, access for persons with disabilities, and other
relevant laws.
TITLE I--OFFICE OF MANAGEMENT AND BUDGET ELECTRONIC GOVERNMENT SERVICES
SEC. 101. MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT SERVICES.
(a) In General.--Title 44, United States Code, is amended by
inserting after chapter 35 the following:
``CHAPTER 36--MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT
SERVICES
``Sec.
``3601. Definitions.
``3602. Office of Electronic Government.
``3603. Chief Information Officers Council.
``3604. E-Government Fund.
``3605. Program to encourage innovative solutions to enhance electronic
Government services and processes.
``3606. E-Government report.
``Sec. 3601. Definitions
``In this chapter, the definitions under section 3502 shall apply,
and the term--
``(1) `Administrator' means the Administrator of the Office
of Electronic Government established under section 3602;
``(2) `Council' means the Chief Information Officers
Council established under section 3603;
``(3) `electronic Government' means the use by the
Government of web-based Internet applications and other
information technologies, combined with processes that
implement these technologies, to--
``(A) enhance the access to and delivery of
Government information and services to the public,
other agencies, and other Government entities; or
``(B) bring about improvements in Government
operations that may include effectiveness, efficiency,
service quality, or transformation;
``(4) `enterprise architecture'--
``(A) means--
``(i) a strategic information asset base,
which defines the mission;
``(ii) the information necessary to perform
the mission;
``(iii) the technologies necessary to
perform the mission; and
``(iv) the transitional processes for
implementing new technologies in response to
changing mission needs; and
``(B) includes--
``(i) a baseline architecture;
``(ii) a target architecture; and
``(iii) a sequencing plan;
``(5) `Fund' means the E-Government Fund established under
section 3604;
``(6) `interoperability' means the ability of different
operating and software systems, applications, and services to
communicate and exchange data in an accurate, effective, and
consistent manner;
``(7) `integrated service delivery' means the provision of
Internet-based Federal Government information or services
integrated according to function or topic rather than separated
according to the boundaries of agency jurisdiction; and
``(8) `tribal government' means the governing body of any
Indian tribe, band, nation, or other organized group or
community, including any Alaska Native village or regional or
village corporation as defined in or established pursuant to
the Alaska Native Claims Settlement Act (43 U.S.C. 1601 et
seq.), which is recognized as eligible for the special programs
and services provided by the United States to Indians because
of their status as Indians.
``Sec. 3602. Office of Electronic Government
``(a) There is established in the Office of Management and Budget
an Office of Electronic Government.
``(b) There shall be at the head of the Office an Administrator who
shall be appointed by the President.
``(c) The Administrator shall assist the Director in carrying out--
``(1) all functions under this chapter;
``(2) all of the functions assigned to the Director under
title II of the E-Government Act of 2002; and
``(3) other electronic government initiatives, consistent
with other statutes.
``(d) The Administrator shall assist the Director and the Deputy
Director for Management and work with the Administrator of the Office
of Information and Regulatory Affairs in setting strategic direction
for implementing electronic Government, under relevant statutes,
including--
``(1) chapter 35;
``(2) subtitle III of title 40, United States Code;
``(3) section 552a of title 5 (commonly referred to as the
`Privacy Act');
``(4) the Government Paperwork Elimination Act (44 U.S.C.
3504 note); and
``(5) the Federal Information Security Management Act of
2002.
``(e) The Administrator shall work with the Administrator of the
Office of Information and Regulatory Affairs and with other offices
within the Office of Management and Budget to oversee implementation of
electronic Government under this chapter, chapter 35, the E-Government
Act of 2002, and other relevant statutes, in a manner consistent with
law, relating to--
``(1) capital planning and investment control for
information technology;
``(2) the development of enterprise architectures;
``(3) information security;
``(4) privacy;
``(5) access to, dissemination of, and preservation of
Government information;
``(6) accessibility of information technology for persons
with disabilities; and
``(7) other areas of electronic Government.
``(f) Subject to requirements of this chapter, the Administrator
shall assist the Director by performing electronic Government functions
as follows:
``(1) Advise the Director on the resources required to
develop and effectively administer electronic Government
initiatives.
``(2) Recommend to the Director changes relating to
Governmentwide strategies and priorities for electronic
Government.
``(3) Provide overall leadership and direction to the
executive branch on electronic Government.
``(4) Promote innovative uses of information technology by
agencies, particularly initiatives involving multiagency
collaboration, through support of pilot projects, research,
experimentation, and the use of innovative technologies.
``(5) Oversee the distribution of funds from, and ensure
appropriate administration and coordination of, the E-
Government Fund established under section 3604.
``(6) Coordinate with the Administrator of General Services
regarding programs undertaken by the General Services
Administration to promote electronic government and the
efficient use of information technologies by agencies.
``(7) Lead the activities of the Chief Information Officers
Council established under section 3603 on behalf of the Deputy
Director for Management, who shall chair the council.
``(8) Assist the Director in establishing policies which
shall set the framework for information technology standards
for the Federal Government under section 11331 of title 40, to
be developed by the National Institute of Standards and
Technology and promulgated by the Secretary of Commerce, taking
into account, if appropriate, recommendations of the Chief
Information Officers Council, experts, and interested parties
from the private and nonprofit sectors and State, local, and
tribal governments, and maximizing the use of commercial
standards as appropriate, including the following:
``(A) Standards and guidelines for
interconnectivity and interoperability as described
under section 3504.
``(B) Consistent with the process under section
207(d) of the E-Government Act of 2002, standards and
guidelines for categorizing Federal Government
electronic information to enable efficient use of
technologies, such as through the use of extensible
markup language.
``(C) Standards and guidelines for Federal
Government computer system efficiency and security.
``(9) Sponsor ongoing dialogue that--
``(A) shall be conducted among Federal, State,
local, and tribal government leaders on electronic
Government in the executive, legislative, and judicial
branches, as well as leaders in the private and
nonprofit sectors, to encourage collaboration and
enhance understanding of best practices and innovative
approaches in acquiring, using, and managing
information resources;
``(B) is intended to improve the performance of
governments in collaborating on the use of information
technology to improve the delivery of Government
information and services; and
``(C) may include--
``(i) development of innovative models--
``(I) for electronic Government
management and Government information
technology contracts; and
``(II) that may be developed
through focused discussions or using
separately sponsored research;
``(ii) identification of opportunities for
public-private collaboration in using Internet-
based technology to increase the efficiency of
Government-to-business transactions;
``(iii) identification of mechanisms for
providing incentives to program managers and
other Government employees to develop and
implement innovative uses of information
technologies; and
``(iv) identification of opportunities for
public, private, and intergovernmental
collaboration in addressing the disparities in
access to the Internet and information
technology.
``(10) Sponsor activities to engage the general public in
the development and implementation of policies and programs,
particularly activities aimed at fulfilling the goal of using
the most effective citizen-centered strategies and those
activities which engage multiple agencies providing similar or
related information and services.
``(11) Oversee the work of the General Services
Administration and other agencies in developing the integrated
Internet-based system under section 204 of the E-Government Act
of 2002.
``(12) Coordinate with the Administrator for Federal
Procurement Policy to ensure effective implementation of
electronic procurement initiatives.
``(13) Assist Federal agencies, including the General
Services Administration, the Department of Justice, and the
United States Access Board in--
``(A) implementing accessibility standards under
section 508 of the Rehabilitation Act of 1973 (29
U.S.C. 794d); and
``(B) ensuring compliance with those standards
through the budget review process and other means.
``(14) Oversee the development of enterprise architectures
within and across agencies.
``(15) Assist the Director and the Deputy Director for
Management in overseeing agency efforts to ensure that
electronic Government activities incorporate adequate, risk-
based, and cost-effective security compatible with business
processes.
``(16) Administer the Office of Electronic Government
established under this section.
``(17) Assist the Director in preparing the E-Government
report established under section 3606.
``(g) The Director shall ensure that the Office of Management and
Budget, including the Office of Electronic Government, the Office of
Information and Regulatory Affairs, and other relevant offices, have
adequate staff and resources to properly fulfill all functions under
the E-Government Act of 2002.
``Sec. 3603. Chief Information Officers Council
``(a) There is established in the executive branch a Chief
Information Officers Council.
``(b) The members of the Council shall be as follows:
``(1) The Deputy Director for Management of the Office of
Management and Budget, who shall act as chairperson of the
Council.
``(2) The Administrator of the Office of Electronic
Government.
``(3) The Administrator of the Office of Information and
Regulatory Affairs.
``(4) The chief information officer of each agency
described under section 901(b) of title 31.
``(5) The chief information officer of the Central
Intelligence Agency.
``(6) The chief information officer of the Department of
the Army, the Department of the Navy, and the Department of the
Air Force, if chief information officers have been designated
for such departments under section 3506(a)(2)(B).
``(7) Any other officer or employee of the United States
designated by the chairperson.
``(c)(1) The Administrator of the Office of Electronic Government
shall lead the activities of the Council on behalf of the Deputy
Director for Management.
``(2)(A) The Vice Chairman of the Council shall be selected by the
Council from among its members.
``(B) The Vice Chairman shall serve a 1-year term, and may serve
multiple terms.
``(3) The Administrator of General Services shall provide
administrative and other support for the Council.
``(d) The Council is designated the principal interagency forum for
improving agency practices related to the design, acquisition,
development, modernization, use, operation, sharing, and performance of
Federal Government information resources.
``(e) In performing its duties, the Council shall consult regularly
with representatives of State, local, and tribal governments.
``(f) The Council shall perform functions that include the
following:
``(1) Develop recommendations for the Director on
Government information resources management policies and
requirements.
``(2) Share experiences, ideas, best practices, and
innovative approaches related to information resources
management.
``(3) Assist the Administrator in the identification,
development, and coordination of multiagency projects and other
innovative initiatives to improve Government performance
through the use of information technology.
``(4) Promote the development and use of common performance
measures for agency information resources management under this
chapter and title II of the E-Government Act of 2002.
``(5) Work as appropriate with the National Institute of
Standards and Technology and the Administrator to develop
recommendations on information technology standards developed
under section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g-3) and promulgated under section
11331 of title 40, and maximize the use of commercial standards
as appropriate, including the following:
``(A) Standards and guidelines for
interconnectivity and interoperability as described
under section 3504.
``(B) Consistent with the process under section
207(d) of the E-Government Act of 2002, standards and
guidelines for categorizing Federal Government
electronic information to enable efficient use of
technologies, such as through the use of extensible
markup language.
``(C) Standards and guidelines for Federal
Government computer system efficiency and security.
``(6) Work with the Office of Personnel Management to
assess and address the hiring, training, classification, and
professional development needs of the Government related to
information resources management.
``(7) Work with the Archivist of the United States to
assess how the Federal Records Act can be addressed effectively
by Federal information resources management activities.
``Sec. 3604. E-Government Fund
``(a)(1) There is established in the Treasury of the United States
the E-Government Fund.
``(2) The Fund shall be administered by the Administrator of the
General Services Administration to support projects approved by the
Director, assisted by the Administrator of the Office of Electronic
Government, that enable the Federal Government to expand its ability,
through the development and implementation of innovative uses of the
Internet or other electronic methods, to conduct activities
electronically.
``(3) Projects under this subsection may include efforts to--
``(A) make Federal Government information and services more
readily available to members of the public (including
individuals, businesses, grantees, and State and local
governments);
``(B) make it easier for the public to apply for benefits,
receive services, pursue business opportunities, submit
information, and otherwise conduct transactions with the
Federal Government; and
``(C) enable Federal agencies to take advantage of
information technology in sharing information and conducting
transactions with each other and with State and local
governments.
``(b)(1) The Administrator shall--
``(A) establish procedures for accepting and reviewing
proposals for funding;
``(B) consult with interagency councils, including the
Chief Information Officers Council, the Chief Financial
Officers Council, and other interagency management councils, in
establishing procedures and reviewing proposals; and
``(C) assist the Director in coordinating resources that
agencies receive from the Fund with other resources available
to agencies for similar purposes.
``(2) When reviewing proposals and managing the Fund, the
Administrator shall observe and incorporate the following procedures:
``(A) A project requiring substantial involvement or
funding from an agency shall be approved by a senior official
with agencywide authority on behalf of the head of the agency,
who shall report directly to the head of the agency.
``(B) Projects shall adhere to fundamental capital planning
and investment control processes.
``(C) Agencies shall identify in their proposals resource
commitments from the agencies involved and how these resources
would be coordinated with support from the Fund, and include
plans for potential continuation of projects after all funds
made available from the Fund are expended.
``(D) After considering the recommendations of the
interagency councils, the Director, assisted by the
Administrator, shall have final authority to determine which of
the candidate projects shall be funded from the Fund.
``(E) Agencies shall assess the results of funded projects.
``(c) In determining which proposals to recommend for funding, the
Administrator--
``(1) shall consider criteria that include whether a
proposal--
``(A) identifies the group to be served, including
citizens, businesses, the Federal Government, or other
governments;
``(B) indicates what service or information the
project will provide that meets needs of groups
identified under subparagraph (A);
``(C) ensures proper security and protects privacy;
``(D) is interagency in scope, including projects
implemented by a primary or single agency that--
``(i) could confer benefits on multiple
agencies; and
``(ii) have the support of other agencies;
and
``(E) has performance objectives that tie to agency
missions and strategic goals, and interim results that
relate to the objectives; and
``(2) may also rank proposals based on criteria that
include whether a proposal--
``(A) has Governmentwide application or
implications;
``(B) has demonstrated support by the public to be
served;
``(C) integrates Federal with State, local, or
tribal approaches to service delivery;
``(D) identifies resource commitments from
nongovernmental sectors;
``(E) identifies resource commitments from the
agencies involved;
``(F) uses web-based technologies to achieve
objectives;
``(G) identifies records management and records
access strategies;
``(H) supports more effective citizen participation
in and interaction with agency activities that further
progress toward a more citizen-centered Government;
``(I) directly delivers Government information and
services to the public or provides the infrastructure
for delivery;
``(J) supports integrated service delivery;
``(K) describes how business processes across
agencies will reflect appropriate transformation
simultaneous to technology implementation; and
``(L) is new or innovative and does not supplant
existing funding streams within agencies.
``(d) The Fund may be used to fund the integrated Internet-based
system under section 204 of the E-Government Act of 2002.
``(e) None of the funds provided from the Fund may be transferred
to any agency until 15 days after the Administrator of the General
Services Administration has submitted to the Committees on
Appropriations of the Senate and the House of Representatives, the
Committee on Governmental Affairs of the Senate, the Committee on
Government Reform of the House of Representatives, and the appropriate
authorizing committees of the Senate and the House of Representatives,
a notification and description of how the funds are to be allocated and
how the expenditure will further the purposes of this chapter.
``(f)(1) The Director shall report annually to Congress on the
operation of the Fund, through the report established under section
3606.
``(2) The report under paragraph (1) shall describe--
``(A) all projects which the Director has approved for
funding from the Fund; and
``(B) the results that have been achieved to date for these
funded projects.
``(g)(1) There are authorized to be appropriated to the Fund--
``(A) $45,000,000 for fiscal year 2003;
``(B) $50,000,000 for fiscal year 2004;
``(C) $100,000,000 for fiscal year 2005;
``(D) $150,000,000 for fiscal year 2006; and
``(E) such sums as are necessary for fiscal year 2007.
``(2) Funds appropriated under this subsection shall remain
available until expended.
``Sec. 3605. Program to encourage innovative solutions to enhance
electronic Government services and processes
``(a) Establishment of Program.--The Administrator shall establish
and promote a Governmentwide program to encourage contractor innovation
and excellence in facilitating the development and enhancement of
electronic Government services and processes.
``(b) Issuance of Announcements Seeking Innovative Solutions.--
Under the program, the Administrator, in consultation with the Council
and the Administrator for Federal Procurement Policy, shall issue
announcements seeking unique and innovative solutions to facilitate the
development and enhancement of electronic Government services and
processes.
``(c) Multiagency Technical Assistance Team.--(1) The
Administrator, in consultation with the Council and the Administrator
for Federal Procurement Policy, shall convene a multiagency technical
assistance team to assist in screening proposals submitted to the
Administrator to provide unique and innovative solutions to facilitate
the development and enhancement of electronic Government services and
processes. The team shall be composed of employees of the agencies
represented on the Council who have expertise in scientific and
technical disciplines that would facilitate the assessment of the
feasibility of the proposals.
``(2) The technical assistance team shall--
``(A) assess the feasibility, scientific and technical
merits, and estimated cost of each proposal; and
``(B) submit each proposal, and the assessment of the
proposal, to the Administrator.
``(3) The technical assistance team shall not consider or evaluate
proposals submitted in response to a solicitation for offers for a
pending procurement or for a specific agency requirement.
``(4) After receiving proposals and assessments from the technical
assistance team, the Administrator shall consider recommending
appropriate proposals for funding under the E-Government Fund
established under section 3604 or, if appropriate, forward the proposal
and the assessment of it to the executive agency whose mission most
coincides with the subject matter of the proposal.
``Sec. 3606. E-Government report
``(a) Not later than March 1 of each year, the Director shall
submit an E-Government status report to the Committee on Governmental
Affairs of the Senate and the Committee on Government Reform of the
House of Representatives.
``(b) The report under subsection (a) shall contain--
``(1) a summary of the information reported by agencies
under section 202(f) of the E-Government Act of 2002;
``(2) the information required to be reported by section
3604(f); and
``(3) a description of compliance by the Federal Government
with other goals and provisions of the E-Government Act of
2002.''.
(b) Technical and Conforming Amendment.--The table of chapters for
title 44, United States Code, is amended by inserting after the item
relating to chapter 35 the following:
``36. Management and Promotion of Electronic Government 3601''.
Services.
SEC. 102. CONFORMING AMENDMENTS.
(a) Electronic Government and Information Technologies.--
(1) In general.--Chapter 3 of title 40, United States Code,
is amended by inserting after section 304 the following new
section:
``Sec. 305. Electronic Government and information technologies
``The Administrator of General Services shall consult with the
Administrator of the Office of Electronic Government on programs
undertaken by the General Services Administration to promote electronic
Government and the efficient use of information technologies by Federal
agencies.''.
(2) Technical and conforming amendment.--The table of
sections for chapter 3 of such title is amended by inserting
after the item relating to section 304 the following:
``305. Electronic Government and information technologies.''.
(b) Modification of Deputy Director for Management Functions.--
Section 503(b) of title 31, United States Code, is amended--
(1) by redesignating paragraphs (5), (6), (7), (8), and
(9), as paragraphs (6), (7), (8), (9), and (10), respectively;
and
(2) by inserting after paragraph (4) the following:
``(5) Chair the Chief Information Officers Council
established under section 3603 of title 44.''.
(c) Office of Electronic Government.--
(1) In general.--Chapter 5 of title 31, United States Code,
is amended by inserting after section 506 the following:
``Sec. 507. Office of Electronic Government
``The Office of Electronic Government, established under section
3602 of title 44, is an office in the Office of Management and
Budget.''.
(2) Technical and conforming amendment.--The table of
sections for chapter 5 of title 31, United States Code, is
amended by inserting after the item relating to section 506 the
following:
``507. Office of Electronic Government.''.
TITLE II--FEDERAL MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT
SERVICES
SEC. 201. DEFINITIONS.
Except as otherwise provided, in this title the definitions under
sections 3502 and 3601 of title 44, United States Code, shall apply.
SEC. 202. FEDERAL AGENCY RESPONSIBILITIES.
(a) In General.--The head of each agency shall be responsible for--
(1) complying with the requirements of this Act (including
the amendments made by this Act), the related information
resource management policies and guidance established by the
Director of the Office of Management and Budget, and the
related information technology standards promulgated by the
Secretary of Commerce;
(2) ensuring that the information resource management
policies and guidance established under this Act by the
Director, and the information technology standards promulgated
under this Act by the Secretary of Commerce are communicated
promptly and effectively to all relevant officials within their
agency; and
(3) supporting the efforts of the Director and the
Administrator of the General Services Administration to
develop, maintain, and promote an integrated Internet-based
system of delivering Federal Government information and
services to the public under section 204.
(b) Performance Integration.--
(1) Agencies shall develop performance measures that
demonstrate how electronic government enables progress toward
agency objectives, strategic goals, and statutory mandates.
(2) In measuring performance under this section, agencies
shall rely on existing data collections to the extent
practicable.
(3) Areas of performance measurement that agencies should
consider include--
(A) customer service;
(B) agency productivity; and
(C) adoption of innovative information technology,
including the appropriate use of commercial best
practices.
(4) Agencies shall link their performance goals, as
appropriate, to key groups, including citizens, businesses, and
other governments, and to internal Federal Government
operations.
(5) As appropriate, agencies shall work collectively in
linking their performance goals to groups identified under
paragraph (4) and shall use information technology in
delivering Government information and services to those groups.
(c) Avoiding Diminished Access.--When promulgating policies and
implementing programs regarding the provision of Government information
and services over the Internet, agency heads shall consider the impact
on persons without access to the Internet, and shall, to the extent
practicable--
(1) ensure that the availability of Government information
and services has not been diminished for individuals who lack
access to the Internet; and
(2) pursue alternate modes of delivery that make Government
information and services more accessible to individuals who do
not own computers or lack access to the Internet.
(d) Accessibility to People With Disabilities.--All actions taken
by Federal departments and agencies under this Act shall be in
compliance with section 508 of the Rehabilitation Act of 1973 (29
U.S.C. 794d).
(e) Sponsored Activities.--Agencies shall sponsor activities that
use information technology to engage the public in the development and
implementation of policies and programs.
(f) Chief Information Officers.--The Chief Information Officer of
each of the agencies designated under chapter 36 of title 44, United
States Code (as added by this Act) shall be responsible for--
(1) participating in the functions of the Chief Information
Officers Council; and
(2) monitoring the implementation, within their respective
agencies, of information technology standards promulgated under
this Act by the Secretary of Commerce, including common
standards for interconnectivity and interoperability,
categorization of Federal Government electronic information,
and computer system efficiency and security.
(g) E-Government Status Report.--
(1) In general.--Each agency shall compile and submit to
the Director an annual E-Government Status Report on--
(A) the status of the implementation by the agency
of electronic government initiatives;
(B) compliance by the agency with this Act; and
(C) how electronic Government initiatives of the
agency improve performance in delivering programs to
constituencies.
(2) Submission.--Each agency shall submit an annual report
under this subsection--
(A) to the Director at such time and in such manner
as the Director requires;
(B) consistent with related reporting requirements;
and
(C) which addresses any section in this title
relevant to that agency.
(h) Use of Technology.--Nothing in this Act supersedes the
responsibility of an agency to use or manage information technology to
deliver Government information and services that fulfill the statutory
mission and programs of the agency.
(i) National Security Systems.--
(1) Inapplicability.--Except as provided under paragraph
(2), this title does not apply to national security systems as
defined in section 11103 of title 40, United States Code.
(2) Applicability.--This section, section 203, and section
214 do apply to national security systems to the extent
practicable and consistent with law.
SEC. 203. COMPATIBILITY OF EXECUTIVE AGENCY METHODS FOR USE AND
ACCEPTANCE OF ELECTRONIC SIGNATURES.
(a) Purpose.--The purpose of this section is to achieve
interoperable implementation of electronic signatures for appropriately
secure electronic transactions with Government.
(b) Electronic Signatures.--In order to fulfill the objectives of
the Government Paperwork Elimination Act (Public Law 105-277; 112 Stat.
2681-749 through 2681-751), each Executive agency (as defined under
section 105 of title 5, United States Code) shall ensure that its
methods for use and acceptance of electronic signatures are compatible
with the relevant policies and procedures issued by the Director.
(c) Authority for Electronic Signatures.--The Administrator of
General Services shall support the Director by establishing a framework
to allow efficient interoperability among Executive agencies when using
electronic signatures, including processing of digital signatures.
(d) Authorization of Appropriations.--There are authorized to be
appropriated to the General Services Administration, to ensure the
development and operation of a Federal bridge certification authority
for digital signature compatibility, and for other activities
consistent with this section, $8,000,000 or such sums as are necessary
in fiscal year 2003, and such sums as are necessary for each fiscal
year thereafter.
SEC. 204. FEDERAL INTERNET PORTAL.
(a) In General.--
(1) Public access.--The Director shall work with the
Administrator of the General Services Administration and other
agencies to maintain and promote an integrated Internet-based
system of providing the public with access to Government
information and services.
(2) Criteria.--To the extent practicable, the integrated
system shall be designed and operated according to the
following criteria:
(A) The provision of Internet-based Government
information and services directed to key groups,
including citizens, business, and other governments,
and integrated according to function or topic rather
than separated according to the boundaries of agency
jurisdiction.
(B) An ongoing effort to ensure that Internet-based
Government services relevant to a given citizen
activity are available from a single point.
(C) Access to Federal Government information and
services consolidated, as appropriate, with Internet-
based information and services provided by State,
local, and tribal governments.
(D) Access to Federal Government information held
by 1 or more agencies shall be made available in a
manner that protects privacy, consistent with law.
(b) Authorization of Appropriations.--There are authorized to be
appropriated to the General Services Administration $15,000,000 for the
maintenance, improvement, and promotion of the integrated Internet-
based system for fiscal year 2003, and such sums as are necessary for
fiscal years 2004 through 2007.
SEC. 205. FEDERAL COURTS.
(a) Individual Court Websites.--The Chief Justice of the United
States, the chief judge of each circuit and district, and the chief
bankruptcy judge of each district shall establish with respect to the
Supreme Court or the respective court of appeals, district, or
bankruptcy court of a district, a website that contains the following
information or links to websites with the following information:
(1) Location and contact information for the courthouse,
including the telephone numbers and contact names for the
clerk's office and justices' or judges' chambers.
(2) Local rules and standing or general orders of the
court.
(3) Individual rules, if in existence, of each justice or
judge in that court.
(4) Access to docket information for each case.
(5) Access to the substance of all written opinions issued
by the court, regardless of whether such opinions are to be
published in the official court reporter, in a text searchable
format.
(6) Access to all documents filed with the courthouse in
electronic form, described under subsection (c).
(7) Any other information (including forms in a format that
can be downloaded) that the court determines useful to the
public.
(b) Maintenance of Data Online.--
(1) Update of information.--The information and rules on
each website shall be updated regularly and kept reasonably
current.
(2) Closed cases.--Electronic files and docket information
for cases closed for more than 1 year are not required to be
made available online, except all written opinions with a date
of issuance after the effective date of this section shall
remain available online.
(c) Electronic Filings.--
(1) In general.--Except as provided under paragraph (2),
each court shall make any document that is filed electronically
publicly available online. A court may convert any document
that is filed in paper form to electronic form. To the extent
such conversions are made, all such electronic versions of the
document shall be made available online.
(2) Exceptions.--Documents that are filed that are not
otherwise available to the public, such as documents filed
under seal, shall not be made available online.
(3) Privacy and security concerns.--The Judicial Conference
of the United States may promulgate rules under this subsection
to protect important privacy and security concerns.
(d) Dockets With Links to Documents.--The Judicial Conference of
the United States shall explore the feasibility of technology to post
online dockets with links allowing all filings, decisions, and rulings
in each case to be obtained from the docket sheet of that case.
(e) Cost of Providing Electronic Docketing Information.--Section
303(a) of the Judiciary Appropriations Act, 1992 (28 U.S.C. 1913 note)
is amended in the first sentence by striking ``shall hereafter'' and
inserting ``may, only to the extent necessary,''.
(f) Time Requirements.--Not later than 2 years after the effective
date of this title, the websites under subsection (a) shall be
established, except that access to documents filed in electronic form
shall be established not later than 4 years after that effective date.
(g) Deferral.--
(1) In general.--
(A) Election.--
(i) Notification.--The Chief Justice of the
United States, a chief judge, or chief
bankruptcy judge may submit a notification to
the Administrative Office of the United States
Courts to defer compliance with any requirement
of this section with respect to the Supreme
Court, a court of appeals, district, or the
bankruptcy court of a district.
(ii) Contents.--A notification submitted
under this subparagraph shall state--
(I) the reasons for the deferral;
and
(II) the online methods, if any, or
any alternative methods, such court or
district is using to provide greater
public access to information.
(B) Exception.--To the extent that the Supreme
Court, a court of appeals, district, or bankruptcy
court of a district maintains a website under
subsection (a), the Supreme Court or that court of
appeals or district shall comply with subsection
(b)(1).
(2) Report.--Not later than 1 year after the effective date
of this title, and every year thereafter, the Judicial
Conference of the United States shall submit a report to the
Committees on Governmental Affairs and the Judiciary of the
Senate and the Committees on Government Reform and the
Judiciary of the House of Representatives that--
(A) contains all notifications submitted to the
Administrative Office of the United States Courts under
this subsection; and
(B) summarizes and evaluates all notifications.
SEC. 206. REGULATORY AGENCIES.
(a) Purposes.--The purposes of this section are to--
(1) improve performance in the development and issuance of
agency regulations by using information technology to increase
access, accountability, and transparency; and
(2) enhance public participation in Government by
electronic means, consistent with requirements under subchapter
II of chapter 5 of title 5, United States Code, (commonly
referred to as the ``Administrative Procedures Act'').
(b) Information Provided by Agencies Online.--To the extent
practicable as determined by the agency in consultation with the
Director, each agency (as defined under section 551 of title 5, United
States Code) shall ensure that a publicly accessible Federal Government
website includes all information about that agency required to be
published in the Federal Register under paragraphs (1) and (2) of
section 552(a) of title 5, United States Code.
(c) Submissions by Electronic Means.--To the extent practicable,
agencies shall accept submissions under section 553(c) of title 5,
United States Code, by electronic means.
(d) Electronic Docketing.--
(1) In general.--To the extent practicable, as determined
by the agency in consultation with the Director, agencies shall
ensure that a publicly accessible Federal Government website
contains electronic dockets for rulemakings under section 553
of title 5, United States Code.
(2) Information available.--Agency electronic dockets shall
make publicly available online to the extent practicable, as
determined by the agency in consultation with the Director--
(A) all submissions under section 553(c) of title
5, United States Code; and
(B) other materials that by agency rule or practice
are included in the rulemaking docket under section
553(c) of title 5, United States Code, whether or not
submitted electronically.
(e) Time Limitation.--Agencies shall implement the requirements of
this section consistent with a timetable established by the Director
and reported to Congress in the first annual report under section 3606
of title 44 (as added by this Act).
SEC. 207. ACCESSIBILITY, USABILITY, AND PRESERVATION OF GOVERNMENT
INFORMATION.
(a) Purpose.--The purpose of this section is to improve the methods
by which Government information, including information on the Internet,
is organized, preserved, and made accessible to the public.
(b) Definitions.--In this section, the term--
(1) ``Committee'' means the Interagency Committee on
Government Information established under subsection (c); and
(2) ``directory'' means a taxonomy of subjects linked to
websites that--
(A) organizes Government information on the
Internet according to subject matter; and
(B) may be created with the participation of human
editors.
(c) Interagency Committee.--
(1) Establishment.--Not later than 180 days after the date
of enactment of this title, the Director shall establish the
Interagency Committee on Government Information.
(2) Membership.--The Committee shall be chaired by the
Director or the designee of the Director and--
(A) shall include representatives from--
(i) the National Archives and Records
Administration;
(ii) the offices of the Chief Information
Officers from Federal agencies; and
(iii) other relevant officers from the
executive branch; and
(B) may include representatives from the Federal
legislative and judicial branches.
(3) Functions.--The Committee shall--
(A) engage in public consultation to the maximum
extent feasible, including consultation with interested
communities such as public advocacy organizations;
(B) conduct studies and submit recommendations, as
provided under this section, to the Director and
Congress; and
(C) share effective practices for access to,
dissemination of, and retention of Federal information.
(4) Termination.--The Committee may be terminated on a date
determined by the Director, except the Committee may not
terminate before the Committee submits all recommendations
required under this section.
(d) Categorizing of Information.--
(1) Committee functions.--Not later than 2 years after the
date of enactment of this Act, the Committee shall submit
recommendations to the Director on--
(A) the adoption of standards, which are open to
the maximum extent feasible, to enable the organization
and categorization of Government information--
(i) in a way that is searchable
electronically, including by searchable
identifiers; and
(iii) in ways that are interoperable across
agencies;
(B) the definition of categories of Government
information which should be classified under the
standards; and
(C) determining priorities and developing schedules
for the initial implementation of the standards by
agencies.
(2) Functions of the director.--Not later than 1 year after
the submission of recommendations under paragraph (1), the
Director shall issue policies--
(A) requiring that agencies use standards, which
are open to the maximum extent feasible, to enable the
organization and categorization of Government
information--
(i) in a way that is searchable
electronically, including by searchable
identifiers;
(ii) in ways that are interoperable across
agencies; and
(iii) that are, as appropriate, consistent
with the standards promulgated by the Secretary
of Commerce under section 3602(f)(8) of title
44, United States Code;
(B) defining categories of Government information
which shall be required to be classified under the
standards; and
(C) determining priorities and developing schedules
for the initial implementation of the standards by
agencies.
(3) Modification of policies.--After the submission of
agency reports under paragraph (4), the Director shall modify
the policies, as needed, in consultation with the Committee and
interested parties.
(4) Agency functions.--Each agency shall report annually to
the Director, in the report established under section 202(g),
on compliance of that agency with the policies issued under
paragraph (2)(A).
(e) Public Access to Electronic Information.--
(1) Committee functions.--Not later than 2 years after the
date of enactment of this Act, the Committee shall submit
recommendations to the Director and the Archivist of the United
States on--
(A) the adoption by agencies of policies and
procedures to ensure that chapters 21, 25, 27, 29, and
31 of title 44, United States Code, are applied
effectively and comprehensively to Government
information on the Internet and to other electronic
records; and
(B) the imposition of timetables for the
implementation of the policies and procedures by
agencies.
(2) Functions of the archivist.--Not later than 1 year
after the submission of recommendations by the Committee under
paragraph (1), the Archivist of the United States shall issue
policies--
(A) requiring the adoption by agencies of policies
and procedures to ensure that chapters 21, 25, 27, 29,
and 31 of title 44, United States Code, are applied
effectively and comprehensively to Government
information on the Internet and to other electronic
records; and
(B) imposing timetables for the implementation of
the policies, procedures, and technologies by agencies.
(3) Modification of policies.--After the submission of
agency reports under paragraph (4), the Archivist of the United
States shall modify the policies, as needed, in consultation
with the Committee and interested parties.
(4) Agency functions.--Each agency shall report annually to
the Director, in the report established under section 202(g),
on compliance of that agency with the policies issued under
paragraph (2)(A).
(f) Agency Websites.--
(1) Standards for agency websites.--Not later than 2 years
after the effective date of this title, the Director shall
promulgate guidance for agency websites that includes--
(A) requirements that websites include direct links
to--
(i) descriptions of the mission and
statutory authority of the agency;
(ii) information made available to the
public under subsections (a)(1) and (b) of
section 552 of title 5, United States Code
(commonly referred to as the ``Freedom of
Information Act'');
(iii) information about the organizational
structure of the agency; and
(iv) the strategic plan of the agency
developed under section 306 of title 5, United
States Code; and
(B) minimum agency goals to assist public users to
navigate agency websites, including--
(i) speed of retrieval of search results;
(ii) the relevance of the results;
(iii) tools to aggregate and disaggregate
data; and
(iv) security protocols to protect
information.
(2) Agency requirements.--(A) Not later than 2 years after
the date of enactment of this Act, each agency shall--
(i) consult with the Committee and solicit public
comment;
(ii) establish a process for determining which
Government information the agency intends to make
available and accessible to the public on the Internet
and by other means;
(iii) develop priorities and schedules for making
Government information available and accessible;
(iv) make such final determinations, priorities,
and schedules available for public comment;
(v) post such final determinations, priorities, and
schedules on the Internet; and
(vi) submit such final determinations, priorities,
and schedules to the Director, in the report
established under section 202(g).
(B) Each agency shall update determinations, priorities,
and schedules of the agency, as needed, after consulting with
the Committee and soliciting public comment, if appropriate.
(3) Public domain directory of public federal government
websites.--
(A) Establishment.--Not later than 2 years after
the effective date of this title, the Director and each
agency shall--
(i) develop and establish a public domain
directory of public Federal Government
websites; and
(ii) post the directory on the Internet
with a link to the integrated Internet-based
system established under section 204.
(B) Development.--With the assistance of each
agency, the Director shall--
(i) direct the development of the directory
through a collaborative effort, including input
from--
(I) agency librarians;
(II) information technology
managers;
(III) program managers;
(IV) records managers;
(V) Federal depository librarians;
and
(VI) other interested parties; and
(ii) develop a public domain taxonomy of
subjects used to review and categorize public
Federal Government websites.
(C) Update.--With the assistance of each agency,
the Administrator of the Office of Electronic
Government shall--
(i) update the directory as necessary, but
not less than every 6 months; and
(ii) solicit interested persons for
improvements to the directory.
(g) Access to Federally Funded Research and Development.--
(1) Development and maintenance of governmentwide
repository and website.--
(A) Repository and website.--The Director of the
Office of Management and Budget, in consultation with
the Director of the Office of Science and Technology
Policy and other relevant agencies, shall ensure the
development and maintenance of--
(i) a repository that fully integrates, to
the maximum extent feasible, information about
research and development funded by the Federal
Government, and the repository shall--
(I) include information about
research and development funded by the
Federal Government, consistent with any
relevant protections for the
information under section 552 of title
5, United States Code, and performed
by--
(aa) institutions not a
part of the Federal Government,
including State, local, and
foreign governments; industrial
firms; educational
institutions; not-for-profit
organizations; federally funded
research and development
centers; and private
individuals; and
(bb) entities of the
Federal Government, including
research and development
laboratories, centers, and
offices; and
(II) integrate information about each
separate research and development task or
award, including--
(aa) the dates upon which
the task or award is expected
to start and end;
(bb) a brief summary
describing the objective and
the scientific and technical
focus of the task or award;
(cc) the entity or
institution performing the task
or award and its contact
information;
(dd) the total amount of
Federal funds expected to be
provided to the task or award
over its lifetime and the
amount of funds expected to be
provided in each fiscal year in
which the work of the task or
award is ongoing;
(ee) any restrictions
attached to the task or award
that would prevent the sharing
with the general public of any
or all of the information
required by this subsection,
and the reasons for such
restrictions; and
(ff) such other information
as may be determined to be
appropriate; and
(ii) 1 or more websites upon which all or
part of the repository of Federal research and
development shall be made available to and
searchable by Federal agencies and non-Federal
entities, including the general public, to
facilitate--
(I) the coordination of Federal
research and development activities;
(II) collaboration among those
conducting Federal research and
development;
(III) the transfer of technology
among Federal agencies and between
Federal agencies and non-Federal
entities; and
(IV) access by policymakers and the
public to information concerning
Federal research and development
activities.
(B) Oversight.--The Director of the Office of
Management and Budget shall issue any guidance
determined necessary to ensure that agencies provide
all information requested under this subsection.
(2) Agency functions.--Any agency that funds Federal
research and development under this subsection shall provide
the information required to populate the repository in the
manner prescribed by the Director of the Office of Management
and Budget.
(3) Committee functions.--Not later than 18 months after
the date of enactment of this Act, working with the Director of
the Office of Science and Technology Policy, and after
consultation with interested parties, the Committee shall
submit recommendations to the Director on--
(A) policies to improve agency reporting of
information for the repository established under this
subsection; and
(B) policies to improve dissemination of the
results of research performed by Federal agencies and
federally funded research and development centers.
(4) Functions of the director.--After submission of
recommendations by the Committee under paragraph (3), the
Director shall report on the recommendations of the Committee
and Director to Congress, in the E-Government report under
section 3606 of title 44 (as added by this Act).
(5) Authorization of appropriations.--There are authorized
to be appropriated for the development, maintenance, and
operation of the Governmentwide repository and website under
this subsection--
(A) $2,000,000 in each of the fiscal years 2003
through 2005; and
(B) such sums as are necessary in each of the
fiscal years 2006 and 2007.
SEC. 208. PRIVACY PROVISIONS.
(a) Purpose.--The purpose of this section is to ensure sufficient
protections for the privacy of personal information as agencies
implement citizen-centered electronic Government.
(b) Privacy Impact Assessments.--
(1) Responsibilities of agencies.--
(A) In general.--An agency shall take actions
described under subparagraph (B) before developing or
procuring information technology that collects,
maintains, or disseminates information that is in an
identifiable form.
(B) Agency activities.--To the extent required
under subparagraph (A), each agency shall--
(i) conduct a privacy impact assessment;
(ii) ensure the review of the privacy
impact assessment by the Chief Information
Officer, or equivalent official, as determined
by the head of the agency; and
(iii) if practicable, after completion of
the review under clause (ii), make the privacy
impact assessment publicly available through
the website of the agency, publication in the
Federal Register, or other means.
(C) Sensitive information.--Subparagraph (B)(iii)
may be modified or waived for security reasons, or to
protect classified, sensitive, or private information
contained in an assessment.
(D) Copy to director.--Agencies shall provide the
Director with a copy of the privacy impact assessment
for each system for which funding is requested.
(2) Contents of a privacy impact assessment.--
(A) In general.--The Director shall issue guidance
to agencies specifying the required contents of a
privacy impact assessment.
(B) Guidance.--The guidance shall--
(i) ensure that a privacy impact assessment
is commensurate with the size of the
information system being assessed, the
sensitivity of information that is in an
identifiable form in that system, and the risk
of harm from unauthorized release of that
information; and
(ii) require that a privacy impact
assessment address--
(I) what information is to be
collected;
(II) why the information is being
collected;
(III) the intended use of the
agency of the information;
(IV) with whom the information will
be shared;
(V) what notice or opportunities
for consent would be provided to
individuals regarding what information
is collected and how that information
is shared;
(VI) how the information will be
secured; and
(VII) whether a system of records
is being created under section 552a of
title 5, United States Code, (commonly
referred to as the ``Privacy Act'').
(3) Responsibilities of the director.--The Director shall--
(A) develop policies and guidelines for agencies on
the conduct of privacy impact assessments;
(B) oversee the implementation of the privacy
impact assessment process throughout the Government;
and
(C) require agencies to conduct privacy impact
assessments of existing information systems or ongoing
collections of information that is in an identifiable
form as the Director determines appropriate.
(c) Privacy Protections on Agency Websites.--
(1) Privacy policies on websites.--
(A) Guidelines for notices.--The Director shall
develop guidance for privacy notices on agency websites
used by the public.
(B) Contents.--The guidance shall require that a
privacy notice address, consistent with section 552a of
title 5, United States Code--
(i) what information is to be collected;
(ii) why the information is being
collected;
(iii) the intended use of the agency of the
information;
(iv) with whom the information will be
shared;
(v) what notice or opportunities for
consent would be provided to individuals
regarding what information is collected and how
that information is shared;
(vi) how the information will be secured;
and
(vii) the rights of the individual under
section 552a of title 5, United States Code
(commonly referred to as the ``Privacy Act''),
and other laws relevant to the protection of
the privacy of an individual.
(2) Privacy policies in machine-readable formats.--The
Director shall issue guidance requiring agencies to translate
privacy policies into a standardized machine-readable format.
(d) Definition.--In this section, the term ``identifiable form''
means any representation of information that permits the identity of an
individual to whom the information applies to be reasonably inferred by
either direct or indirect means.
SEC. 209. FEDERAL INFORMATION TECHNOLOGY WORKFORCE DEVELOPMENT.
(a) Purpose.--The purpose of this section is to improve the skills
of the Federal workforce in using information technology to deliver
Government information and services.
(b) Workforce Development.--
(1) In general.--In consultation with the Director, the
Chief Information Officers Council, and the Administrator of
General Services, the Director of the Office of Personnel
Management shall--
(A) analyze, on an ongoing basis, the personnel
needs of the Federal Government related to information
technology and information resource management;
(B) oversee the development of curricula, training
methods, and training priorities that correspond to the
projected personnel needs of the Federal Government
related to information technology and information
resource management; and
(C) assess the training of Federal employees in
information technology disciplines, as necessary, in
order to ensure that the information resource
management needs of the Federal Government are
addressed.
(2) Authority to detail employees to non-federal
employers.--In carrying out paragraph (1), the Director of the
Office of Personnel Management may provide for a program under
which a Federal employee may be detailed to a non-Federal
employer. The Director of the Office of Personnel Management
shall prescribe regulations for such program, including the
conditions for service and duties as the Director considers
necessary.
(3) Coordination provision.--An assignment described in
section 3703 of title 5, United States Code, shall be made only
in accordance with the program established under paragraph (2),
if any.
(4) Employee participation.--Subject to information
resource management needs and the limitations imposed by
resource needs in other occupational areas, and consistent with
their overall workforce development strategies, agencies shall
encourage employees to participate in occupational information
technology training.
(5) Authorization of Appropriations.--There are authorized
to be appropriated to the Office of Personnel Management for
the implementation of this subsection, $7,000,000 in fiscal
year 2003, and such sums as are necessary for each fiscal year
thereafter.
(c) Information Technology Exchange Program.--
(1) In general.--Subpart B of part III of title 5, United
States Code, is amended by adding at the end the following:
``CHAPTER 37--INFORMATION TECHNOLOGY EXCHANGE PROGRAM
``Sec.
``3701. Definitions.
``3702. General provisions.
``3703. Assignment of employees to private sector organizations.
``3704. Assignment of employees from private sector organizations.
``3705. Application to Office of the Chief Technology Officer of the
District of Columbia.
``3706. Reporting requirement.
``3707. Regulations.
``Sec. 3701. Definitions
``For purposes of this chapter--
``(1) the term `agency' means an Executive agency, but does
not include the General Accounting Office; and
``(2) the term `detail' means--
``(A) the assignment or loan of an employee of an
agency to a private sector organization without a
change of position from the agency that employs the
individual, or
``(B) the assignment or loan of an employee of a
private sector organization to an agency without a
change of position from the private sector organization
that employs the individual,
whichever is appropriate in the context in which such term is
used.
``Sec. 3702. General provisions
``(a) Assignment Authority.--On request from or with the agreement
of a private sector organization, and with the consent of the employee
concerned, the head of an agency may arrange for the assignment of an
employee of the agency to a private sector organization or an employee
of a private sector organization to the agency. An eligible employee is
an individual who--
``(1) works in the field of information technology
management;
``(2) is considered an exceptional performer by the
individual's current employer; and
``(3) is expected to assume increased information
technology management responsibilities in the future.
An employee of an agency shall be eligible to participate in this
program only if the employee is employed at the GS-11 level or above
(or equivalent) and is serving under a career or career-conditional
appointment or an appointment of equivalent tenure in the excepted
service, and applicable requirements of section 209(b) of the E-
Government Act of 2002 are met with respect to the proposed assignment
of such employee.
``(b) Agreements.--Each agency that exercises its authority under
this chapter shall provide for a written agreement between the agency
and the employee concerned regarding the terms and conditions of the
employee's assignment. In the case of an employee of the agency, the
agreement shall--
``(1) require the employee to serve in the civil service,
upon completion of the assignment, for a period equal to the
length of the assignment; and
``(2) provide that, in the event the employee fails to
carry out the agreement (except for good and sufficient reason,
as determined by the head of the agency from which assigned)
the employee shall be liable to the United States for payment
of all expenses of the assignment.
An amount under paragraph (2) shall be treated as a debt due the United
States.
``(c) Termination.--Assignments may be terminated by the agency or
private sector organization concerned for any reason at any time.
``(d) Duration.--Assignments under this chapter shall be for a
period of between 3 months and 1 year, and may be extended in 3-month
increments for a total of not more than 1 additional year, except that
no assignment under this chapter may commence after the end of the 5-
year period beginning on the date of the enactment of this chapter.
``(e) Assistance.--The Chief Information Officers Council, by
agreement with the Office of Personnel Management, may assist in the
administration of this chapter, including by maintaining lists of
potential candidates for assignment under this chapter, establishing
mentoring relationships for the benefit of individuals who are given
assignments under this chapter, and publicizing the program.
``(f) Considerations.--In exercising any authority under this
chapter, an agency shall take into consideration--
``(1) the need to ensure that small business concerns are
appropriately represented with respect to the assignments
described in sections 3703 and 3704, respectively; and
``(2) how assignments described in section 3703 might best
be used to help meet the needs of the agency for the training
of employees in information technology management.
``Sec. 3703. Assignment of employees to private sector organizations
``(a) In General.--An employee of an agency assigned to a private
sector organization under this chapter is deemed, during the period of
the assignment, to be on detail to a regular work assignment in his
agency.
``(b) Coordination With Chapter 81.--Notwithstanding any other
provision of law, an employee of an agency assigned to a private sector
organization under this chapter is entitled to retain coverage, rights,
and benefits under subchapter I of chapter 81, and employment during
the assignment is deemed employment by the United States, except that,
if the employee or the employee's dependents receive from the private
sector organization any payment under an insurance policy for which the
premium is wholly paid by the private sector organization, or other
benefit of any kind on account of the same injury or death, then, the
amount of such payment or benefit shall be credited against any
compensation otherwise payable under subchapter I of chapter 81.
``(c) Reimbursements.--The assignment of an employee to a private
sector organization under this chapter may be made with or without
reimbursement by the private sector organization for the travel and
transportation expenses to or from the place of assignment, subject to
the same terms and conditions as apply with respect to an employee of a
Federal agency or a State or local government under section 3375, and
for the pay, or a part thereof, of the employee during assignment. Any
reimbursements shall be credited to the appropriation of the agency
used for paying the travel and transportation expenses or pay.
``(d) Tort Liability; Supervision.--The Federal Tort Claims Act and
any other Federal tort liability statute apply to an employee of an
agency assigned to a private sector organization under this chapter.
The supervision of the duties of an employee of an agency so assigned
to a private sector organization may be governed by an agreement
between the agency and the organization.
``(e) Small Business Concerns.--
``(1) In general.--The head of each agency shall take such
actions as may be necessary to ensure that, of the assignments
made under this chapter from such agency to private sector
organizations in each year, at least 20 percent are to small
business concerns.
``(2) Definitions.--For purposes of this subsection--
``(A) the term `small business concern' means a
business concern that satisfies the definitions and
standards specified by the Administrator of the Small
Business Administration under section 3(a)(2) of the
Small Business Act (as from time to time amended by the
Administrator);
``(B) the term `year' refers to the 12-month period
beginning on the date of the enactment of this chapter,
and each succeeding 12-month period in which any
assignments under this chapter may be made; and
``(C) the assignments `made' in a year are those
commencing in such year.
``(3) Reporting requirement.--An agency which fails to
comply with paragraph (1) in a year shall, within 90 days after
the end of such year, submit a report to the Committees on
Government Reform and Small Business of the House of
Representatives and the Committees on Governmental Affairs and
Small Business of the Senate. The report shall include--
``(A) the total number of assignments made under
this chapter from such agency to private sector
organizations in the year;
``(B) of that total number, the number (and
percentage) made to small business concerns; and
``(C) the reasons for the agency's noncompliance
with paragraph (1).
``(4) Exclusion.--This subsection shall not apply to an
agency in any year in which it makes fewer than 5 assignments
under this chapter to private sector organizations.
``Sec. 3704. Assignment of employees from private sector organizations
``(a) In General.--An employee of a private sector organization
assigned to an agency under this chapter is deemed, during the period
of the assignment, to be on detail to such agency.
``(b) Terms and Conditions.--An employee of a private sector
organization assigned to an agency under this chapter--
``(1) may continue to receive pay and benefits from the
private sector organization from which he is assigned;
``(2) is deemed, notwithstanding subsection (a), to be an
employee of the agency for the purposes of--
``(A) chapter 73;
``(B) sections 201, 203, 205, 207, 208, 209, 603,
606, 607, 643, 654, 1905, and 1913 of title 18;
``(C) sections 1343, 1344, and 1349(b) of title 31;
``(D) the Federal Tort Claims Act and any other
Federal tort liability statute;
``(E) the Ethics in Government Act of 1978;
``(F) section 1043 of the Internal Revenue Code of
1986; and
``(G) section 27 of the Office of Federal
Procurement Policy Act;
``(3) may not have access to any trade secrets or to any
other nonpublic information which is of commercial value to the
private sector organization from which he is assigned; and
``(4) is subject to such regulations as the President may
prescribe.
The supervision of an employee of a private sector organization
assigned to an agency under this chapter may be governed by agreement
between the agency and the private sector organization concerned. Such
an assignment may be made with or without reimbursement by the agency
for the pay, or a part thereof, of the employee during the period of
assignment, or for any contribution of the private sector organization
to employee benefit systems.
``(c) Coordination With Chapter 81.--An employee of a private
sector organization assigned to an agency under this chapter who
suffers disability or dies as a result of personal injury sustained
while performing duties during the assignment shall be treated, for the
purpose of subchapter I of chapter 81, as an employee as defined by
section 8101 who had sustained the injury in the performance of duty,
except that, if the employee or the employee's dependents receive from
the private sector organization any payment under an insurance policy
for which the premium is wholly paid by the private sector
organization, or other benefit of any kind on account of the same
injury or death, then, the amount of such payment or benefit shall be
credited against any compensation otherwise payable under subchapter I
of chapter 81.
``(d) Prohibition Against Charging Certain Costs to the Federal
Government.--A private sector organization may not charge the Federal
Government, as direct or indirect costs under a Federal contract, the
costs of pay or benefits paid by the organization to an employee
assigned to an agency under this chapter for the period of the
assignment.
``Sec. 3705. Application to Office of the Chief Technology Officer of
the District of Columbia
``(a) In General.--The Chief Technology Officer of the District of
Columbia may arrange for the assignment of an employee of the Office of
the Chief Technology Officer to a private sector organization, or an
employee of a private sector organization to such Office, in the same
manner as the head of an agency under this chapter.
``(b) Terms and Conditions.--An assignment made pursuant to
subsection (a) shall be subject to the same terms and conditions as an
assignment made by the head of an agency under this chapter, except
that in applying such terms and conditions to an assignment made
pursuant to subsection (a), any reference in this chapter to a
provision of law or regulation of the United States shall be deemed to
be a reference to the applicable provision of law or regulation of the
District of Columbia, including the applicable provisions of the
District of Columbia Government Comprehensive Merit Personnel Act of
1978 (sec. 109601.01 et seq., D.C. Official Code) and section 601 of
the District of Columbia Campaign Finance Reform and Conflict of
Interest Act (sec. 1-1106.01, D.C. Official Code).
``(c) Definition.--For purposes of this section, the term `Office
of the Chief Technology Officer' means the office established in the
executive branch of the government of the District of Columbia under
the Office of the Chief Technology Officer Establishment Act of 1998
(sec. 1-1401 et seq., D.C. Official Code).
``Sec. 3706. Reporting requirement
``(a) In General.--The Office of Personnel Management shall, not
later than April 30 and October 31 of each year, prepare and submit to
the Committee on Government Reform of the House of Representatives and
the Committee on Governmental Affairs of the Senate a semiannual report
summarizing the operation of this chapter during the immediately
preceding 6-month period ending on March 31 and September 30,
respectively.
``(b) Content.--Each report shall include, with respect to the 6-
month period to which such report relates--
``(1) the total number of individuals assigned to, and the
total number of individuals assigned from, each agency during
such period;
``(2) a brief description of each assignment included under
paragraph (1), including--
``(A) the name of the assigned individual, as well
as the private sector organization and the agency
(including the specific bureau or other agency
component) to or from which such individual was
assigned;
``(B) the respective positions to and from which
the individual was assigned, including the duties and
responsibilities and the pay grade or level associated
with each; and
``(C) the duration and objectives of the
individual's assignment; and
``(3) such other information as the Office considers
appropriate.
``(c) Publication.--A copy of each report submitted under
subsection (a)--
``(1) shall be published in the Federal Register; and
``(2) shall be made publicly available on the Internet.
``(d) Agency Cooperation.--On request of the Office, agencies shall
furnish such information and reports as the Office may require in order
to carry out this section.
``Sec. 3707. Regulations
``The Director of the Office of Personnel Management shall
prescribe regulations for the administration of this chapter.''.
(2) Report.--Not later than 4 years after the date of the
enactment of this Act, the General Accounting Office shall
prepare and submit to the Committee on Government Reform of the
House of Representatives and the Committee on Governmental
Affairs of the Senate a report on the operation of chapter 37
of title 5, United States Code (as added by this subsection).
Such report shall include--
(A) an evaluation of the effectiveness of the
program established by such chapter; and
(B) a recommendation as to whether such program
should be continued (with or without modification) or
allowed to lapse.
(3) Clerical Amendment.--The analysis for part III of title
5, United States Code, is amended by inserting after the item
relating to chapter 35 the following:
``37. Information Technology Exchange Program............... 3701''.
(d) Ethics Provisions.--
(1) One-year restriction on certain communications.--
Section 207(c)(2)(A) of title 18, United States Code, is
amended--
(A) by striking ``or'' at the end of clause (iii);
(B) by striking the period at the end of clause
(iv) and inserting ``; or''; and
(C) by adding at the end the following:
``(v) assigned from a private sector organization
to an agency under chapter 37 of title 5.''.
(2) Disclosure of confidential information.--Section 1905
of title 18, United States Code, is amended by inserting ``or
being an employee of a private sector organization who is or
was assigned to an agency under chapter 37 of title 5,'' after
``(15 U.S.C. 1311-1314),''.
(3) Contract advice.--Section 207 of title 18, United
States Code, is amended by adding at the end the following:
``(l) Contract Advice by Former Details.--Whoever, being an
employee of a private sector organization assigned to an agency under
chapter 37 of title 5, within one year after the end of that
assignment, knowingly represents or aids, counsels, or assists in
representing any other person (except the United States) in connection
with any contract with that agency shall be punished as provided in
section 216 of this title.''.
(4) Restriction on disclosure of procurement information.--
Section 27 of the Office of Federal Procurement Policy Act (41
U.S.C. 423) is amended in subsection (a)(1) by adding at the
end the following new sentence: ``In the case of an employee of
a private sector organization assigned to an agency under
chapter 37 of title 5, United States Code, in addition to the
restriction in the preceding sentence, such employee shall not,
other than as provided by law, knowingly disclose contractor
bid or proposal information or source selection information
during the three-year period after the end of the assignment of
such employee.''.
(e) Report on Existing Exchange Programs.--
(1) Exchange program defined.--For purposes of this
subsection, the term ``exchange program'' means an executive
exchange program, the program under subchapter VI of chapter 33
of title 5, United States Code, and any other program which
allows for--
(A) the assignment of employees of the Federal
Government to non-Federal employers;
(B) the assignment of employees of non-Federal
employers to the Federal Government; or
(C) both.
(2) Reporting requirement.--Not later than 1 year after the
date of the enactment of this Act, the Office of Personnel
Management shall prepare and submit to the Committee on
Government Reform of the House of Representatives and the
Committee on Governmental Affairs of the Senate a report
identifying all existing exchange programs.
(3) Specific information.--The report shall, for each such
program, include--
(A) a brief description of the program, including
its size, eligibility requirements, and terms or
conditions for participation;
(B) specific citation to the law or other authority
under which the program is established;
(C) the names of persons to contact for more
information, and how they may be reached; and
(D) any other information which the Office
considers appropriate.
(f) Report on the Establishment of a Governmentwide Information
Technology Training Program.--
(1) In general.--Not later January 1, 2003, the Office of
Personnel Management, in consultation with the Chief
Information Officers Council and the Administrator of General
Services, shall review and submit to the Committee on
Government Reform of the House of Representatives and the
Committee on Governmental Affairs of the Senate a written
report on the following:
(A) The adequacy of any existing information
technology training programs available to Federal
employees on a Governmentwide basis.
(B)(i) If one or more such programs already exist,
recommendations as to how they might be improved.
(ii) If no such program yet exists, recommendations
as to how such a program might be designed and
established.
(C) With respect to any recommendations under
subparagraph (B), how the program under chapter 37 of
title 5, United States Code, might be used to help
carry them out.
(2) Cost estimate.--The report shall, for any recommended
program (or improvements) under paragraph (1)(B), include the
estimated costs associated with the implementation and
operation of such program as so established (or estimated
difference in costs of any such program as so improved).
(g) Technical and Conforming Amendments.--
(1) Amendments to title 5, united states code.--Title 5,
United States Code, is amended--
(A) in section 3111, by adding at the end the
following:
``(d) Notwithstanding section 1342 of title 31, the head of an
agency may accept voluntary service for the United States under chapter
37 of this title and regulations of the Office of Personnel
Management.'';
(B) in section 4108, by striking subsection (d);
and
(C) in section 7353(b), by adding at the end the
following:
``(4) Nothing in this section precludes an employee of a private
sector organization, while assigned to an agency under chapter 37, from
continuing to receive pay and benefits from such organization in
accordance with such chapter.''.
(2) Amendment to title 18, united states code.--Section 209
of title 18, United States Code, is amended by adding at the
end the following:
``(g)(1) This section does not prohibit an employee of a private
sector organization, while assigned to an agency under chapter 37 of
title 5, from continuing to receive pay and benefits from such
organization in accordance with such chapter.
``(2) For purposes of this subsection, the term `agency' means an
agency (as defined by section 3701 of title 5) and the Office of the
Chief Technology Officer of the District of Columbia.''.
(3) Other amendments.--Section 125(c)(1) of Public Law 100-
238 (5 U.S.C. 8432 note) is amended--
(A) in subparagraph (B), by striking ``or'' at the
end;
(B) in subparagraph (C), by striking ``and'' at the
end and inserting ``or''; and
(C) by adding at the end the following:
``(D) an individual assigned from a Federal agency
to a private sector organization under chapter 37 of
title 5, United States Code; and''.
SEC. 210. SHARE-IN-SAVINGS INITIATIVES.
(a) Defense Contracts.--(1) Chapter 137 of title 10, United States
Code, is amended by adding at the end the following new section:
``Sec. 2332. Share-in-savings contracts
``(a) Authority To Enter Into Share-in-Savings Contracts.--(1) The
head of an agency may enter into a share-in-savings contract for
information technology (as defined in section 11101(6) of title 40) in
which the Government awards a contract to improve mission-related or
administrative processes or to accelerate the achievement of its
mission and share with the contractor in savings achieved through
contract performance.
``(2)(A) Except as provided in subparagraph (B), a share-in-savings
contract shall be awarded for a period of not more than five years.
``(B) A share-in-savings contract may be awarded for a period
greater than five years, but not more than 10 years, if the head of the
agency determines in writing prior to award of the contract that--
``(i) the level of risk to be assumed and the investment to
be undertaken by the contractor is likely to inhibit the
government from obtaining the needed information technology
competitively at a fair and reasonable price if the contract is
limited in duration to a period of five years or less; and
``(ii) usage of the information technology to be acquired
is likely to continue for a period of time sufficient to
generate reasonable benefit for the government.
``(3) Contracts awarded pursuant to the authority of this section
shall, to the maximum extent practicable, be performance-based
contracts that identify objective outcomes and contain performance
standards that will be used to measure achievement and milestones that
must be met before payment is made.
``(4) Contracts awarded pursuant to the authority of this section
shall include a provision containing a quantifiable baseline that is to
be the basis upon which a savings share ratio is established that
governs the amount of payment a contractor is to receive under the
contract. Before commencement of performance of such a contract, the
senior procurement executive of the agency shall determine in writing
that the terms of the provision are quantifiable and will likely yield
value to the Government.
``(5)(A) The head of the agency may retain savings realized through
the use of a share-in-savings contract under this section that are in
excess of the total amount of savings paid to the contractor under the
contract. Except as provided in subparagraph (B), savings shall be
credited to the appropriation or fund against which charges were made
to carry out the contract and shall be used for information technology.
``(B) Amounts retained by the agency under this subsection shall--
``(i) without further appropriation, remain available until
expended; and
``(ii) be applied first to fund any contingent liabilities
associated with share-in-savings procurements that are not
fully funded.
``(b) Cancellation and Termination.--(1) If funds are not made
available for the continuation of a share-in-savings contract entered
into under this section in a subsequent fiscal year, the contract shall
be canceled or terminated. The costs of cancellation or termination may
be paid out of--
``(A) appropriations available for the performance of the
contract;
``(B) appropriations available for acquisition of the
information technology procured under the contract, and not
otherwise obligated; or
``(C) funds subsequently appropriated for payments of costs
of cancellation or termination, subject to the limitations in
paragraph (3).
``(2) The amount payable in the event of cancellation or
termination of a share-in-savings contract shall be negotiated with the
contractor at the time the contract is entered into.
``(3)(A) Subject to subparagraph (B), the head of an agency may
enter into share-in-savings contracts under this section in any given
fiscal year even if funds are not made specifically available for the
full costs of cancellation or termination of the contract if funds are
available and sufficient to make payments with respect to the first
fiscal year of the contract and the following conditions are met
regarding the funding of cancellation and termination liability:
``(i) The amount of unfunded contingent liability for the
contract does not exceed the lesser of--
``(I) 25 percent of the estimated costs of a
cancellation or termination; or
``(II) $5,000,000.
``(ii) Unfunded contingent liability in excess of
$1,000,000 has been approved by the Director of the Office of
Management and Budget or the Director's designee.
``(B) The aggregate number of share-in-savings contracts that may
be entered into under subparagraph (A) by all agencies to which this
chapter applies in a fiscal year--
``(i) may not exceed 5, in each of fiscal years 2003, 2004,
and 2005; and
``(ii) may not exceed 10, in each of fiscal years 2006,
2007, 2008, and 2009.
``(c) Definitions.--In this section:
``(1) The term `contractor' means a private entity that
enters into a contract with an agency.
``(2) The term `savings' means--
``(A) monetary savings to an agency; or
``(B) savings in time or other benefits realized by
the agency, including enhanced revenues.
``(3) The term `share-in-savings contract' means a contract
under which--
``(A) a contractor provides solutions for--
``(i) improving the agency's mission-
related or administrative processes; or
``(ii) accelerating the achievement of
agency missions; and
``(B) the head of the agency pays the contractor an
amount equal to a portion of the savings derived by the
agency from--
``(i) any improvements in mission-related
or administrative processes that result from
implementation of the solution; or
``(ii) acceleration of achievement of
agency missions.
``(d) Termination.--No share-in-savings contracts may be entered
into under this section after September 30, 2009.''.
(2) The table of sections at the beginning of such chapter is
amended by adding at the end of the following new item:
``2332. Share-in-savings contracts.''.
(b) Other Contracts.--Title III of the Federal Property and
Administrative Services Act of 1949 is amended by adding at the end the
following:
``SEC. 317. SHARE-IN-SAVINGS CONTRACTS.
``(a) Authority To Enter Into Share-in-Savings Contracts.--(1) The
head of an executive agency may enter into a share-in-savings contract
for information technology (as defined in section 11101(6) of title 40,
United States Code) in which the Government awards a contract to
improve mission-related or administrative processes or to accelerate
the achievement of its mission and share with the contractor in savings
achieved through contract performance.
``(2)(A) Except as provided in subparagraph (B), a share-in-savings
contract shall be awarded for a period of not more than five years.
``(B) A share-in-savings contract may be awarded for a period
greater than five years, but not more than 10 years, if the head of the
agency determines in writing prior to award of the contract that--
``(i) the level of risk to be assumed and the investment to
be undertaken by the contractor is likely to inhibit the
government from obtaining the needed information technology
competitively at a fair and reasonable price if the contract is
limited in duration to a period of five years or less; and
``(ii) usage of the information technology to be acquired
is likely to continue for a period of time sufficient to
generate reasonable benefit for the government.
``(3) Contracts awarded pursuant to the authority of this section
shall, to the maximum extent practicable, be performance-based
contracts that identify objective outcomes and contain performance
standards that will be used to measure achievement and milestones that
must be met before payment is made.
``(4) Contracts awarded pursuant to the authority of this section
shall include a provision containing a quantifiable baseline that is to
be the basis upon which a savings share ratio is established that
governs the amount of payment a contractor is to receive under the
contract. Before commencement of performance of such a contract, the
senior procurement executive of the agency shall determine in writing
that the terms of the provision are quantifiable and will likely yield
value to the Government.
``(5)(A) The head of the agency may retain savings realized through
the use of a share-in-savings contract under this section that are in
excess of the total amount of savings paid to the contractor under the
contract. Except as provided in subparagraph (B), savings shall be
credited to the appropriation or fund against which charges were made
to carry out the contract and shall be used for information technology.
``(B) Amounts retained by the agency under this subsection shall--
``(i) without further appropriation, remain available until
expended; and
``(ii) be applied first to fund any contingent liabilities
associated with share-in-savings procurements that are not
fully funded.
``(b) Cancellation and Termination.--(1) If funds are not made
available for the continuation of a share-in-savings contract entered
into under this section in a subsequent fiscal year, the contract shall
be canceled or terminated. The costs of cancellation or termination may
be paid out of--
``(A) appropriations available for the performance of the
contract;
``(B) appropriations available for acquisition of the
information technology procured under the contract, and not
otherwise obligated; or
``(C) funds subsequently appropriated for payments of costs
of cancellation or termination, subject to the limitations in
paragraph (3).
``(2) The amount payable in the event of cancellation or
termination of a share-in-savings contract shall be negotiated with the
contractor at the time the contract is entered into.
``(3)(A) Subject to subparagraph (B), the head of an executive
agency may enter into share-in-savings contracts under this section in
any given fiscal year even if funds are not made specifically available
for the full costs of cancellation or termination of the contract if
funds are available and sufficient to make payments with respect to the
first fiscal year of the contract and the following conditions are met
regarding the funding of cancellation and termination liability:
``(i) The amount of unfunded contingent liability for the
contract does not exceed the lesser of--
``(I) 25 percent of the estimated costs of a
cancellation or termination; or
``(II) $5,000,000.
``(ii) Unfunded contingent liability in excess of
$1,000,000 has been approved by the Director of the Office of
Management and Budget or the Director's designee.
``(B) The aggregate number of share-in-savings contracts that may
be entered into under subparagraph (A) by all executive agencies to
which this chapter applies in a fiscal year--
``(i) may not exceed 5, in each of fiscal years 2003, 2004,
and 2005; and
``(ii) may not exceed 10, in each of fiscal years 2006,
2007, 2008, and 2009.
``(c) Definitions.--In this section:
``(1) The term `contractor' means a private entity that
enters into a contract with an agency.
``(2) The term `savings' means--
``(A) monetary savings to an agency; or
``(B) savings in time or other benefits realized by
the agency, including enhanced revenues.
``(3) The term `share-in-savings contract' means a contract
under which--
``(A) a contractor provides solutions for--
``(i) improving the agency's mission-
related or administrative processes; or
``(ii) accelerating the achievement of
agency missions; and
``(B) the head of the agency pays the contractor an
amount equal to a portion of the savings derived by the
agency from--
``(i) any improvements in mission-related
or administrative processes that result from
implementation of the solution; or
``(ii) acceleration of achievement of
agency missions.
``(d) Termination.--No share-in-savings contracts may be entered
into under this section after September 30, 2009.''.
(c) Development of Incentives.--The Director of the Office of
Management and Budget shall, in consultation with the Committee on
Governmental Affairs of the Senate, the Committee on Government Reform
of the House of Representatives, and executive agencies, develop
techniques to permit an executive agency to retain a portion of the
savings (after payment of the contractor's share of the savings)
derived from share-in-savings contracts as funds are appropriated to
the agency in future fiscal years.
(d) Regulations.--Not later than 270 days after the date of the
enactment of this Act, the Federal Acquisition Regulation shall be
revised to implement the provisions enacted by this section. Such
revisions shall--
(1) provide for the use of competitive procedures in the
selection and award of share-in-savings contracts to--
(A) ensure the contractor's share of savings
reflects the risk involved and market conditions; and
(B) otherwise yield greatest value to the
government; and
(2) allow appropriate regulatory flexibility to facilitate
the use of share-in-savings contracts by executive agencies,
including the use of innovative provisions for technology
refreshment and nonstandard Federal Acquisition Regulation
contract clauses.
(e) Additional Guidance.--The Administrator of General Services
shall--
(1) identify potential opportunities for the use of share-
in-savings contracts; and
(2) in consultation with the Director of the Office of
Management and Budget, provide guidance to executive agencies
for determining mutually beneficial savings share ratios and
baselines from which savings may be measured.
(f) OMB Report to Congress.--In consultation with executive
agencies, the Director of the Office of Management and Budget shall,
not later than 2 years after the date of the enactment of this Act,
submit to Congress a report containing--
(1) a description of the number of share-in-savings
contracts entered into by each executive agency under by this
section and the amendments made by this section, and, for each
contract identified--
(A) the information technology acquired;
(B) the total amount of payments made to the
contractor; and
(C) the total amount of savings or other measurable
benefits realized;
(2) a description of the ability of agencies to determine
the baseline costs of a project against which savings can be
measured; and
(3) any recommendations, as the Director deems appropriate,
regarding additional changes in law that may be necessary to
ensure effective use of share-in-savings contracts by executive
agencies.
(g) GAO Report to Congress.--The Comptroller General shall, not
later than 6 months after the report required under subsection (f) is
submitted to Congress, conduct a review of that report and submit to
Congress a report containing--
(1) the results of the review; and
(2) any recommendations, as the Comptroller General deems
appropriate, on the use of share-in-savings contracts by
executive agencies.
(h) Definitions.--In this section, the terms ``contractor'',
``savings'', and ``share-in-savings contract'' have the meanings given
those terms in section 317 of the Federal Property and Administrative
Services Act of 1949 (as added by subsection (b)).
SEC. 211. AUTHORIZATION FOR ACQUISITION OF INFORMATION TECHNOLOGY BY
STATE AND LOCAL GOVERNMENTS THROUGH FEDERAL SUPPLY
SCHEDULES.
(a) Authority To Use Certain Supply Schedules.--Section 502 of
title 40, United States Code, is amended by adding at the end the
following new subsection:
``(c) Use of Certain Supply Schedules.--
``(1) In general.--The Administrator may provide for the
use by State or local governments of Federal supply schedules
of the General Services Administration for automated data
processing equipment (including firmware), software, supplies,
support equipment, and services (as contained in Federal supply
classification code group 70).
``(2) Voluntary use.--In any case of the use by a State or
local government of a Federal supply schedule pursuant to
paragraph (1), participation by a firm that sells to the
Federal Government through the supply schedule shall be
voluntary with respect to a sale to the State or local
government through such supply schedule.
``(3) Definitions.--In this subsection:
``(A) The term `State or local government' includes
any State, local, regional, or tribal government, or
any instrumentality thereof (including any local
educational agency or institution of higher education).
``(B) The term `tribal government' means a tribal
organization, as defined in section 4 of the Indian
Self-Determination and Education Assistance Act (25
U.S.C. 450b).
``(C) The term `local educational agency' has the
meaning given that term in section 8013 of the
Elementary and Secondary Education Act of 1965 (20
U.S.C. 7713).
``(D) The term `institution of higher education'
has the meaning given that term in section 101(a) of
the Higher Education Act of 1965 (20 U.S.C.
1001(a)).''.
(b) Procedures.--Not later than 30 days after the date of the
enactment of this Act, the Administrator of General Services shall
establish procedures to implement section 501(c) of title 40, United
States Code (as added by subsection (a)).
(c) Report.--Not later than December 31, 2004, the Administrator
shall submit to the Committee on Government Reform of the House of
Representatives and the Committee on Governmental Affairs of the Senate
a report on the implementation and effects of the amendment made by
subsection (a).
SEC. 212. INTEGRATED REPORTING STUDY AND PILOT PROJECTS.
(a) Purposes.--The purposes of this section are to--
(1) enhance the interoperability of Federal information
systems;
(2) assist the public, including the regulated community,
in electronically submitting information to agencies under
Federal requirements, by reducing the burden of duplicate
collection and ensuring the accuracy of submitted information;
and
(3) enable any person to integrate and obtain similar
information held by 1 or more agencies under 1 or more Federal
requirements without violating the privacy rights of an
individual.
(b) Definitions.--In this section, the term--
(1) ``agency'' means an Executive agency as defined under
section 105 of title 5, United States Code; and
(2) ``person'' means any individual, trust, firm, joint
stock company, corporation (including a government
corporation), partnership, association, State, municipality,
commission, political subdivision of a State, interstate body,
or agency or component of the Federal Government.
(c) Report.--
(1) In general.--Not later than 3 years after the date of
enactment of this Act, the Director shall oversee a study, in
consultation with agencies, the regulated community, public
interest organizations, and the public, and submit a report to
the Committee on Governmental Affairs of the Senate and the
Committee on Government Reform of the House of Representatives
on progress toward integrating Federal information systems
across agencies.
(2) Contents.--The report under this section shall--
(A) address the integration of data elements used
in the electronic collection of information within
databases established under Federal statute without
reducing the quality, accessibility, scope, or utility
of the information contained in each database;
(B) address the feasibility of developing, or
enabling the development of, software, including
Internet-based tools, for use by reporting persons in
assembling, documenting, and validating the accuracy of
information electronically submitted to agencies under
nonvoluntary, statutory, and regulatory requirements;
(C) address the feasibility of developing a
distributed information system involving, on a
voluntary basis, at least 2 agencies, that--
(i) provides consistent, dependable, and
timely public access to the information
holdings of 1 or more agencies, or some portion
of such holdings, without requiring public
users to know which agency holds the
information; and
(ii) allows the integration of public
information held by the participating agencies;
(D) address the feasibility of incorporating other
elements related to the purposes of this section at the
discretion of the Director; and
(E) make any recommendations that the Director
deems appropriate on the use of integrated reporting
and information systems, to reduce the burden on
reporting and strengthen public access to databases
within and across agencies.
(d) Pilot Projects To Encourage Integrated Collection and
Management of Data and Interoperability of Federal Information
Systems.--
(1) In general.--In order to provide input to the study
under subsection (c), the Director shall designate, in
consultation with agencies, a series of no more than 5 pilot
projects that integrate data elements. The Director shall
consult with agencies, the regulated community, public interest
organizations, and the public on the implementation of the
pilot projects.
(2) Goals of pilot projects.--
(A) In general.--Each goal described under
subparagraph (B) shall be addressed by at least 1 pilot
project each.
(B) Goals.--The goals under this paragraph are to--
(i) reduce information collection burdens
by eliminating duplicative data elements within
2 or more reporting requirements;
(ii) create interoperability between or
among public databases managed by 2 or more
agencies using technologies and techniques that
facilitate public access; and
(iii) develop, or enable the development
of, software to reduce errors in electronically
submitted information.
(3) Input.--Each pilot project shall seek input from users
on the utility of the pilot project and areas for improvement.
To the extent practicable, the Director shall consult with
relevant agencies and State, tribal, and local governments in
carrying out the report and pilot projects under this section.
(e) Protections.--The activities authorized under this section
shall afford protections for--
(1) confidential business information consistent with
section 552(b)(4) of title 5, United States Code, and other
relevant law;
(2) personal privacy information under sections 552(b) (6)
and (7)(C) and 552a of title 5, United States Code, and other
relevant law;
(3) other information consistent with section 552(b)(3) of
title 5, United States Code, and other relevant law; and
(4) confidential statistical information collected under a
confidentiality pledge, solely for statistical purposes,
consistent with the Office of Management and Budget's Federal
Statistical Confidentiality Order, and other relevant law.
SEC. 213. COMMUNITY TECHNOLOGY CENTERS.
(a) Purposes.--The purposes of this section are to--
(1) study and enhance the effectiveness of community
technology centers, public libraries, and other institutions
that provide computer and Internet access to the public; and
(2) promote awareness of the availability of on-line
government information and services, to users of community
technology centers, public libraries, and other public
facilities that provide access to computer technology and
Internet access to the public.
(b) Study and Report.--Not later than 2 years after the effective
date of this title, the Administrator shall--
(1) conduct a study to evaluate the best practices of
community technology centers that have received Federal funds;
and
(2) submit a report on the study to--
(A) the Committee on Governmental Affairs of the
Senate;
(B) the Committee on Health, Education, Labor, and
Pensions of the Senate;
(C) the Committee on Government Reform of the House
of Representatives; and
(D) the Committee on Education and the Workforce of
the House of Representatives.
(c) Contents.--The report under subsection (b) may consider--
(1) an evaluation of the best practices being used by
successful community technology centers;
(2) a strategy for--
(A) continuing the evaluation of best practices
used by community technology centers; and
(B) establishing a network to share information and
resources as community technology centers evolve;
(3) the identification of methods to expand the use of best
practices to assist community technology centers, public
libraries, and other institutions that provide computer and
Internet access to the public;
(4) a database of all community technology centers that
have received Federal funds, including--
(A) each center's name, location, services
provided, director, other points of contact, number of
individuals served; and
(B) other relevant information;
(5) an analysis of whether community technology centers
have been deployed effectively in urban and rural areas
throughout the Nation; and
(6) recommendations of how to--
(A) enhance the development of community technology
centers; and
(B) establish a network to share information and
resources.
(d) Cooperation.--All agencies that fund community technology
centers shall provide to the Administrator any information and
assistance necessary for the completion of the study and the report
under this section.
(e) Assistance.--
(1) In general.--The Administrator, in consultation with
the Secretary of Education, shall work with other relevant
Federal agencies, and other interested persons in the private
and nonprofit sectors to--
(A) assist in the implementation of
recommendations; and
(B) identify other ways to assist community
technology centers, public libraries, and other
institutions that provide computer and Internet access
to the public.
(2) Types of assistance.--Assistance under this subsection
may include--
(A) contribution of funds;
(B) donations of equipment, and training in the use
and maintenance of the equipment; and
(C) the provision of basic instruction or training
material in computer skills and Internet usage.
(f) Online Tutorial.--
(1) In general.--The Administrator, in consultation with
the Secretary of Education, the Director of the Institute of
Museum and Library Services, other relevant agencies, and the
public, shall develop an online tutorial that--
(A) explains how to access Government information
and services on the Internet; and
(B) provides a guide to available online resources.
(2) Distribution.--The Administrator, with assistance from
the Secretary of Education, shall distribute information on the
tutorial to community technology centers, public libraries, and
other institutions that afford Internet access to the public.
(g) Promotion of Community Technology Centers.--The Administrator,
with assistance from the Department of Education and in consultation
with other agencies and organizations, shall promote the availability
of community technology centers to raise awareness within each
community where such a center is located.
(h) Authorization of Appropriations.--There are authorized to be
appropriated for the study of best practices at community technology
centers, for the development and dissemination of the online tutorial,
and for the promotion of community technology centers under this
section--
(1) $2,000,000 in fiscal year 2003;
(2) $2,000,000 in fiscal year 2004; and
(3) such sums as are necessary in fiscal years 2005 through
2007.
SEC. 214. ENHANCING CRISIS MANAGEMENT THROUGH ADVANCED INFORMATION
TECHNOLOGY.
(a) Purpose.--The purpose of this section is to improve how
information technology is used in coordinating and facilitating
information on disaster preparedness, response, and recovery, while
ensuring the availability of such information across multiple access
channels.
(b) In General.--
(1) Study on enhancement of crisis response.--Not later
than 90 days after the date of enactment of this Act, the
Administrator, in consultation with the Federal Emergency
Management Agency, shall enter into a contract to conduct a
study on using information technology to enhance crisis
preparedness, response, and consequence management of natural
and manmade disasters.
(2) Contents.--The study under this subsection shall
address--
(A) a research and implementation strategy for
effective use of information technology in crisis
response and consequence management, including the more
effective use of technologies, management of
information technology research initiatives, and
incorporation of research advances into the information
and communications systems of--
(i) the Federal Emergency Management
Agency; and
(ii) other Federal, State, and local
agencies responsible for crisis preparedness,
response, and consequence management; and
(B) opportunities for research and development on
enhanced technologies into areas of potential
improvement as determined during the course of the
study.
(3) Report.--Not later than 2 years after the date on which
a contract is entered into under paragraph (1), the
Administrator shall submit a report on the study, including
findings and recommendations to--
(A) the Committee on Governmental Affairs of the
Senate; and
(B) the Committee on Government Reform of the House
of Representatives.
(4) Interagency cooperation.--Other Federal departments and
agencies with responsibility for disaster relief and emergency
assistance shall fully cooperate with the Administrator in
carrying out this section.
(5) Authorization of appropriations.--There are authorized
to be appropriated for research under this subsection, such
sums as are necessary for fiscal year 2003.
(c) Pilot Projects.--Based on the results of the research conducted
under subsection (b), the Administrator, in consultation with the
Federal Emergency Management Agency, shall initiate pilot projects or
report to Congress on other activities that further the goal of
maximizing the utility of information technology in disaster
management. The Administrator shall cooperate with other relevant
agencies, and, if appropriate, State, local, and tribal governments, in
initiating such pilot projects.
SEC. 215. DISPARITIES IN ACCESS TO THE INTERNET.
(a) Study and Report.--
(1) Study.--Not later than 90 days after the date of
enactment of this Act, the Administrator of General Services
shall request that the National Academy of Sciences, acting
through the National Research Council, enter into a contract to
conduct a study on disparities in Internet access for online
Government services.
(2) Report.--Not later than 2 years after the date of
enactment of this Act, the Administrator of General Services
shall submit to the Committee on Governmental Affairs of the
Senate and the Committee on Government Reform of the House of
Representatives a final report of the study under this section,
which shall set forth the findings, conclusions, and
recommendations of the National Research Council.
(b) Contents.--The report under subsection (a) shall include a
study of--
(1) how disparities in Internet access influence the
effectiveness of online Government services, including a review
of--
(A) the nature of disparities in Internet access;
(B) the affordability of Internet service;
(C) the incidence of disparities among different
groups within the population; and
(D) changes in the nature of personal and public
Internet access that may alleviate or aggravate
effective access to online Government services;
(2) how the increase in online Government services is
influencing the disparities in Internet access and how
technology development or diffusion trends may offset such
adverse influences; and
(3) related societal effects arising from the interplay of
disparities in Internet access and the increase in online
Government services.
(c) Recommendations.--The report shall include recommendations on
actions to ensure that online Government initiatives shall not have the
unintended result of increasing any deficiency in public access to
Government services.
(d) Authorization of Appropriations.--There are authorized to be
appropriated $950,000 in fiscal year 2003 to carry out this section.
TITLE III--INFORMATION SECURITY
SEC. 301. INFORMATION SECURITY.
(a) Short Title.--This title may be cited as the ``Federal
Information Security Management Act of 2002''.
(b) Information Security.--
(1) In general.--Subchapter II of chapter 35 of title 44,
United States Code, is amended to read as follows:
``SUBCHAPTER II--INFORMATION SECURITY
``Sec. 3531. Purposes
``The purposes of this subchapter are to--
``(1) provide a comprehensive framework for ensuring the
effectiveness of information security controls over information
resources that support Federal operations and assets;
``(2) recognize the highly networked nature of the current
Federal computing environment and provide effective
governmentwide management and oversight of the related
information security risks, including coordination of
information security efforts throughout the civilian, national
security, and law enforcement communities;
``(3) provide for development and maintenance of minimum
controls required to protect Federal information and
information systems;
``(4) provide a mechanism for improved oversight of Federal
agency information security programs;
``(5) acknowledge that commercially developed information
security products offer advanced, dynamic, robust, and
effective information security solutions, reflecting market
solutions for the protection of critical information
infrastructures important to the national defense and economic
security of the nation that are designed, built, and operated
by the private sector; and
``(6) recognize that the selection of specific technical
hardware and software information security solutions should be
left to individual agencies from among commercially developed
products.
``Sec. 3532. Definitions
``(a) In General.--Except as provided under subsection (b), the
definitions under section 3502 shall apply to this subchapter.
``(b) Additional Definitions.--As used in this subchapter--
``(1) the term `information security' means protecting
information and information systems from unauthorized access,
use, disclosure, disruption, modification, or destruction in order to
provide--
``(A) integrity, which means guarding against
improper information modification or destruction, and
includes ensuring information nonrepudiation and
authenticity;
``(B) confidentiality, which means preserving
authorized restrictions on access and disclosure,
including means for protecting personal privacy and
proprietary information; and
``(C) availability, which means ensuring timely and
reliable access to and use of information;
``(2) the term `national security system' means any
information system (including any telecommunications system)
used or operated by an agency or by a contractor of an agency,
or other organization on behalf of an agency--
``(A) the function, operation, or use of which--
``(i) involves intelligence activities;
``(ii) involves cryptologic activities
related to national security;
``(iii) involves command and control of
military forces;
``(iv) involves equipment that is an
integral part of a weapon or weapons system; or
``(v) is critical to the direct fulfillment
of military or intelligence missions,
except that this subparagraph does not include a system
that is used for routine administrative and business
applications (including payroll, finance, logistics,
and personnel management applications); or
``(B) is protected at all times by procedures
established for information that have been specifically
authorized under criteria established by an Executive
order or an Act of Congress to be kept classified in
the interest of national defense or foreign policy; and
``(3) the term `information technology' has the meaning
given that term in section 11101 of title 40.
``Sec. 3533. Authority and functions of the Director
``(a) The Director shall oversee agency information security
policies and practices, including--
``(1) developing and overseeing the implementation of
policies, principles, standards, and guidelines on information
security, including through the promulgation of standards and
guidelines under section 11331 of title 40;
``(2) requiring agencies, consistent with the standards
promulgated under such section 11331 and the requirements of
this subchapter, to identify and provide information security
protections commensurate with the risk and magnitude of the
harm resulting from the unauthorized access, use, disclosure,
disruption, modification, or destruction of--
``(A) information collected or maintained by or on
behalf of an agency; or
``(B) information systems used or operated by an
agency or by a contractor of an agency or other
organization on behalf of an agency;
``(3) coordinating the development of standards and
guidelines under section 20 of the National Institute of
Standards and Technology Act (15 U.S.C. 278g-3) with agencies
and offices operating or exercising control of national
security systems (including the National Security Agency) to
assure, to the maximum extent feasible, that such standards and
guidelines are complementary with standards and guidelines
developed for national security systems;
``(4) overseeing agency compliance with the requirements of
this subchapter, including through any authorized action under
section 11303 of title 40, to enforce accountability for
compliance with such requirements;
``(5) reviewing at least annually, and approving or
disapproving, agency information security programs required
under section 3534(b);
``(6) coordinating information security policies and
procedures with related information resources management
policies and procedures;
``(7) overseeing the operation of the Federal information
security incident center required under section 3536; and
``(8) reporting to Congress no later than March 1 of each
year on agency compliance with the requirements of this
subchapter, including--
``(A) a summary of the findings of evaluations
required by section 3535;
``(B) significant deficiencies in agency
information security practices;
``(C) planned remedial action to address such
deficiencies; and
``(D) a summary of, and the views of the Director
on, the report prepared by the National Institute of
Standards and Technology under section 20(e)(7) of the
National Institute of Standards and Technology Act (15
U.S.C. 278g-3).
``(b) Except for the authorities described in paragraphs (4) and
(8) of subsection (a), the authorities of the Director under this
section shall not apply to national security systems.
``Sec. 3534. Federal agency responsibilities
``(a) The head of each agency shall--
``(1) be responsible for--
``(A) providing information security protections
commensurate with the risk and magnitude of the harm
resulting from unauthorized access, use, disclosure,
disruption, modification, or destruction of--
``(i) information collected or maintained
by or on behalf of the agency; and
``(ii) information systems used or operated
by an agency or by a contractor of an agency or
other organization on behalf of an agency;
``(B) complying with the requirements of this
subchapter and related policies, procedures, standards,
and guidelines, including--
``(i) information security standards
promulgated by the Director under section 11331
of title 40; and
``(ii) information security standards and
guidelines for national security systems issued
in accordance with law and as directed by the
President; and
``(C) ensuring that information security management
processes are integrated with agency strategic and
operational planning processes;
``(2) ensure that senior agency officials provide
information security for the information and information
systems that support the operations and assets under their
control, including through--
``(A) assessing the risk and magnitude of the harm
that could result from the unauthorized access, use,
disclosure, disruption, modification, or destruction of
such information or information systems;
``(B) determining the levels of information
security appropriate to protect such information and
information systems in accordance with standards
promulgated under section 11331 of title 40, for
information security classifications and related
requirements;
``(C) implementing policies and procedures to cost-
effectively reduce risks to an acceptable level; and
``(D) periodically testing and evaluating
information security controls and techniques to ensure
that they are effectively implemented;
``(3) delegate to the agency Chief Information Officer
established under section 3506 (or comparable official in an
agency not covered by such section) the authority to ensure
compliance with the requirements imposed on the agency under
this subchapter, including--
``(A) designating a senior agency information
security officer who shall--
``(i) carry out the Chief Information
Officer's responsibilities under this section;
``(ii) possess professional qualifications,
including training and experience, required to
administer the functions described under this
section;
``(iii) have information security duties as
that official's primary duty; and
``(iv) head an office with the mission and
resources to assist in ensuring agency
compliance with this section;
``(B) developing and maintaining an agencywide
information security program as required by subsection
(b);
``(C) developing and maintaining information
security policies, procedures, and control techniques
to address all applicable requirements, including those
issued under section 3533 of this title, and section
11331 of title 40;
``(D) training and overseeing personnel with
significant responsibilities for information security
with respect to such responsibilities; and
``(E) assisting senior agency officials concerning
their responsibilities under paragraph (2);
``(4) ensure that the agency has trained personnel
sufficient to assist the agency in complying with the
requirements of this subchapter and related policies,
procedures, standards, and guidelines; and
``(5) ensure that the agency Chief Information Officer, in
coordination with other senior agency officials, reports
annually to the agency head on the effectiveness of the agency
information security program, including progress of remedial
actions.
``(b) Each agency shall develop, document, and implement an
agencywide information security program, approved by the Director under
section 3533(a)(5), to provide information security for the information
and information systems that support the operations and assets of the
agency, including those provided or managed by another agency,
contractor, or other source, that includes--
``(1) periodic assessments of the risk and magnitude of the
harm that could result from the unauthorized access, use,
disclosure, disruption, modification, or destruction of
information and information systems that support the operations
and assets of the agency;
``(2) policies and procedures that--
``(A) are based on the risk assessments required by
paragraph (1);
``(B) cost-effectively reduce information security
risks to an acceptable level;
``(C) ensure that information security is addressed
throughout the life cycle of each agency information
system; and
``(D) ensure compliance with--
``(i) the requirements of this subchapter;
``(ii) policies and procedures as may be
prescribed by the Director, and information
security standards promulgated under section
11331 of title 40;
``(iii) minimally acceptable system
configuration requirements, as determined by
the agency; and
``(iv) any other applicable requirements,
including standards and guidelines for national
security systems issued in accordance with law
and as directed by the President;
``(3) subordinate plans for providing adequate information
security for networks, facilities, and systems or groups of
information systems, as appropriate;
``(4) security awareness training to inform personnel,
including contractors and other users of information systems
that support the operations and assets of the agency, of--
``(A) information security risks associated with
their activities; and
``(B) their responsibilities in complying with
agency policies and procedures designed to reduce these
risks;
``(5) periodic testing and evaluation of the effectiveness
of information security policies, procedures, and practices, to
be performed with a frequency depending on risk, but no less than
annually, of which such testing--
``(A) shall include testing of management,
operational, and technical controls of every
information system identified in the inventory required
under section 3505(c); and
``(B) may include testing relied on in a evaluation
under section 3535;
``(6) a process for planning, implementing, evaluating, and
documenting remedial action to address any deficiencies in the
information security policies, procedures, and practices of the
agency;
``(7) procedures for detecting, reporting, and responding
to security incidents, consistent with standards and guidelines
issued pursuant to section 3536(b), including--
``(A) mitigating risks associated with such
incidents before substantial damage is done;
``(B) notifying and consulting with the Federal
information security incident center referred to in
section 3536; and
``(C) notifying and consulting with, as
appropriate--
``(i) law enforcement agencies and relevant
Offices of Inspector General;
``(ii) an office designated by the
President for any incident involving a national
security system; and
``(iii) any other agency or office, in
accordance with law or as directed by the
President; and
``(8) plans and procedures to ensure continuity of
operations for information systems that support the operations
and assets of the agency.
``(c) Each agency shall--
``(1) report annually to the Director, the Committees on
Government Reform and Science of the House of Representatives,
the Committees on Governmental Affairs and Commerce, Science,
and Transportation of the Senate, the appropriate authorization
and appropriations committees of Congress, and the Comptroller
General on the adequacy and effectiveness of information
security policies, procedures, and practices, and compliance
with the requirements of this subchapter, including compliance
with each requirement of subsection (b);
``(2) address the adequacy and effectiveness of information
security policies, procedures, and practices in plans and
reports relating to--
``(A) annual agency budgets;
``(B) information resources management under
subchapter 1 of this chapter;
``(C) information technology management under
subtitle III of title 40;
``(D) program performance under sections 1105 and
1115 through 1119 of title 31, and sections 2801 and
2805 of title 39;
``(E) financial management under chapter 9 of title
31, and the Chief Financial Officers Act of 1990 (31
U.S.C. 501 note; Public Law 101-576) (and the
amendments made by that Act);
``(F) financial management systems under the
Federal Financial Management Improvement Act (31 U.S.C.
3512 note); and
``(G) internal accounting and administrative
controls under section 3512 of title 31, (known as the
`Federal Managers Financial Integrity Act'); and
``(3) report any significant deficiency in a policy,
procedure, or practice identified under paragraph (1) or (2)--
``(A) as a material weakness in reporting under
section 3512 of title 31; and
``(B) if relating to financial management systems,
as an instance of a lack of substantial compliance
under the Federal Financial Management Improvement Act
(31 U.S.C. 3512 note).
``(d)(1) In addition to the requirements of subsection (c), each
agency, in consultation with the Director, shall include as part of the
performance plan required under section 1115 of title 31 a description
of--
``(A) the time periods, and
``(B) the resources, including budget, staffing, and
training,
that are necessary to implement the program required under subsection
(b).
``(2) The description under paragraph (1) shall be based on the
risk assessments required under subsection (b)(2)(1).
``(e) Each agency shall provide the public with timely notice and
opportunities for comment on proposed information security policies and
procedures to the extent that such policies and procedures affect
communication with the public.
``Sec. 3535. Annual independent evaluation
``(a)(1) Each year each agency shall have performed an independent
evaluation of the information security program and practices of that
agency to determine the effectiveness of such program and practices.
``(2) Each evaluation by an agency under this section shall
include--
``(A) testing of the effectiveness of information security
policies, procedures, and practices of a representative subset
of the agency's information systems;
``(B) an assessment (made on the basis of the results of
the testing) of compliance with--
``(i) the requirements of this subchapter; and
``(ii) related information security policies,
procedures, standards, and guidelines; and
``(C) separate presentations, as appropriate, regarding
information security relating to national security systems.
``(b) Subject to subsection (c)--
``(1) for each agency with an Inspector General appointed
under the Inspector General Act of 1978, the annual evaluation
required by this section shall be performed by the Inspector
General or by an independent external auditor, as determined by the
Inspector General of the agency; and
``(2) for each agency to which paragraph (1) does not
apply, the head of the agency shall engage an independent
external auditor to perform the evaluation.
``(c) For each agency operating or exercising control of a national
security system, that portion of the evaluation required by this
section directly relating to a national security system shall be
performed--
``(1) only by an entity designated by the agency head; and
``(2) in such a manner as to ensure appropriate protection
for information associated with any information security
vulnerability in such system commensurate with the risk and in
accordance with all applicable laws.
``(d) The evaluation required by this section may be based in whole
or in part on an audit, evaluation, or report relating to programs or
practices of the applicable agency.
``(e)(1) Each year, not later than such date established by the
Director, the head of each agency shall submit to the Director the
results of the evaluation required under this section.
``(2) To the extent an evaluation required under this section
directly relates to a national security system, the evaluation results
submitted to the Director shall contain only a summary and assessment
of that portion of the evaluation directly relating to a national
security system.
``(f) Agencies and evaluators shall take appropriate steps to
ensure the protection of information which, if disclosed, may adversely
affect information security. Such protections shall be commensurate
with the risk and comply with all applicable laws and regulations.
``(g)(1) The Director shall summarize the results of the
evaluations conducted under this section in the report to Congress
required under section 3533(a)(8).
``(2) The Director's report to Congress under this subsection shall
summarize information regarding information security relating to
national security systems in such a manner as to ensure appropriate
protection for information associated with any information security
vulnerability in such system commensurate with the risk and in
accordance with all applicable laws.
``(3) Evaluations and any other descriptions of information systems
under the authority and control of the Director of Central Intelligence
or of National Foreign Intelligence Programs systems under the
authority and control of the Secretary of Defense shall be made
available to Congress only through the appropriate oversight committees
of Congress, in accordance with applicable laws.
``(h) The Comptroller General shall periodically evaluate and
report to Congress on--
``(1) the adequacy and effectiveness of agency information
security policies and practices; and
``(2) implementation of the requirements of this
subchapter.
``Sec. 3536. Federal information security incident center
``(a) The Director shall ensure the operation of a central Federal
information security incident center to--
``(1) provide timely technical assistance to operators of
agency information systems regarding security incidents,
including guidance on detecting and handling information
security incidents;
``(2) compile and analyze information about incidents that
threaten information security;
``(3) inform operators of agency information systems about
current and potential information security threats, and
vulnerabilities; and
``(4) consult with agencies or offices operating or
exercising control of national security systems (including the
National Security Agency) and such other agencies or offices in
accordance with law and as directed by the President regarding
information security incidents and related matters.
``(b) Each agency operating or exercising control of a national
security system shall share information about information security
incidents, threats, and vulnerabilities with the Federal information
security incident center to the extent consistent with standards and
guidelines for national security systems, issued in accordance with law
and as directed by the President.
``Sec. 3537. National security systems
``The head of each agency operating or exercising control of a
national security system shall be responsible for ensuring that the
agency--
``(1) provides information security protections
commensurate with the risk and magnitude of the harm resulting
from the unauthorized access, use, disclosure, disruption,
modification, or destruction of the information contained in
such system;
``(2) implements information security policies and
practices as required by standards and guidelines for national
security systems, issued in accordance with law and as directed
by the President; and
``(3) complies with the requirements of this subchapter.
``Sec. 3538. Authorization of appropriations
``There are authorized to be appropriated to carry out the
provisions of this subchapter such sums as may be necessary for each of
fiscal years 2003 through 2007.
``Sec. 3539. Effect on existing law
``Nothing in this subchapter, section 11331 of title 40, or section
20 of the National Standards and Technology Act (15 U.S.C. 278g-3) may
be construed as affecting the authority of the President, the Office of
Management and Budget or the Director thereof, the National Institute
of Standards and Technology, or the head of any agency, with respect to
the authorized use or disclosure of information, including with regard
to the protection of personal privacy under section 552a of title 5,
the disclosure of information under section 552 of title 5, the
management and disposition of records under chapters 29, 31, or 33 of
title 44, the management of information resources under subchapter I of
chapter 35 of this title, or the disclosure of information to the
Congress or the Comptroller General of the United States.''.
(2) Clerical amendment.--The items in the table of sections
at the beginning of such chapter 35 under the heading
``SUBCHAPTER II--INFORMATION SECURITY'' are amended to read as
follows:
``3531. Purposes.
``3532. Definitions.
``3533. Authority and functions of the Director.
``3534. Federal agency responsibilities.
``3535. Annual independent evaluation.
``3536. Federal information security incident center.
``3537. National security systems.
``3538. Authorization of appropriations.
``3539. Effect on existing law.''.
(c) Information Security Responsibilities of Certain Agencies.--
(1) National security responsibilities.--(A) Nothing in
this Act (including any amendment made by this Act) shall
supersede any authority of the Secretary of Defense, the
Director of Central Intelligence, or other agency head, as
authorized by law and as directed by the President, with regard
to the operation, control, or management of national security
systems, as defined by section 3532(b)(2) of title 44, United
States Code.
(B) Section 2224 of title 10, United States Code, is
amended--
(i) in subsection (b), by striking ``(b) Objectives
and Minimum Requirements.--(1)'' and inserting ``(b)
Objectives of the Program.--'';
(ii) in subsection (b), by striking paragraph (2);
and
(iii) in subsection (c), in the matter preceding
paragraph (1), by inserting ``, including through
compliance with subtitle II of chapter 35 of title 44''
after ``infrastructure''.
(2) Atomic energy act of 1954.--Nothing in this Act shall
supersede any requirement made by or under the Atomic Energy
Act of 1954 (42 U.S.C. 2011 et seq.). Restricted data or
formerly restricted data shall be handled, protected,
classified, downgraded, and declassified in conformity with the
Atomic Energy Act of 1954 (42 U.S.C. 2011 et seq.).
SEC. 302. MANAGEMENT OF INFORMATION TECHNOLOGY.
(a) In General.--Section 11331 of title 40, United States Code, is
amended to read as follows:
``Sec. 11331. Responsibilities for federal information systems
standards
``(a) Information Security Standards.--
``(1) In general.--(A) Except as provided under paragraph
(2), the Director of the Office of Management and Budget shall,
on the basis of proposed standards developed by the National
Institute of Standards and Technology pursuant to paragraph (3)
of section 20(a) of the National Institute of Standards and
Technology Act (15 U.S.C. 278g-3(a)), promulgate information
security standards pertaining to Federal information systems.
``(B) Standards promulgated under subparagraph (A) shall
include--
``(i) standards that provide minimum information
security requirements as determined under section 20(b)
of the National Institute of Standards and Technology
Act (15 U.S.C. 278g-3(b)); and
``(ii) such standards that are otherwise necessary
to improve the efficiency of operation or security of
Federal information systems.
``(C) Information security standards described under
subparagraph (B) shall be compulsory and binding.
``(2) National security systems.--Standards and guidelines
for national security systems under this subsection shall be
developed, promulgated, enforced, and overseen as otherwise
authorized by law and as directed by the President.
``(3) Agency head authority.--The head of an agency may
employ standards for the cost-effective information security
for all operations and assets within or under the supervision
of that agency that are more stringent than the standards
promulgated by the Director under this subsection, if such
standards--
``(A) contain, at a minimum, the provisions of
those applicable standards made compulsory and binding
by the Director; and
``(B) are otherwise consistent with policies and
guidelines issued under section 3533 of title 44.
``(4) Decisions on promulgation of standards.--(A) The
decision regarding the promulgation of any standard by the
Director under paragraphs (1) and (2) shall occur not later
than 6 months after the submission of the proposed standard to
the Director by the National Institute of Standards and
Technology, as provided under section 20 of the National
Institute of Standards and Technology Act (15 U.S.C. 278g-3).
``(B) A decision by the Director to significantly modify,
or not promulgate, a proposed standard submitted to the
Director by the National Institute of Standards and Technology,
as provided under section 20 of the National Institute of
Standards and Technology Act (15 U.S.C. 278g-3), shall be made
after the public is given an opportunity to comment on the
Director's proposed decision.
``(b) Additional Standards Relating to Federal Information
Systems.--
``(1) In general.--Except as provided under paragraph (2),
the Secretary of Commerce shall, on the basis of proposed
standards developed by the National Institute of Standards and
Technology pursuant to paragraph (2) of section 20(a) of the
National Institute of Standards and Technology Act (15 U.S.C.
278g-3(a)) and in consultation with the Director of the Office
of Management and Budget, promulgate standards pertaining to
Federal information systems. The Secretary shall make such
standards compulsory and binding to the extent that the
Secretary determines necessary to improve the efficiency and
effectiveness of the operation of Federal information systems.
``(2) National security systems.--Standards and guidelines
for national security systems under this subsection shall be
developed, promulgated, enforced, and overseen as otherwise
authorized by law and as directed by the President.
``(3) Authority of Secretary.--The authority conferred upon
the Secretary of Commerce by this subsection shall be exercised
subject to direction by the President and in coordination with
the Director of the Office of Management and Budget to ensure
fiscal and policy consistency.
``(4) Agency head authority.--The head of an agency may
employ standards for information systems that are more
stringent than the standards promulgated by the Secretary of
Commerce under this subsection, if such standards contain, at a
minimum, the provisions of those applicable standards made
compulsory and binding by the Secretary of Commerce.
``(c) Definitions.--In this section:
``(1) Federal information system.--The term `Federal
information system' means an information system used or
operated by an agency, by a contractor of an agency, or by
another organization on behalf of an agency.
``(2) Information security.--The term `information
security' has the meaning given that term in section 3532(b)(1)
of title 44.
``(3) National security system.--The term `national
security system' has the meaning given that term in section
3532(b)(2) of title 44.''.
(b) Clerical Amendment.--The item relating to section 11331 in the
table of sections at the beginning of chapter 113 of such title is
amended to read as follows:
``11331. Responsibilities for Federal information systems standards.''.
SEC. 303. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY.
Section 20 of the National Institute of Standards and Technology
Act (15 U.S.C. 278g-3), is amended by striking the text and inserting
the following:
``(a) The Institute shall--
``(1) have the mission of developing standards, guidelines,
and associated methods and techniques for information systems;
``(2) develop standards and guidelines, including minimum
requirements, for information systems used or operated by an
agency or by a contractor of an agency or other organization on
behalf of an agency, other than national security systems (as
defined in section 3532(b)(2) of title 44, United States Code);
and
``(3) develop standards and guidelines, including minimum
requirements, for providing adequate information security for
all agency operations and assets, but such standards and
guidelines shall not apply to national security systems.
``(b) The standards and guidelines required by subsection (a) shall
include, at a minimum--
``(1)(A) standards to be used by all agencies to categorize
all information and information systems collected or maintained
by or on behalf of each agency based on the objectives of
providing appropriate levels of information security according
to a range of risk levels;
``(B) guidelines recommending the types of information and
information systems to be included in each such category; and
``(C) minimum information security requirements for
information and information systems in each such category;
``(2) a definition of and guidelines concerning detection
and handling of information security incidents; and
``(3) guidelines developed in coordination with the
National Security Agency for identifying an information system
as a national security system consistent with applicable
requirements for national security systems, issued in
accordance with law and as directed by the President.
``(c) In developing standards and guidelines required by
subsections (a) and (b), the Institute shall--
``(1) consult with other agencies and offices and the
private sector (including the Director of the Office of
Management and Budget, the Departments of Defense and Energy,
the National Security Agency, the General Accounting Office,
and the Secretary of Homeland Security) to assure--
``(A) use of appropriate information security
policies, procedures, and techniques, in order to
improve information security and avoid unnecessary and
costly duplication of effort; and
``(B) that such standards and guidelines are
complementary with standards and guidelines employed
for the protection of national security systems and
information contained in such systems;
``(2) provide the public with an opportunity to comment on
proposed standards and guidelines;
``(3) submit to the Director of the Office of Management
and Budget for promulgation under section 11331 of title 40,
United States Code--
``(A) standards, as required under subsection
(b)(1)(A), no later than 12 months after the date of
the enactment of this section; and
``(B) minimum information security requirements for
each category, as required under subsection (b)(1)(C),
no later than 36 months after the date of the enactment
of this section;
``(4) issue guidelines as required under subsection
(b)(1)(B), no later than 18 months after the date of the
enactment of this section;
``(5) ensure that such standards and guidelines do not
specify the use or procurement of certain products, including
any specific hardware or software;
``(6) ensure that such standards and guidelines provide for
sufficient flexibility to permit alternative solutions to
provide equivalent levels of protection for identified
information security risks; and
``(7) use flexible, performance-based standards and
guidelines that, to the greatest extent possible, permit the
use of off-the-shelf commercially developed information
security products.
``(d)(1) There is established in the Institute an Office for
Information Security Programs.
``(2) The Office for Information Security Programs shall be headed
by a Director, who shall be a senior executive and shall be compensated
at a level in the Senior Executive Service under section 5382 of title
5, United States Code, as determined by the Secretary of Commerce.
``(3) The Director of the Institute shall delegate to the Director
of the Office of Information Security Programs the authority to
administer all functions under this section, except that any such
delegation shall not relieve the Director of the Institute of
responsibility for the administration of such functions. The Director
of the Office of Information Security Programs shall serve as principal
adviser to the Director of the Institute on all functions under this
section.
``(e) The Institute shall--
``(1) submit standards developed pursuant to subsection
(a), along with recommendations as to the extent to which these
should be made compulsory and binding, to the Director of the
Office of Management and Budget for promulgation under section
11331 of title 40, United States Code;
``(2) provide assistance to agencies regarding--
``(A) compliance with the standards and guidelines
developed under subsection (a);
``(B) detecting and handling information security
incidents; and
``(C) information security policies, procedures,
and practices;
``(3) conduct research, as needed, to determine the nature
and extent of information security vulnerabilities and
techniques for providing cost-effective information security;
``(4) develop and periodically revise performance
indicators and measures for agency information security
policies and practices;
``(5) evaluate private sector information security policies
and practices and commercially available information
technologies to assess potential application by agencies to
strengthen information security;
``(6) evaluate security policies and practices developed
for national security systems to assess potential application
by agencies to strengthen information security;
``(7) periodically assess the effectiveness of standards
and guidelines developed under this section and undertake
revisions as appropriate;
``(8) solicit and consider the recommendations of the
Information Security and Privacy Advisory Board, established by
section 21, regarding standards and guidelines developed under
subsection (a) and submit such recommendations to the Director
of the Office of Management and Budget with such standards
submitted to the Director; and
``(9) prepare an annual public report on activities
undertaken in the previous year, and planned for the coming
year, to carry out responsibilities under this section.
``(f) As used in this section--
``(1) the term `agency' has the same meaning as provided in
section 3502(1) of title 44, United States Code;
``(2) the term `information security' has the same meaning
as provided in section 3532(b)(1) of such title;
``(3) the term `information system' has the same meaning as
provided in section 3502(8) of such title;
``(4) the term `information technology' has the same
meaning as provided in section 11101 of title 40, United States
Code; and
``(5) the term `national security system' has the same
meaning as provided in section 3532(b)(2) of title 44, United
States Code.
``(g) There are authorized to be appropriated to the Secretary of
Commerce $20,000,000 for each of fiscal years 2003, 2004, 2005, 2006,
and 2007 to enable the National Institute of Standards and Technology
to carry out the provisions of this section.''.
SEC. 304. INFORMATION SECURITY AND PRIVACY ADVISORY BOARD.
Section 21 of the National Institute of Standards and Technology
Act (15 U.S.C. 278g-4), is amended--
(1) in subsection (a), by striking ``Computer System
Security and Privacy Advisory Board'' and inserting
``Information Security and Privacy Advisory Board'';
(2) in subsection (a)(1), by striking ``computer or
telecommunications'' and inserting ``information technology'';
(3) in subsection (a)(2)--
(A) by striking ``computer or telecommunications
technology'' and inserting ``information technology'';
and
(B) by striking ``computer or telecommunications
equipment'' and inserting ``information technology'';
(4) in subsection (a)(3)--
(A) by striking ``computer systems'' and inserting
``information system''; and
(B) by striking ``computer systems security'' and
inserting ``information security'';
(5) in subsection (b)(1) by striking ``computer systems
security'' and inserting ``information security'';
(6) in subsection (b) by striking paragraph (2) and
inserting the following:
``(2) to advise the Institute and the Director of the
Office of Management and Budget on information security and
privacy issues pertaining to Federal Government information
systems, including through review of proposed standards and guidelines
developed under section 20; and'';
(7) in subsection (b)(3) by inserting ``annually'' after
``report'';
(8) by inserting after subsection (e) the following new
subsection:
``(f) The Board shall hold meetings at such locations and at such
time and place as determined by a majority of the Board.'';
(9) by redesignating subsections (f) and (g) as subsections
(g) and (h), respectively; and
(10) by striking subsection (h), as redesignated by
paragraph (9), and inserting the following:
``(h) As used in this section, the terms `information system' and
`information technology' have the meanings given in section 20.''.
SEC. 305. TECHNICAL AND CONFORMING AMENDMENTS.
(a) Computer Security Act.--Subsections (b) and (c) of section
11332 of title 40, United States Code, are repealed.
(b) Floyd D. Spence National Defense Authorization Act for Fiscal
Year 2001.--The Floyd D. Spence National Defense Authorization Act for
Fiscal Year 2001 (Public Law 106-398) is amended by striking section
1062 (44 U.S.C. 3531 note).
(c) Paperwork Reduction Act.--(1) Section 3504(g) of title 44,
United States Code, is amended--
(A) by adding ``and'' at the end of paragraph (1);
(B) in paragraph (2)--
(i) by striking ``sections 11331 and 11332(b) and
(c) of title 40'' and inserting ``section 11331 of
title 40 and subchapter II of this chapter''; and
(ii) by striking ``; and'' and inserting a period;
and
(C) by striking paragraph (3).
(2) Section 3505 of such title is amended by adding at the end--
``(c)(1) The head of each agency shall develop and maintain an
inventory of major information systems (including major national
security systems) operated by or under the control of such agency.
``(2) The identification of information systems in an inventory
under this subsection shall include an identification of the interfaces
between each such system and all other systems or networks, including
those not operated by or under the control of the agency.
``(3) Such inventory shall be--
``(A) updated at least annually;
``(B) made available to the Comptroller General; and
``(C) used to support information resources management,
including--
``(i) preparation and maintenance of the inventory
of information resources under section 3506(b)(4);
``(ii) information technology planning, budgeting,
acquisition, and management under section 3506(h),
subtitle III of title 40, and related laws and
guidance;
``(iii) monitoring, testing, and evaluation of
information security controls under subchapter II;
``(iv) preparation of the index of major
information systems required under section 552(g) of
title 5, United States Code; and
``(v) preparation of information system inventories
required for records management under chapters 21, 29,
31, and 33.
``(4) The Director shall issue guidance for and oversee the
implementation of the requirements of this subsection.''.
(3) Section 3506(g) of such title is amended--
(A) by adding ``and'' at the end of paragraph (1);
(B) in paragraph (2)--
(i) by striking ``section 11332 of title 40'' and
inserting ``subchapter II of this chapter''; and
(ii) by striking ``; and'' and inserting a period;
and
(C) by striking paragraph (3).
SEC. 306. CONSTRUCTION.
Nothing in this title, or the amendments made by this title,
affects the authority of the National Institute of Standards and
Technology or the Department of Commerce relating to the development
and promulgation of standards or guidelines under paragraphs (1) and
(2) of section 20(a) of the National Institute of Standards and
Technology Act (15 U.S.C. 278g-3(a)).
TITLE IV--AUTHORIZATION OF APPROPRIATIONS AND EFFECTIVE DATES
SEC. 401. AUTHORIZATION OF APPROPRIATIONS.
Except for those purposes for which an authorization of
appropriations is specifically provided in title I or II, including the
amendments made by such titles, there are authorized to be appropriated
such sums as are necessary to carry out titles I and II for each of
fiscal years 2003 through 2007.
SEC. 402. EFFECTIVE DATES.
(a) Titles I and II.--
(1) In general.--Except as provided under paragraph (2),
titles I and II and the amendments made by such titles shall
take effect 120 days after the date of enactment of this Act.
(2) Immediate enactment.--Sections 207, 214, and 215 shall
take effect on the date of enactment of this Act.
(b) Titles III and IV.--Title III and this title shall take effect
on the date of enactment of this Act.
TITLE V--CONFIDENTIAL INFORMATION PROTECTION AND STATISTICAL EFFICIENCY
SEC. 501. SHORT TITLE.
This title may be cited as the ``Confidential Information
Protection and Statistical Efficiency Act of 2002''.
SEC. 502. DEFINITIONS.
As used in this title:
(1) The term ``agency'' means any entity that falls within
the definition of the term ``executive agency'' as defined in
section 102 of title 31, United States Code, or ``agency'', as
defined in section 3502 of title 44, United States Code.
(2) The term ``agent''--
(A) means an employee of a private organization or
a researcher affiliated with an institution of higher
learning (including a person granted special sworn
status by the Bureau of the Census under section 23(c)
of title 13, United States Code) with whom a contract
or other agreement is executed, on a temporary basis,
by an executive agency to perform exclusively
statistical activities under the control and
supervision of an officer or employee of that agency;
or
(B) means an individual who is working under the
authority of a government entity with which a contract
or other agreement is executed by an executive agency
to perform exclusively statistical activities under the
control of an officer or employee of that agency; or
(C) means an individual who is a self-employed
researcher, a consultant, or a contractor, or who is an
employee of a contractor and with whom a contract or
other agreement is executed by an executive agency to
perform a statistical activity under the control of an
officer or employee of that agency; or
(D) means an individual who is a contractor or who
is an employee of a contractor engaged by the agency to
design or maintain the systems for handling or storage
of data received under this title; and
(E) who agrees in writing to comply with all
provisions of law that affect information acquired by
that agency.
(3) The term ``business data'' means operating and
financial data and information about businesses, tax-exempt
organizations, and government entities.
(4) The term ``identifiable form'' means any representation
of information that permits the identity of the respondent to
whom the information applies to be reasonably inferred by
either direct or indirect means.
(5) The term ``nonstatistical purpose''--
(A) means the use of data in identifiable form for
any purpose that is not a statistical purpose,
including any administrative, regulatory, law
enforcement, adjudicatory, or other purpose that
affects the rights, privileges, or benefits of a
particular identifiable respondent; and
(B) includes the disclosure under section 552 of
title 5, United States Code (popularly known as the
Freedom of Information Act) of data that are acquired
for exclusively statistical purposes under a pledge of
confidentiality.
(6) The term ``respondent'' means a person who, or
organization that, is requested or required to supply
information to an agency, is the subject of information
requested or required to be supplied to an agency, or provides
that information to an agency.
(7) The term ``statistical activities''--
(A) means the collection, compilation, processing,
or analysis of data for the purpose of describing or
making estimates concerning the whole, or relevant
groups or components within, the economy, society, or
the natural environment; and
(B) includes the development of methods or
resources that support those activities, such as
measurement methods, models, statistical
classifications, or sampling frames.
(8) The term ``statistical agency or unit'' means an agency
or organizational unit of the executive branch whose activities
are predominantly the collection, compilation, processing, or
analysis of information for statistical purposes.
(9) The term ``statistical purpose''--
(A) means the description, estimation, or analysis
of the characteristics of groups, without identifying
the individuals or organizations that comprise such
groups; and
(B) includes the development, implementation, or
maintenance of methods, technical or administrative
procedures, or information resources that support the
purposes described in subparagraph (A).
SEC. 503. COORDINATION AND OVERSIGHT OF POLICIES.
(a) In General.--The Director of the Office of Management and
Budget shall coordinate and oversee the confidentiality and disclosure
policies established by this title. The Director may promulgate rules
or provide other guidance to ensure consistent interpretation of this
title by the affected agencies.
(b) Agency Rules.--Subject to subsection (c), agencies may
promulgate rules to implement this title. Rules governing disclosures
of information that are authorized by this title shall be promulgated
by the agency that originally collected the information.
(c) Review and Approval of Rules.--The Director shall review any
rules proposed by an agency pursuant to this title for consistency with
the provisions of this title and chapter 35 of title 44, United States
Code, and such rules shall be subject to the approval of the Director.
(d) Reports.--
(1) The head of each agency shall provide to the Director
of the Office of Management and Budget such reports and other
information as the Director requests.
(2) Each Designated Statistical Agency referred to in
section 522 shall report annually to the Director of the Office
of Management and Budget, the Committee on Government Reform of
the House of Representatives, and the Committee on Governmental
Affairs of the Senate on the actions it has taken to implement
sections 523 and 524. The report shall include copies of each
written agreement entered into pursuant to section 524(a) for
the applicable year.
(3) The Director of the Office of Management and Budget
shall include a summary of reports submitted to the Director
under paragraph (2) and actions taken by the Director to
advance the purposes of this title in the annual report to the
Congress on statistical programs prepared under section
3504(e)(2) of title 44, United States Code.
SEC. 504. EFFECT ON OTHER LAWS.
(a) Section 3510 of Title 44, United States Code.--This title,
including amendments made by this title, does not diminish the
authority under section 3510 of title 44, United States Code, of the
Director of the Office of Management and Budget to direct, and of an
agency to make, disclosures that are not inconsistent with any
applicable law.
(b) Sections 8, 16, 301, and 401 of Title 13 and Section 2108 of
Title 44, United States Code.--This title, including amendments made by
this title, does not diminish the authority of the Bureau of the Census
to provide information in accordance with sections 8, 16, 301, and 401
of title 13 and section 2108 of title 44, United States Code.
(c) Section 9 of Title 13, United States Code.--This title,
including amendments made by this title, shall not be construed as
authorizing the disclosure for nonstatistical purposes of demographic
data or information collected by the Census Bureau pursuant to section
9 of title 13, United States Code.
(d) Section 12 of the Federal Energy Administration Act of 1974.--
In accordance with the provisions of this title, data acquired for
exclusively statistical purposes under a pledge of confidentiality are
exempt from mandatory disclosure in identifiable form for
nonstatistical purposes under section 12 of the Federal Energy
Administration Act of 1974 (15 U.S.C. 771).
(e) Preemption of State Law.--Nothing in this title shall preempt
applicable State law regarding the confidentiality of data collected by
the States.
(f) Statutes Regarding False Statements.--Notwithstanding section
512, information collected by an agency for exclusively statistical
purposes under a pledge of confidentiality may be provided by the
collecting agency to a law enforcement agency for the prosecution of
submissions to the collecting agency of false statistical information
under statutes that authorize criminal penalties (such as section 221
of title 13, United States Code) or civil penalties for the provision
of false statistical information, unless such disclosure or use would
otherwise be prohibited under Federal law.
(g) Construction.--Nothing in this title shall be construed as
restricting or diminishing any confidentiality protections or penalties
for unauthorized disclosure that otherwise apply to data or information
collected for statistical purposes or nonstatistical purposes,
including, but not limited to, section 6103 of the Internal Revenue
Code of 1986 (26 U.S.C. 6103).
Subtitle A--Confidential Information Protection
SEC. 511. FINDINGS AND PURPOSES.
(a) Findings.--Congress finds the following:
(1) Individuals, businesses, and other organizations have
varying degrees of legal protection when providing information
to the Federal Government for strictly statistical purposes.
(2) Pledges of confidentiality by the Federal Government
provide assurances to the public that information about
individuals or organizations or provided by individuals or
organizations for exclusively statistical purposes will be held
in confidence and will not be used against such individuals or
organizations in any Federal Government action.
(3) Protecting the confidentiality interests of individuals
or organizations who provide information for Federal
statistical programs serves both the interests of the public
and the needs of society.
(4) Declining trust of the public in the protection of
information provided to the Federal Government adversely
affects both the accuracy and completeness of statistical
analyses.
(5) Ensuring that information provided for statistical
purposes receives protection is essential in continuing public
cooperation in statistical programs.
(b) Purposes.--The purposes of this subtitle are the following:
(1) To ensure that information supplied by individuals or
organizations to an agency for statistical purposes under a
pledge of confidentiality is used exclusively for statistical
purposes.
(2) To ensure that individuals or organizations who supply
information to the Federal Government for statistical purposes
will neither have that information disclosed in identifiable
form to anyone not authorized by this title nor have that
information used for any purpose other than a statistical
purpose.
(3) To safeguard the confidentiality of individually
identifiable information acquired under a pledge of
confidentiality for statistical purposes by controlling access
to, and uses made of, such information.
SEC. 512. LIMITATIONS ON USE AND DISCLOSURE OF DATA AND INFORMATION.
(a) Use of Statistical Data or Information.--Data or information
acquired by an agency under a pledge of confidentiality and for
exclusively statistical purposes shall be used by officers, employees,
or agents of the agency exclusively for statistical purposes.
(b) Disclosure of Statistical Data or Information.--
(1) Data or information acquired by an agency under a
pledge of confidentiality for exclusively statistical purposes
shall not be disclosed by an agency in identifiable form, for
any use other than an exclusively statistical purpose, except
with the informed consent of the respondent.
(2) A disclosure pursuant to paragraph (1) is authorized
only when the head of the agency approves such disclosure and
the disclosure is not prohibited by any other law.
(3) This section does not restrict or diminish any
confidentiality protections in law that otherwise apply to data
or information acquired by an agency under a pledge of
confidentiality for exclusively statistical purposes.
(c) Rule for Use of Data or Information for Nonstatistical
Purposes.--A statistical agency or unit shall clearly distinguish any
data or information it collects for nonstatistical purposes (as
authorized by law) by a rule that provides that the respondent
supplying the data or information is fully informed, before the data or
information is collected, that the data or information could be used
for nonstatistical purposes.
(d) Designation of Agents.--A statistical agency or unit may
designate agents, by contract or by entering into a special agreement
containing the provisions required by section 502, who may perform
exclusively statistical activities, subject to the limitations and
penalties described in this title.
SEC. 513. FINES AND PENALTIES.
Whoever, being an officer, employee, or agent of an agency
acquiring information for exclusively statistical purposes, having
taken and subscribed the oath of office, or having sworn to observe the
limitations imposed by section 512, comes into possession of such
information by reason of his or her being an officer, employee, or
agent and, knowing that the disclosure of the specific information is
prohibited under the provisions of this title, willfully discloses the
information in any manner to a person or agency not entitled to receive
it, shall be guilty of a class E felony and imprisoned for not more
than 5 years, or fined not more than $250,000, or both.
Subtitle B--Statistical Efficiency
SEC. 521. FINDINGS AND PURPOSES.
(a) Findings.--Congress finds the following:
(1) Federal statistics are an important source of
information for public and private decision-makers such as
policymakers, consumers, businesses, investors, and workers.
(2) Federal statistical agencies should continuously seek
to improve their efficiency. Statutory constraints limit the
ability of these agencies to share data and thus to achieve
higher efficiency for Federal statistical programs.
(3) The quality of Federal statistics depends on the
willingness of businesses to respond to statistical surveys.
Reducing reporting burdens will increase response rates, and
therefore lead to more accurate characterizations of the
economy.
(4) Enhanced sharing of business data among the Bureau of
the Census, the Bureau of Economic Analysis, and the Bureau of
Labor Statistics for exclusively statistical purposes will
improve their ability to track more accurately the large and
rapidly changing nature of United States business. In
particular, the statistical agencies will be able to better
ensure that businesses are consistently classified in
appropriate industries, resolve data anomalies, produce
statistical samples that are consistently adjusted for the
entry and exit of new businesses in a timely manner, and
correct faulty reporting errors quickly and efficiently.
(5) Congress enacted the International Investment and Trade
in Services Act of 1990 that allowed the Bureau of the Census,
the Bureau of Economic Analysis, and the Bureau of Labor
Statistics to share data on foreign-owned companies. The Act
not only expanded detailed industry coverage from 135
industries to over 800 industries with no increase in the data
collected from respondents but also demonstrated how data
sharing can result in the creation of valuable data products.
(6) With subtitle A of this title, the sharing of business
data among the Bureau of the Census, the Bureau of Economic
Analysis, and the Bureau of Labor Statistics continues to
ensure the highest level of confidentiality for respondents to
statistical surveys.
(b) Purposes.--The purposes of this subtitle are the following:
(1) To authorize the sharing of business data among the
Bureau of the Census, the Bureau of Economic Analysis, and the
Bureau of Labor Statistics for exclusively statistical
purposes.
(2) To reduce the paperwork burdens imposed on businesses
that provide requested information to the Federal Government.
(3) To improve the comparability and accuracy of Federal
economic statistics by allowing the Bureau of the Census, the
Bureau of Economic Analysis, and the Bureau of Labor Statistics
to update sample frames, develop consistent classifications of
establishments and companies into industries, improve coverage,
and reconcile significant differences in data produced by the
three agencies.
(4) To increase understanding of the United States economy,
especially for key industry and regional statistics, to develop
more accurate measures of the impact of technology on
productivity growth, and to enhance the reliability of the
Nation's most important economic indicators, such as the
National Income and Product Accounts.
SEC. 522. DESIGNATION OF STATISTICAL AGENCIES.
For purposes of this subtitle, the term ``Designated Statistical
Agency'' means each of the following:
(1) The Bureau of the Census of the Department of Commerce.
(2) The Bureau of Economic Analysis of the Department of
Commerce.
(3) The Bureau of Labor Statistics of the Department of
Labor.
SEC. 523. RESPONSIBILITIES OF DESIGNATED STATISTICAL AGENCIES.
The head of each of the Designated Statistical Agencies shall--
(1) identify opportunities to eliminate duplication and
otherwise reduce reporting burden and cost imposed on the
public in providing information for statistical purposes;
(2) enter into joint statistical projects to improve the
quality and reduce the cost of statistical programs; and
(3) protect the confidentiality of individually
identifiable information acquired for statistical purposes by adhering
to safeguard principles, including--
(A) emphasizing to their officers, employees, and
agents the importance of protecting the confidentiality
of information in cases where the identity of
individual respondents can reasonably be inferred by
either direct or indirect means;
(B) training their officers, employees, and agents
in their legal obligations to protect the
confidentiality of individually identifiable
information and in the procedures that must be followed
to provide access to such information;
(C) implementing appropriate measures to assure the
physical and electronic security of confidential data;
(D) establishing a system of records that
identifies individuals accessing confidential data and
the project for which the data were required; and
(E) being prepared to document their compliance
with safeguard principles to other agencies authorized
by law to monitor such compliance.
SEC. 524. SHARING OF BUSINESS DATA AMONG DESIGNATED STATISTICAL
AGENCIES.
(a) In General.--A Designated Statistical Agency may provide
business data in an identifiable form to another Designated Statistical
Agency under the terms of a written agreement among the agencies
sharing the business data that specifies--
(1) the business data to be shared;
(2) the statistical purposes for which the business data
are to be used;
(3) the officers, employees, and agents authorized to
examine the business data to be shared; and
(4) appropriate security procedures to safeguard the
confidentiality of the business data.
(b) Responsibilities of Agencies Under Other Laws.--The provision
of business data by an agency to a Designated Statistical Agency under
this subtitle shall in no way alter the responsibility of the agency
providing the data under other statutes (including section 552 of title
5, United States Code (popularly known as the ``Freedom of Information
Act''), and section 552b of title 5, United States Code (popularly
known as the ``Privacy Act of 1974'')) with respect to the provision or
withholding of such information by the agency providing the data.
(c) Responsibilities of Officers, Employees, and Agents.--
Examination of business data in identifiable form shall be limited to
the officers, employees, and agents authorized to examine the
individual reports in accordance with written agreements pursuant to
this section. Officers, employees, and agents of a Designated
Statistical Agency who receive data pursuant to this subtitle shall be
subject to all provisions of law, including penalties, that relate--
(1) to the unlawful provision of the business data that
would apply to the officers, employees, and agents of the
agency that originally obtained the information; and
(2) to the unlawful disclosure of the business data that
would apply to officers, employees, and agents of the agency
that originally obtained the information.
(d) Notice.--Whenever a written agreement concerns data that
respondents were required by law to report and the respondents were not
informed that the data could be shared among the Designated Statistical
Agencies, for exclusively statistical purposes, the terms of such
agreement shall be described in a public notice issued by the agency
that intends to provide the data. Such notice shall allow a minimum of
60 days for public comment.
SEC. 525. LIMITATIONS ON USE OF BUSINESS DATA PROVIDED BY DESIGNATED
STATISTICAL AGENCIES.
(a) In General.--Business data provided by a Designated Statistical
Agency pursuant to this subtitle shall be used exclusively for
statistical purposes.
(b) Publication of Data.--Publication of business data acquired by
a Designated Statistical Agency shall occur in a manner whereby the
data furnished by any particular respondent are not in identifiable
form.
SEC. 526. CONFORMING AMENDMENTS.
(a) Department of Commerce.--Section 1 of the Act of January 27,
1938 (15 U.S.C. 176a) is amended by striking ``The'' and inserting
``Except as provided in the Confidential Information Protection and
Statistical Efficiency Act of 2002, the''.
(b) Title 13.--Chapter 10 of title 13, United States Code, is
amended--
(1) by adding after section 401 the following:
``Sec. 402. Providing business data to Designated Statistical Agencies
``The Bureau of the Census may provide business data to the Bureau
of Economic Analysis and the Bureau of Labor Statistics (`Designated
Statistical Agencies') if such information is required for an
authorized statistical purpose and the provision is the subject of a
written agreement with that Designated Statistical Agency, or their
successors, as defined in the Confidential Information Protection and
Statistical Efficiency Act of 2002.''; and
(2) in the table of sections for the chapter by adding
after the item relating to section 401 the following:
``402. Providing business data to Designated Statistical Agencies.''.
Union Calendar No. 489
107th CONGRESS
2d Session
H. R. 2458
[Report No. 107-787, Part I]
Rule___________________________________________________________________
A BILL
To enhance the management and promotion of electronic Government
services and processes by establishing a Federal Chief Information
Officer within the Office of Management and Budget, and by establishing
a broad framework of measures that require using Internet-based
information technology to enhance citizen access to Government
information and services, and for other purposes.
_______________________________________________________________________
November 14, 2002
Reported with an amendment and referred to the Committee on the
Judiciary for a period ending not later than November 14, 2002 for
consideration of such provisions of the bill and amendment as fall
within the jurisdiction of that committee pursuant to clause 1(k), rule
X
Committee on the Judiciary discharged; committed to the Committee of
the Whole House on the State of the Union and ordered to be
printedvernment information and services, and for other purposes.
_______________________________________________________________________
November 14, 2002
Reported with an amendment and referred to the Committee on the
Judiciary for a period ending not later than N