[Congressional Record Volume 146, Number 155 (Friday, December 15, 2000)]
[Senate]
[Pages S11886-S11890]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]




            PUBLIC SAFETY OFFICER MEDAL OF VALOR ACT OF 2000

  Mr. STEVENS. Mr. President, I ask unanimous consent that the 
Judiciary Committee be discharged from further consideration of H.R. 46 
and the Senate proceed to its immediate consideration.
  The PRESIDING OFFICER. Without objection, it is so ordered. The clerk 
will report the bill by title.
  The assistant legislative clerk read as follows:

       A bill (H.R. 46) to provide a national medal for public 
     safety officers who act with extraordinary valor above and 
     beyond the call of duty.

  There being no objection, the Senate proceeded to consider the bill.
  Mr. LEAHY. Mr. President, today we consider three bipartisan measures 
offered together as a package: the Public Safety Officer Medal of Valor 
Act, H.R. 46; the Computer Crime Enforcement Act, which I introduced as 
S. 1314, on July 1, 1999, with Senator DeWine and is now also co-
sponsored by Senators Robb, Hatch and Abraham; and a Hatch-Leahy-
Schumer ``Internet Security Act'' amendment. I thank my colleagues for 
their hard work on these pieces of legislation, each of which I will 
discuss in turn.
  I support the Public Safety Officer Medal of Valor Act. I cosponsored 
the Stevens bill, S. 39, to establish a Public Safety Medal of Valor. 
In April and May, 1999, I made sure that the Senate acted on Senator 
Stevens' bill, S. 39.
  On April 22, 1999, the Senate Judiciary Committee took up that 
measure in regular order and reported it unanimously. At that time I 
congratulated Senator Stevens and thanked him for his leadership. I 
noted that we had worked together on a number of law enforcement 
matters and that the senior Senator from Alaska is a stalwart supporter 
of the men and women who put themselves at risk to protect us all. I 
said that I looked forward to enactment of this measure and to seeing 
the extraordinary heroism of our police, firefighters and correctional 
officers recognized with the Medal of Valor.
  On May 18, 1999, I was privileged to be on the floor of the Senate 
when we proceeded to consider S. 39 and passed it unanimously. I took 
that occasion to commend Senator Stevens and all who had worked so hard 
to move this measure in a timely way. That was over one year ago, 
during National Police Week last year. The measure was sent to the 
House where it lay dormant for the rest of last year and most of this 
one.
  The President of the United States came to Capitol Hill to speak at 
the Law Enforcement Officers Memorial Service on May 15, 2000, and said 
on that occasion that if Congress would not act on the Medal of Valor, 
he was instructing the Attorney General to explore ways to award such 
recognition by Executive action.
  Unfortunately, these calls for action did not waken the House from 
its slumber on this matter and the House of Representatives refused to 
pass the Senate-passed Medal of Valor bill. Instead, over the past 
year, the House has insisted that the Senate take up, fix and pass the 
House-passed version of this measure if it is to become law. House 
members have indicated that they are now prepared to accept most of the 
Senate-passed text, but insist that it be enacted under the House bill 
number. In order to get this important measure to the President, that 
is what we are doing today. We are discharging the House-passed version 
of that bill, H.R. 46, from the Judiciary Committee, adopting a 
complete substitute, and sending it back to the House.
  I have worked with Senator Hatch, Senator Stevens and others to 
perfect the final version of this bill. We have crafted bipartisan 
improvements to ensure that the Medal of Valor Board will worked 
effectively and efficiently with the National Medal of Valor Office 
within the Department of Justice. Our legislation establishes both of 
these entities and it is essential that they work well together to 
design the Medal of Valor and to create the criteria and procedures for 
recommendations of nominees for the award. The men and women who will 
be honored by the Medal of Valor for their brave deeds deserve nothing 
less.
  The information age is filled with unlimited potential for good, but 
it also creates a variety of new challenges for law enforcement. A 
recent survey by the FBI and the Computer Security Institute found that 
62 percent of information security professionals reported computer 
security breaches in the past year. These breaches in computer security 
resulted in financial losses of more than $120 million from fraud, 
theft of

[[Page S11887]]

information, sabotage, computer viruses, and stolen laptops. Computer 
crime has become a multi-billion dollar problem.
  Many of us have worked on these issues for years. In 1984, we passed 
the Computer Fraud and Abuse Act to criminalize conduct when carried 
out by means of unauthorized access to a computer. In 1986, we passed 
the Electronic Communications Privacy Act (ECPA), which I was proud to 
sponsor, to criminalize tampering with electronic mail systems and 
remote data processing systems and to protect the privacy of computer 
users. In 1994, the Violent Crime Control and Law Enforcement Act 
included the Computer Abuse Amendments which I authored to make illegal 
the intentional transmission of computer viruses.
  In the 104th Congress, Senators Kyl, Grassley and I worked together 
to enact the National Information Infrastructure Protection Act to 
increase protection under federal criminal law for both government and 
private computers, and to address an emerging problem of computer-age 
blackmail in which a criminal threatens to harm or shut down a computer 
system unless their extortion demands are met. In the 105th Congress, 
Senators Kyl and I also worked together on criminal copyright 
amendments that became law to enhance the protection of copyrighted 
works online.
  The Congress must be constantly vigilant to keep the law up-to-date 
with technology. The Computer Crime Enforcement Act, S. 1314, and the 
Hatch-Leahy-Schumer ``Internet Security Act'' amendment are part of 
that ongoing effort. These complementary pieces of legislation reflect 
twin-track progress against computer crime: More tools at the federal 
level and more resources for local computer crime enforcement. The fact 
that this is a bipartisan effort is good for technology policy.
  But make no mistake about it: even with passage of this legislation, 
there is more work to be done--both to assist law enforcement and to 
safeguard the privacy and other important constitutional rights of our 
citizens. I wish that the Congress had also tackled online privacy 
in this session, but that will now be punted into the next 
congressional session.

  The legislation before us today does not attempt to resolve every 
issue. For example, both the Senate and the House held hearings this 
session about the FBI's Carnivore program. Carnivore is a computer 
program designed to advance criminal investigations by capturing 
information in Internet communications pursuant to court orders. Those 
hearings sparked a good debate about whether advances in technology, 
like Carnivore, require Congress to pass new legislation to assure that 
our private Internet communications are protected from government over-
reaching while protecting the government's right to investigate crime. 
I look forward to our discussion of these privacy issues in the next 
Congress.
  The Computer Crime Enforcement Act is intended to help states and 
local agencies in fighting computer crime. All 50 states have now 
enacted tough computer crime control laws. They establish a firm 
groundwork for electronic commerce, an increasingly important sector of 
the nation's economy.
  Unfortunately, too many state and local law enforcement agencies are 
struggling to afford the high cost of enforcing their state computer 
crime statutes. Earlier this year, I released a survey on computer 
crime in Vermont. My office surveyed 54 law enforcement agencies in 
Vermont--43 police departments and 11 State's attorney offices--on 
their experience investigating and prosecuting computer crimes. The 
survey found that more than half of these Vermont law enforcement 
agencies encounter computer crime, with many police departments and 
state's attorney offices handling 2 to 5 computer crimes per month.
  Despite this documented need, far too many law enforcement agencies 
in Vermont cannot afford the cost of policing against computer crimes. 
Indeed, my survey found that 98 percent of the responding Vermont law 
enforcement agencies do not have funds dedicated for use in computer 
crime enforcement. My survey also found that few law enforcement 
officers in Vermont are properly trained in investigating computer 
crimes and analyzing cyber-evidence.
  According to my survey, 83 percent of responding law enforcement 
agencies in Vermont do not employ officers properly trained in computer 
crime investigative techniques. Moreover, my survey found that 52 
percent of the law enforcement agencies that handle one or more 
computer crimes per month cited their lack of training as a problem 
encountered during investigations. Without the necessary education, 
training and technical support, our law enforcement officers are and 
will continue to be hamstrung in their efforts to crack down on 
computer crimes.
  I crafted the Computer Crime Enforcement Act, S. 1314, to address 
this problem. The bill would authorize a $25 million Department of 
Justice grant program to help states prevent and prosecute computer 
crime. Grants under our bipartisan bill may be used to provide 
education, training, and enforcement programs for local law enforcement 
officers and prosecutors in the rapidly growing field of computer 
criminal justice. Our legislation has been endorsed by the Information 
Technology Association of America and the Fraternal Order of Police. 
This is an important bipartisan effort to provide our state and local 
partners in crime-fighting with the resources they need to address 
computer crime.
  The Internet Security Act of 2000 makes progress to ensure that we 
are properly dealing with the increase in computer crime. I thank and 
commend Senators Hatch and Schumer for working with me and other 
Members of the Judiciary Committee to address some of the serious 
concerns we had with the first iteration of their bill, S. 2448, as it 
was originally introduced.
  Specifically, as introduced, S. 2448 would have over-federalized 
minor computer abuses. Currently, federal jurisdiction exists for a 
variety of computer crimes if, and only if, such criminal offenses 
result in at least $5,000 of damage or cause another specified injury, 
including the impairment of medical treatment, physical injury to a 
person or a threat to public safety. S. 2448, as introduced, would have 
eliminated the $5,000 jurisdictional threshold and thereby criminalized 
a variety of minor computer abuses, regardless of whether any 
significant harm resulted.
  For example, if an overly-curious college sophomore checks a 
professor's unattended computer to see what grade he is going to get 
and accidently deletes a file or a message, current Federal law does 
not make that conduct a crime. That conduct may be cause for discipline 
at the college, but not for the FBI to swoop in and investigate. Yet, 
under the original S. 2448, as introduced, this unauthorized access to 
the professor's computer would have constituted a federal crime.
  Another example is that of a teenage hacker, who plays a trick on a 
friend by modifying the friend's vanity Web page. Under current law, no 
federal crime has occurred. Yet, under the original S. 2448, as 
introduced, this conduct would have constituted a federal crime.
  As America Online correctly noted in a June, 2000 letter, 
``eliminating the $5,000 threshold for both criminal and civil 
violations would risk criminalizing a wide range of essentially benign 
conduct and engendering needless litigation. . . .'' Similarly, the 
Internet Alliance commented in a June, 2000 letter that ``[c]omplete 
abolition of the limit will lead to needless federal prosecution of 
often trivial offenses that can be reached under state law. . . .''
  Those provisions were overkill. Our federal laws do not need to reach 
each and every minor, inadvertent and harmless computer abuse--after 
all, each of the 50 states has its own computer crime laws. Rather, our 
federal laws need to reach those offenses for which federal 
jurisdiction is appropriate.
  Prior Congresses have declined to over-federalize computer offenses 
as originally proposed in S. 2448, as introduced, and sensibly 
determined that not all computer abuses warrant federal criminal 
sanctions. When the computer crime law was first enacted in 1984, the 
House Judiciary Committee reporting the bill stated:

       The Federal jurisdictional threshold is that there must be 
     $5,000 worth of benefit to the defendant or loss to another 
     in order to concentrate Federal resources on the more 
     substantial computer offenses that affect

[[Page S11888]]

     interstate or foreign commerce. (H.Rep. 98-894, at p. 22, 
     July 24, 1984).

  Similarly, the Senate Judiciary Committee under the chairmanship of 
Senator Thurmond, rejected suggestions in 1986 that ``the Congress 
should enact as sweeping a Federal statute as possible so that no 
computer crime is potentially uncovered.'' (S. Rep. 99-432, at p. 4, 
September 3, 1986).
  The Hatch-Leahy-Schumer substitute amendment to S. 2448, which was 
reported unanimously by the Judiciary Committee on October 5th, 
addresses those federalism concerns by retaining the $5,000 
jurisdictional threshold in current law. That Committee-reported 
substitute amendment, with the additional refinements reflected in the 
Hatch-Leahy-Schumer Internet Security Act amendment to H.R. 46, which 
the Senate considers today, makes other improvements to the original 
bill and current law, as summarized below.
  First, titles II, III, IV and V of the original bill, S. 2448, about 
which various problems had been raised, are eliminated. For example, 
title V of the original bill would have authorized the Justice 
Department to enter into Mutual Legal Assistance Treaties (MLAT) with 
foreign governments that would allow the Attorney General broad 
discretion to investigate lawful conduct in the U.S. at the request of 
foreign governments without regard to whether the conduct investigated 
violates any Federal computer crime law. In my view, that discretion 
was too broad and troubling.
  Second, the amendment includes an authorization of appropriations of 
$5 million to the Computer Crime and Intellectual Property (CCIP) 
section within the Justice Department's Criminal Division and requires 
the Attorney General to make the head of CCIP a ``Deputy Assistant 
Attorney General,'' which is not a Senate-confirmed position, in order 
to highlight the increasing importance and profile of this position. 
This authorized funding level is consistent with an amendment I 
sponsored and circulated to Members of the Judiciary Committee to 
improve S. 2448 and am pleased to see it incorporated into the Internet 
Security Act amendment to H.R. 46.
  Third, the amendment modifies section 1030 of title 18, United States 
Code, in several important ways, including providing for increased and 
enhanced penalties for serious violations of federal computer crime 
laws, clarifying the definitions of ``loss'' to ensure that the full 
costs to a hacking victim are taken into account and of ``protected 
computer'' to facilitate investigations of international computer 
crimes affecting the United States, and preserving the existing $5,000 
threshold and other jurisdictional prerequisites for violations of 
section 1030(a)(5)--i.e., no Federal crime has occurred unless the 
conduct (1) causes loss to 1 or more persons during any 1-year period 
aggregating at least $5,000 in value, (2) impairs the medical care of 
another person, (3) causes physical injury to another person, (4) 
threatens public health or safety, or (5) causes damage affecting a 
computer system used by or for a government entity in furtherance of 
the administration of justice, national defense, or national security.
  The amendment clarifies the precise elements of the offense the 
government must prove in order to establish a violation by moving these 
prerequisites from the current definition of ``damage'' to the 
description of the offense. In addition, the amendment creates a new 
category of felony violations where a hacker causes damage to a 
computer system used by or for a government entity in furtherance of 
the administration of justice, national defense, or national security.
  Currently, the Computer Fraud and Abuse Act provides for federal 
criminal penalties for those who intentionally access a protected 
computer or cause an unauthorized transmission to a protected computer 
and cause damage. ``Protected computer'' is defined to include those 
that are ``used in interstate or foreign commerce.'' See 18 U.S.C. 
1030(e)(2)(B). The amendment would clarify the definition of 
``protected computer'' to ensure that computers which are used in 
interstate or foreign commerce but are located outside of the United 
States are included within the definition of ``protected computer'' 
when those computers are used in a manner that affects interstate or 
foreign commerce or communication of this country. This will ensure 
that our government will be able to conduct domestic investigations and 
prosecutions against hackers from this country who hack into foreign 
computer systems and against those hacking though the United States to 
other foreign venues. Moreover, by clarifying the fact that a domestic 
offense exists, the United States will be able to use speedier domestic 
procedures in support of international hacker cases, and create the 
option of prosecuting such criminals in the United States.
  The amendment also adds a definition of ``loss'' to the Computer 
Fraud and Abuse Act. Current law defines the term ``damage'' to include 
impairment of the integrity or availability of data, programs, systems 
or information causing a ``loss aggregating at least $5,000 in value 
during any 1-year period to one or more individuals.'' See 18 U.S.C. 
Sec. 1030(e)(8)(A). The new definition of ``loss'' to be added as 
section 1030(e)(11) will ensure that the full costs to victims of 
responding to hacking offenses, conducting damage assessments, 
restoring systems and data to the condition they were in before an 
attack, as well as lost revenue and costs incurred because of an 
interruption in service, are all counted. This statutory definition is 
consistent with the definition of ``loss'' appended by the U.S. 
Sentencing Commission to the Federal Sentencing Guidelines (see 
U.S.S.G. Sec. 2B1.1 Commentary, Application note 2), and will help 
reconcile procedures by which prosecutors value loss for charging 
purposes and by which judges value loss for sentencing purposes. 
Getting this type of true accounting of ``loss'' is important because 
loss amounts can be used to calculate restitution and to determine the 
appropriate sentence for the perpetrator under the sentencing 
guidelines.
  Fourth, section 303(e) of the Hatch-Leahy-Schumer Internet Security 
Act amendment to H.R. 46 clarifies the grounds for obtaining damages in 
civil actions for violations of the Computer Fraud and Abuse Act. 
Current law authorizes a person who suffers ``damage or loss'' from a 
violation of section 1030 to sue the violator for compensatory damages 
or injunctive or other equitable relief, and limits the remedy to 
``economic damages'' for violations ``involving damage as defined 
in subsection (e)(8)(A),'' relating to violations of 1030(a)(5) that 
cause loss aggregating at least $5,000 during any 1-year period. 
Current law does not contain a definition of ``loss,'' which is being 
added by this amendment.

  To take account of both the new definition of ``loss'' and the 
incorporation of the requisite jurisdictional thresholds into the 
description of the offense (rather than the current definition of 
``damage''), the amendment to subsection (g) makes several changes. 
First, the amendment strikes the reference to subsection (e)(8)(A) in 
the current civil action provision and retains Congress' previous 
intent to allow civil plaintiffs only economic damages for violations 
of section 1030(a)(5) that do not also affect medical treatment, cause 
physical injury, threaten public health and safety or affect computer 
systems used in furtherance of the administration of justice, the 
national defense or national security.
  Second, the amendment clarifies that civil actions under section 
1030, and not just 1030(a)(5), are limited to conduct that involves one 
of the factors enumerated in new subsection (a)(5)(B), namely, the 
conduct (1) causes loss to 1 or more persons during any 1-year period 
aggregating at least $5,000 in value, (2) impairs the medical care of 
another person, (3) causes physical injury to another person, (4) 
threatens public health or safety, or (5) causes damage affecting a 
computer system used by or for a government entity in furtherance of 
the administration of justice, national defense, or national security. 
This clarification is consistent with judicial constructions of the 
statute, requiring proof of the $5,000 loss threshold as a prerequisite 
for civil suit, for example, under subsection 1030(a)(2)(C). See, e.g., 
America Online, Inc. v. LCGM, Inc., 46 F.Supp. 2d 444, 450 (E.D. Va. 
1998) (court granted summary judgment on claim under 1030(a)(2)(C), 
stating, ``[p]laintiff asserts that as a result of defendants' actions, 
it suffered damages exceeding $5,000, the statutory threshold 
requirement'').

[[Page S11889]]

  While proof of ``loss'' is required, this amendment preserves current 
law that civil enforcement of certain violations of section 1030 is 
available without requiring proof of ``damage,'' which is defined in 
the amendment to mean ``any impairment to the integrity or availability 
of data, a program, a system, or information.'' In fact, only 
subsection 1030(a)(5) requires proof of ``damage''; civil enforcement 
of other subsections of this law may proceed without such proof. Thus, 
only the factors enumerated in new subsection (a)(5)(B), and not its 
introductory language referring to conduct described in subsection 
(a)(5)(A), constitute threshold requirements for civil suits for 
violations of section 1030 other than subsection 1030(a)(5).
  Finally, the amendment adds a new sentence to subsection 1030(g) 
clarifying that civil actions may not be brought ``for the negligent 
design or manufacture of computer hardware, computer software, or 
firmware.''
  The Congress provided this civil remedy in the 1994 amendments to the 
Act, which I originally sponsored with Senator Gordon Humphrey, to 
enhance privacy protection for computer communications and the 
information stored on computers by encouraging institutions to improve 
computer security practices, deterring unauthorized persons from 
trespassing on computer systems of others, and supplementing the 
resources of law enforcement in combating computer crime. [See The 
Computer Abuse Amendments Act of 1990: Hearing Before the Subcomm. On 
Technology and the Law of the Senate Comm. On the Judiciary, 101st 
Cong., 2nd Sess., S. Hrg. 101-1276, at pp. 69, 88, 92 (1990); see also 
Statement of Senator Humphrey, 136 Cong. Rec. S18235 (1990) (``Given 
the Government's limited capacity to pursue all computer crime cases, 
the existence of this limited civil remedy will serve to enhance 
deterrence in this critical area.'')]. The ``new, civil remedy for 
those harmed by violations of the Computer Fraud and Abuse Act'' was 
intended to ``boost the deterrence of the statute by allowing aggrieved 
individuals to obtain relief.'' [S. Rep. No. 101-544, 101st Cong., 2d 
Sess., p. 6-7 (1990); see also Statement of Senator Leahy, 136 Cong. 
Rec. S18234 (1990)]. We certainly and expressly did not want to ``open 
the floodgates to frivolous litigation.'' [Statement of Senator Leahy, 
136 Cong. Rec. S4614 (1990)].
  At the time the civil remedy provision was added to the Computer 
Fraud and Abuse Act, this Act contained no prohibition against 
negligently causing damage to a computer through unauthorized access, 
reflected in current law, 18 U.S.C. Sec.  1030(a)(5)(C). That 
prohibition was added only with subsequent amendments made in 1996, as 
part of the National Information Infrastructure Protection Act. 
Nevertheless, the civil remedy has been interpreted in some cases to 
apply to the negligent manufacture of computer hardware or software. 
See, e.g., Shaw v. Toshiba America Information Systems, Inc., NEC, 91 
F.Supp. 2d 926 (E.D. TX 1999) (court interpreted the term transmission 
to include sale of computers with a minor design defect).
  The Hatch-Leahy-Schumer Internet Security Act amendment to subsection 
1030(g) is intended to ensure that the civil remedy is a robust option 
for private enforcement actions, while limiting its applicability to 
negligence cases that are more appropriately governed by contractual 
warranties, state tort law and consumer protection laws.
  Fifth, sections 304 and 309 of the Hatch-Leahy-Schumer Internet 
Security Act amendment to H.R. 46 authorize criminal forfeiture of 
computers, equipment, and other personal property used to violate the 
Computer Fraud and Abuse Act, as well as real and personal property 
derived from the proceeds of computer crime. Property, both real and 
personal, which is derived from proceeds traceable to a violation of 
section 1030, is currently subject to both criminal and civil 
forfeiture. See 18 U.S.C. Sec.  981(a)(1)(C) and 982(a)(2)(B). Thus, 
the amendment would clarify in section 1030 itself that forfeiture 
applies and extend the application of forfeiture to property that is 
used or intended to be used to commit or to facilitate the commission 
of a computer crime. In addition, to deter and prevent piracy, theft 
and counterfeiting of intellectual property, the section 309 of the 
amendment allows forfeiture of devices, such as replicators or other 
devices used to copy or produce computer programs to which counterfeit 
labels have been affixed.
  The criminal forfeiture provision in section 304 specifically states 
that only the ``interest of such person,'' referring to the defendant 
who committed the computer crime, is subject to forfeiture. Moreover, 
the criminal forfeiture authorized by Sections 304 and 309 is made 
expressly subject to Section 413 of the Comprehensive Drug Abuse 
Prevention and Control Act of 1970, but subsection (d) of section 413 
is expressly exempted from application to Section 304 and 309. That 
subsection (d) creates a rebuttable presumption of forfeiture in favor 
of the government where a person convicted of a felony acquired the 
property during the period that the crime was committed or within a 
reasonable time after such period and there was no likely source for 
such property other than the criminal violation. Thus, by making 
subsection (d) inapplicable, Sections 304 and 309 make it more 
difficult for the government to prove that the property should be 
forfeited.

  Sixth, unlike the version reported by the Judiciary Committee, the 
amendment does not require that prior delinquency adjudications of 
juveniles for violations of the Computer Fraud and Abuse Act be counted 
under the definition of ``conviction'' for purposes of enhanced 
penalties. This is an improvement that I urged since juvenile 
adjudications simply are not criminal convictions. Juvenile proceedings 
are more informal than adult prosecutions and are not subject to the 
same due process protections. Consequently, counting juvenile 
adjudications as a prior conviction for purposes of the recidivist 
sanctions under the amendment would be unduly harsh and unfair. In any 
event, prior juvenile delinquency adjudications are already subject to 
sentencing enhancements under certain circumstances under the 
Sentencing Guidelines. See, e.g., U.S.S.G. Sec.  411.2(d) (upward 
adjustments in sentences required for each juvenile sentence to 
confinement of at least sixty days and for each juvenile sentence 
imposed within five years of the defendant's commencement of instant 
offense).
  Seventh, the amendment changes a current directive to the Sentencing 
Commission enacted as section 805 of the Antiterrorism and Effective 
Death Penalty Act of 1996, P.L. 104-132, that imposed a 6-month 
mandatory minimum sentence for any conviction of the sections 
1030(a)(4) or (a)(5) of title 18, United States code. The 
Administration has noted that ``[i]n some instances, prosecutors have 
exercised their discretion and elected not to charge some defendants 
whose actions otherwise would qualify them for prosecution under the 
statute, knowing that the result would be mandatory imprisonment.'' 
Clearly, mandatory imprisonment is not always the most appropriate 
remedy for a federal criminal violation, and the ironic result of this 
``get tough'' proposal has been to discourage prosecutions that might 
otherwise have gone forward. The amendment eliminates that mandatory 
minimum term of incarceration for misdemeanor and less serious felony 
computer crimes.
  Eighth, section 310 of the amendment directs the Sentencing 
Commission to review and, where appropriate, adjust sentencing 
guidelines for computer crimes to address a variety of factors, 
including to ensure that the guidelines provide sufficiently stringent 
penalties to deter and punish persons who intentionally use encryption 
in connection with the commission or concealment of criminal acts.
  The Sentencing Guidelines already provide for enhanced penalties when 
persons obstruct or impede the administration of justice, see U.S.S.G. 
Sec. 3C1.1, or engage in more than minimal planning, see U.S.S.G. 
Sec. 2B1.1(b)(4)(A). As the use of encryption technology becomes more 
widespread, additional guidance from the Sentencing Commission would be 
helpful to determine the circumstances when such encryption use would 
warrant a guideline adjustment. For example, if a defendant employs an 
encryption product that works automatically and transparently with a 
telecommunications service or software product, an enhancement for use 
of encryption may not be appropriate, while the deliberate use of

[[Page S11890]]

encryption as part of a sophisticated and intricate scheme to conceal 
criminal activity and make the offense, or its extent, difficult to 
detect, may warrant a guideline enhancement either under existing 
guidelines or a new guideline.
  Ninth, the Hatch-Leahy-Schumer Internet Security Act amendment to 
H.R. 46 would eliminate certain statutory restrictions on the authority 
of the United States Secret Service ("Secret Service''). Under current 
law, the Secret Service is authorized to investigate offenses under six 
designated subsections of 18 U.S.C. Sec.  1030, subject to agreement 
between the Secretary of the Treasury and the Attorney General: 
subsections (a)(2)(A) (illegally accessing a computer and obtaining 
financial information); (a)(2)(B) (illegally accessing a computer and 
obtaining information from a department or agency of the United 
States); (a)(3) (illegally accessing a non-public computer of a 
department or agency of the United States either exclusively used by 
the United States or used by the United States and the conduct affects 
that use by or for the United States); (a)(4) (accessing a protected 
computer with intent to defraud and thereby furthering the fraud and 
obtaining a thing of value, unless the object of the fraud and the 
thing obtained consists only of the use of the computer and the value 
of such use is not more than $5,000 in a one-year period); (a)(5) 
(knowingly causing the transmission of a program, information, code or 
command and thereby intentionally and without authorization causing 
damage to a protected computer; and illegally accessing a protected 
computer and causing damage recklessly or otherwise); and (a)(6) 
(trafficking in a password with intent to defraud).
  Under current law, the Secret Service is not authorized to 
investigate offenses under subsection (a)(1) (accessing a computer and 
obtaining information relating to national security with reason to 
believe the information could be used to the injury of the United 
States or to the advantage of a foreign nation and willfully retaining 
or transmitting that information or attempting to do so); (a)(2)(C) 
(illegally accessing a protected computer and obtaining information 
where the conduct involves an interstate or foreign communication); and 
(a)(7) (transmitting a threat to damage a protected computer with 
intent to extort).
  The Internet Security Act removes these limitations on the authority 
of the Secret Service and authorizes the Secret Service to investigate 
any offense under Section 1030 relating to its jurisdiction under 18 
U.S.C. Sec.  3056 and subject to agreement between the Secretary of the 
Treasury and the Attorney General. This provision also makes clear that 
the FBI retains primary authority to investigate offenses under 
subsection 1030(a)(1).
  Prior to 1996 amendments to the Computer Fraud and Abuse Act, the 
Secret Service was authorized to investigate all violations of Section 
1030. According to the 1996 Committee Reports of the 104th Congress, 
2nd Session, the 1996 amendments attempted to concentrate the Secret 
Service's jurisdiction on certain subsections considered to be within 
the Secret Service's traditional jurisdiction and not grant authority 
in matters with a national security nexus. According to the 
Administration, which first proposed the elimination of these statutory 
restrictions in connection with transmittal of its comprehensive crime 
bill, the ``21st Century Law Enforcement and Public Safety Act,'' 
however, these specific enumerations of investigative authority ``have 
the potential to complicate investigations and impede interagency 
cooperation.'' (See Section-by-section Analysis, SEC. 3082, for ``21st 
Century Law Enforcement and Public Safety Act'').

  The current restrictions, for example, risk hindering the Secret 
Service from investigating ``hacking'' into White House computers or 
investigating threats against the President that may be delivered by 
such a ``hacker,'' and fulfilling its mission to protect financial 
institutions and the nation's financial infrastructure. The provision 
thus modifies existing law to restore the Secret Service's authority to 
investigate violations of Section 1030, leaving it to the Departments 
of Treasury and Justice to determine between them how to allocate 
workload and particular cases. This arrangement is consistent with 
other jurisdictional grants of authority to the Secret Service. See, 
e.g., 18 U.S.C. Sec. Sec.  1029(d), 3056(b)(3).
  Tenth, section 307 of the Hatch-Leahy-Schumer Internet Security Act 
amendment would provide an additional defense to civil actions relating 
to preserving records in response to government requests. Current law 
authorizes civil actions and criminal liability for unauthorized 
interference with or disclosures of electronically stored wire or 
electronic communications under certain circumstances. 18 U.S.C. 
Sec. Sec.  2701, et seq. A provision of that statutory scheme makes 
clear that it is a complete defense to civil and criminal liability if 
the person or entity interfering with or attempting to disclose a 
communication does so in good faith reliance on a court warrant or 
order, grand jury subpoena, legislative or statutory authorization. 18 
U.S.C. Sec.  2707(e)(1).
  Current law, however, does not address one scenario under which a 
person or entity might also have a complete defense. A provision of the 
same statutory scheme currently requires providers of wire or 
electronic communication services and remote computing services, upon 
request of a governmental entity, to take all necessary steps to 
preserve records and other evidence in its possession for a renewal 
period of 90 days pending the issuance of a court order or other 
process requiring disclosure of the records or other evidence. 18 
U.S.C. Sec.  2703(f). Section 2707(e)(1), which describes the 
circumstances under which a person or entity would have a complete 
defense to civil or criminal liability, fails to identify good faith 
reliance on a governmental request pursuant to Section 2703(f) as 
another basis for a complete defense. Section 307 modifies current law 
by addressing this omission and expressly providing that a person or 
entity who acts in good faith reliance on a governmental request 
pursuant to Section 2703(f) also has a complete defense to civil and 
criminal liability.
  Finally, the bill authorizes construction and operation of a National 
Cyber Crime Technical Support Center and 10 regional computer forensic 
labs that will provide education, training, and forensic examination 
capabilities for State and local law enforcement officials charged with 
investigating computer crimes. The section authorizes a total of $100 
million for FY 2001, of which $20 million shall be available solely for 
the 10 regional labs and would complement the state computer crime 
grant bill, S. 1314, with which this bill is offered.


                           Amendment No. 4366

(Purpose: To enhance computer crime enforcement and Internet security, 
                        and for other purposes)

  Mr. STEVENS. Mr. President, Senator Hatch has an amendment which is 
at the desk.
  The PRESIDING OFFICER. The clerk will report.
  The assistant legislative clerk read as follows:

       The Senator from Alaska [Mr. Stevens], for Mr. Hatch, 
     proposes an amendment numbered 4366.

  (The text of the amendment is printed in today's Record under 
``Amendments Submitted.'')
  Mr. STEVENS. Mr. President, I ask unanimous consent that the 
amendment be agreed to.
  The PRESIDING OFFICER. Without objection, it is so ordered.
  The amendment (No. 4366) was agreed to.
  Mr. STEVENS. Mr. President, I ask unanimous consent that the bill, as 
amended, be read the third time and passed, the motion to reconsider be 
laid upon the table, the amendment to the title be agreed to, and any 
statements relating to the bill be printed in the Record.
  The PRESIDING OFFICER. Without objection, it is so ordered.
  The bill (H.R. 46), as amended, was read the third time and passed.
  The title was amended so as to read:

       To provide a national medal for public safety officers who 
     act with extraordinary valor above and beyond the call of 
     duty, to enhance computer crime enforcement and Internet 
     security, and for other purposes.

                          ____________________