[House Report 106-876]
[From the U.S. Government Publishing Office]
106th Congress Report
HOUSE OF REPRESENTATIVES
2d Session 106-876
======================================================================
COMPUTER SECURITY ENHANCEMENT ACT OF 2000
_______
September 21, 2000.--Committed to the Committee of the Whole House on
the State of the Union and ordered to be printed
_______
Mr. Sensenbrenner, from the Committee on Science, submitted the
following
R E P O R T
[To accompany H.R. 2413]
[Including cost estimate of the Congressional Budget Office]
The Committee on Science, to whom was referred the bill (H.R.
2413) to amend the National Institute of Standards and
Technology Act to enhance the ability of the National Institute
of Standards and Technology to improve computer security, and
for other purposes, having considered the same, report
favorably thereon with an amendment and recommend that the bill
as amended do pass.
CONTENTS
Page
I. Amendment.......................................................2
II. Purpose of the Bill.............................................6
III. Background and Need for the Legislation.........................6
IV. Summary of Hearings.............................................7
V. Committee Actions..............................................11
VI. Summary of Major Provisions of the Bill........................11
VII. Section-By-Section Analysis (By Title and Section)/Committee
Views..........................................................12
VIII. Cost Estimate..................................................18
IX. Congressional Budget Office Cost Estimate......................18
X. Compliance with Public Law 104-4 (Unfunded Mandates)...........19
XI. Committee Oversight Findings and Recommendations...............19
XII. Oversight Findings and Recommendations by the Committee on
Government Reform and Oversight................................20
XIII. Constitutional Authority Statement.............................20
XIV. Federal Advisory Committee Statement...........................20
XV. Congressional Accountability Act...............................20
XVI. Statement of Preemption of State, Local, or Tribal Law.........20
XVII. Changes in Existing Law Made by the Bill, As Reported..........20
XVIII.Committee Recommendations......................................23
XIX. Proceedings of Subcommittee Markup.............................24
XX. Proceedings of Full Committee Markup...........................59
I. Amendment
The amendment is as follows:
Strike all after the enacting clause and insert the
following:
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Computer Security Enhancement Act of
2000''.
SEC. 2. FINDINGS AND PURPOSES.
(a) Findings.--The Congress finds the following:
(1) The National Institute of Standards and Technology has
responsibility for developing standards and guidelines needed
to ensure the cost-effective security and privacy of sensitive
information in Federal computer systems.
(2) The Federal Government has an important role in ensuring
the protection of sensitive, but unclassified, information
controlled by Federal agencies.
(3) Technology that is based on the application of
cryptography exists and can be readily provided by private
sector companies to ensure the confidentiality, authenticity,
and integrity of information associated with public and private
activities.
(4) The development and use of encryption technologies by
industry should be driven by market forces rather than by
Government imposed requirements.
(b) Purposes.--The purposes of this Act are to--
(1) reinforce the role of the National Institute of Standards
and Technology in ensuring the security of unclassified
information in Federal computer systems; and
(2) promote technology solutions based on private sector
offerings to protect the security of Federal computer systems.
SEC. 3. VOLUNTARY STANDARDS FOR PUBLIC KEY MANAGEMENT INFRASTRUCTURE.
Section 20(b) of the National Institute of Standards and Technology
Act (15 U.S.C. 278g-3(b)) is amended--
(1) by redesignating paragraphs (2), (3), (4), and (5) as
paragraphs (3), (4), (8), and (9), respectively; and
(2) by inserting after paragraph (1) the following new
paragraph:
``(2) upon request from the private sector, to assist in
establishing voluntary interoperable standards, guidelines, and
associated methods and techniques to facilitate and expedite
the establishment of non-Federal management infrastructures for
public keys that can be used to communicate with and conduct
transactions with the Federal Government;''.
SEC. 4. SECURITY OF FEDERAL COMPUTERS AND NETWORKS.
Section 20(b) of the National Institute of Standards and Technology
Act (15 U.S.C. 278g-3(b)), as amended by section 3 of this Act, is
further amended by inserting after paragraph (4), as so redesignated by
section 3(1) of this Act, the following new paragraphs:
``(5) except for national security systems, as defined in
section 5142 of Public Law 104-106 (40 U.S.C. 1452), to provide
guidance and assistance to Federal agencies for protecting the
security and privacy of sensitive information in interconnected
Federal computer systems, including identification of
significant risks thereto;
``(6) to promote compliance by Federal agencies with existing
Federal computer information security and privacy guidelines;
``(7) in consultation with appropriate Federal agencies,
assist Federal response efforts related to unauthorized access
to Federal computer systems;''.
SEC. 5. COMPUTER SECURITY IMPLEMENTATION.
Section 20 of the National Institute of Standards and Technology Act
(15 U.S.C. 278g-3) is further amended--
(1) by redesignating subsections (c) and (d) as subsections
(e) and (f), respectively; and
(2) by inserting after subsection (b) the following new
subsection:
``(c)(1) In carrying out subsection (a)(2) and (3), the Institute
shall--
``(A) emphasize the development of technology-neutral policy
guidelines for computer security practices by the Federal
agencies;
``(B) promote the use of commercially available products,
which appear on the list required by paragraph (2), to provide
for the security and privacy of sensitive information in
Federal computer systems;
``(C) develop qualitative and quantitative measures
appropriate for assessing the quality and effectiveness of
information security and privacy programs at Federal agencies;
``(D) perform evaluations and tests at Federal agencies to
assess existing information security and privacy programs;
``(E) promote development of accreditation procedures for
Federal agencies based on the measures developed under
subparagraph (C);
``(F) if requested, consult with and provide assistance to
Federal agencies regarding the selection by agencies of
security technologies and products and the implementation of
security practices; and
``(G)(i) develop uniform testing procedures suitable for
determining the conformance of commercially available security
products to the guidelines and standards developed under
subsection (a)(2) and (3);
``(ii) establish procedures for certification of private
sector laboratories to perform the tests and evaluations of
commercially available security products developed in
accordance with clause (i); and
``(iii) promote the testing of commercially available
security products for their conformance with guidelines and
standards developed under subsection (a)(2) and (3).
``(2) The Institute shall maintain and make available to Federal
agencies and to the public a list of commercially available security
products that have been tested by private sector laboratories certified
in accordance with procedures established under paragraph (1)(G)(ii),
and that have been found to be in conformance with the guidelines and
standards developed under subsection (a)(2) and (3).
``(3) The Institute shall annually transmit to the Congress, in an
unclassified format, a report containing--
``(A) the findings of the evaluations and tests of Federal
computer systems conducted under this section during the 12
months preceding the date of the report, including the
frequency of the use of commercially available security
products included on the list required by paragraph (2);
``(B) the planned evaluations and tests under this section
for the 12 months following the date of the report; and
``(C) any recommendations by the Institute to Federal
agencies resulting from the findings described in subparagraph
(A), and the response by the agencies to those
recommendations.''.
SEC. 6. COMPUTER SECURITY REVIEW, PUBLIC MEETINGS, AND INFORMATION.
Section 20 of the National Institute of Standards and Technology Act
(15 U.S.C. 278g-3), as amended by this Act, is further amended by
inserting after subsection (c), as added by section 5 of this Act, the
following new subsection:
``(d)(1) The Institute shall solicit the recommendations of the
Computer System Security and Privacy Advisory Board, established by
section 21, regarding standards and guidelines that are being
considered for submittal to the Secretary in accordance with subsection
(a)(4). The recommendations of the Board shall accompany standards and
guidelines submitted to the Secretary.
``(2) There are authorized to be appropriated to the Secretary
$1,030,000 for fiscal year 2001 and $1,060,000 for fiscal year 2002 to
enable the Computer System Security and Privacy Advisory Board,
established by section 21, to identify emerging issues related to
computer security, privacy, and cryptography and to convene public
meetings on those subjects, receive presentations, and publish reports,
digests, and summaries for public distribution on those subjects.''.
SEC. 7. LIMITATION ON PARTICIPATION IN REQUIRING ENCRYPTION STANDARDS.
Section 20 of the National Institute of Standards and Technology Act
(15 U.S.C. 278g-3), as amended by this Act, is further amended by
adding at the end the following new subsection:
``(g) The Institute shall not promulgate, enforce, or otherwise adopt
standards, or carry out activities or policies, for the Federal
establishment of encryption standards required for use in computer
systems other than Federal Government computer systems.''.
SEC. 8. MISCELLANEOUS AMENDMENTS.
Section 20 of the National Institute of Standards and Technology Act
(15 U.S.C. 278g-3), as amended by this Act, is further amended--
(1) in subsection (b)(9), as so redesignated by section 3(1)
of this Act, by inserting ``to the extent that such
coordination will improve computer security and to the extent
necessary for improving such security for Federal computer
systems'' after ``Management and Budget)'';
(2) in subsection (e), as so redesignated by section 5(1) of
this Act, by striking ``shall draw upon'' and inserting in lieu
thereof ``may draw upon'';
(3) in subsection (e)(2), as so redesignated by section 5(1)
of this Act, by striking ``(b)(5)'' and inserting in lieu
thereof ``(b)(8)''; and
(4) in subsection (f)(1)(B)(i), as so redesignated by section
5(1) of this Act, by inserting ``and computer networks'' after
``computers''.
SEC. 9. FEDERAL COMPUTER SYSTEM SECURITY TRAINING.
Section 5(b) of the Computer Security Act of 1987 (40 U.S.C. 759
note) is amended--
(1) by striking ``and'' at the end of paragraph (1);
(2) by striking the period at the end of paragraph (2) and
inserting in lieu thereof ``; and''; and
(3) by adding at the end the following new paragraph:
``(3) to include emphasis on protecting sensitive information
in Federal databases and Federal computer sites that are
accessible through public networks.''.
SEC. 10. COMPUTER SECURITY FELLOWSHIP PROGRAM.
There are authorized to be appropriated to the Secretary of Commerce
$500,000 for fiscal year 2001 and $500,000 for fiscal year 2002 for the
Director of the National Institute of Standards and Technology for
fellowships, subject to the provisions of section 18 of the National
Institute of Standards and Technology Act (15 U.S.C. 278g-1), to
support students at institutions of higher learning in computer
security. Amounts authorized by this section shall not be subject to
the percentage limitation stated in such section 18.
SEC. 11. STUDY OF PUBLIC KEY INFRASTRUCTURE BY THE NATIONAL RESEARCH
COUNCIL.
(a) Review by National Research Council.--Not later than 90 days
after the date of the enactment of this Act, the Secretary of Commerce
shall enter into a contract with the National Research Council of the
National Academy of Sciences to conduct a study of public key
infrastructures for use by individuals, businesses, and government.
(b) Contents.--The study referred to in subsection (a) shall--
(1) assess technology needed to support public key
infrastructures;
(2) assess current public and private plans for the
deployment of public key infrastructures;
(3) assess interoperability, scalability, and integrity of
private and public entities that are elements of public key
infrastructures;
(4) make recommendations for Federal legislation and other
Federal actions required to ensure the national feasibility and
utility of public key infrastructures; and
(5) address such other matters as the National Research
Council considers relevant to the issues of public key
infrastructure.
(c) Interagency Cooperation With Study.--All agencies of the Federal
Government shall cooperate fully with the National Research Council in
its activities in carrying out the study under this section, including
access by properly cleared individuals to classified information if
necessary.
(d) Report.--Not later than 18 months after the date of the enactment
of this Act, the Secretary of Commerce shall transmit to the Committee
on Science of the House of Representatives and the Committee on
Commerce, Science, and Transportation of the Senate a report setting
forth the findings, conclusions, and recommendations of the National
Research Council for public policy related to public key
infrastructures for use by individuals, businesses, and government.
Such report shall be submitted in unclassified form.
(e) Authorization of Appropriations.--There are authorized to be
appropriated to the Secretary of Commerce $450,000 for fiscal year
2001, to remain available until expended, for carrying out this
section.
SEC. 12. PROMOTION OF NATIONAL INFORMATION SECURITY.
The Under Secretary of Commerce for Technology shall--
(1) promote an increased use of security techniques, such as
risk assessment, and security tools, such as cryptography, to
enhance the protection of the Nation's information
infrastructure;
(2) establish a central repository of information for
dissemination to the public to promote awareness of information
security vulnerabilities and risks; and
(3) promote the development of the national, standards-based
infrastructure needed to support government, commercial, and
private uses of encryption technologies for confidentiality and
authentication.
SEC. 13. ELECTRONIC AUTHENTICATION INFRASTRUCTURE.
(a) Electronic Authentication Infrastructure.--
(1) Guidelines and standards.--Not later than 18 months after
the date of the enactment of this Act, the Director, in
consultation with industry and appropriate Federal agencies,
shall develop electronic authentication infrastructure
guidelines and standards for use by Federal agencies to assist
those agencies to effectively select and utilize electronic
authentication technologies in a manner that is--
(A) adequately secure to meet the needs of those
agencies and their transaction partners; and
(B) interoperable, to the maximum extent possible.
(2) Elements.--The guidelines and standards developed under
paragraph (1) shall include--
(A) protection profiles for cryptographic and
noncryptographic methods of authenticating identity for
electronic authentication products and services;
(B) a core set of interoperability specifications for
the Federal acquisition of electronic authentication
products and services; and
(C) validation criteria to enable Federal agencies to
select cryptographic electronic authentication products
and services appropriate to their needs.
(3) Coordination with national policy panel.--The Director
shall ensure that the development of guidelines and standards
with respect to cryptographic electronic authentication
products and services under this subsection is carried out in
consultation with the National Policy Panel for Digital
Signatures established under subsection (e).
(4) Revisions.--The Director shall periodically review the
guidelines and standards developed under paragraph (1) and
revise them as appropriate.
(b) Listing of Validated Products.--Not later than 30 months after
the date of the enactment of this Act, and thereafter, the Director
shall maintain and make available to Federal agencies and to the public
a list of commercially available electronic authentication products,
and other such products used by Federal agencies, evaluated as
conforming with the guidelines and standards developed under subsection
(a).
(c) Specifications for Electronic Certification and Management
Technologies.--
(1) Specifications.--The Director shall, as appropriate,
establish core specifications for particular electronic
certification and management technologies, or their components,
for use by Federal agencies.
(2) Evaluation.--The Director shall advise Federal agencies
on how to evaluate the conformance with the specifications
established under paragraph (1) of electronic certification and
management technologies, developed for use by Federal agencies
or available for such use.
(3) Maintenance of list.--The Director shall maintain and
make available to Federal agencies a list of electronic
certification and management technologies evaluated as
conforming to the specifications established under paragraph
(1).
(d) Reports.--Not later than 18 months after the date of the
enactment of this Act, and annually thereafter, the Director shall
transmit to the Congress a report that includes--
(1) a description and analysis of the utilization by Federal
agencies of electronic authentication technologies; and
(2) an evaluation of the extent to which Federal agencies'
electronic authentication infrastructures conform to the
guidelines and standards developed under subsection (a)(1).
(e) National Policy Panel for Digital Signatures.--
(1) Establishment.--Not later than 90 days after the date of
the enactment of this Act, the Under Secretary shall establish
a National Policy Panel for Digital Signatures. The Panel shall
be composed of government, academic, and industry technical and
legal experts on the implementation of digital signature
technologies, State officials, including officials from States
which have enacted laws recognizing the use of digital
signatures, and representative individuals from the interested
public.
(2) Responsibilities.--The Panel shall serve as a forum for
exploring all relevant factors associated with the development
of a national digital signature infrastructure based on uniform
guidelines and standards to enable the widespread availability
and use of digital signature systems. The Panel shall develop--
(A) model practices and procedures for certification
authorities to ensure the accuracy, reliability, and
security of operations associated with issuing and
managing digital certificates;
(B) guidelines and standards to ensure consistency
among jurisdictions that license certification
authorities; and
(C) audit procedures for certification authorities.
(3) Coordination.--The Panel shall coordinate its efforts
with those of the Director under subsection (a).
(4) Administrative support.--The Under Secretary shall
provide administrative support to enable the Panel to carry out
its responsibilities.
(5) Report.--Not later than 1 year after the date of the
enactment of this Act, the Under Secretary shall transmit to
the Congress a report containing the recommendations of the
Panel.
(f) Definitions.--For purposes of this section--
(1) the term ``certification authorities'' means issuers of
digital certificates;
(2) the term ``digital certificate'' means an electronic
document that binds an individual's identity to the
individual's key;
(3) the term ``digital signature'' means a mathematically
generated mark utilizing key cryptography techniques that is
unique to both the signatory and the information signed;
(4) the term ``digital signature infrastructure'' means the
software, hardware, and personnel resources, and the
procedures, required to effectively utilize digital
certificates and digital signatures;
(5) the term ``electronic authentication'' means
cryptographic or noncryptographic methods of authenticating
identity in an electronic communication;
(6) the term ``electronic authentication infrastructure''
means the software, hardware, and personnel resources, and the
procedures, required to effectively utilize electronic
authentication technologies;
(7) the term ``electronic certification and management
technologies'' means computer systems, including associated
personnel and procedures, that enable individuals to apply
unique digital signatures to electronic information;
(8) the term ``protection profile'' means a list of security
functions and associated assurance levels used to describe a
product; and
(9) the term ``Under Secretary'' means the Under Secretary of
Commerce for Technology.
SEC. 14. SOURCE OF AUTHORIZATIONS.
There are authorized to be appropriated to the Secretary of Commerce
$7,000,000 for fiscal year 2001 and $8,000,000 for fiscal year 2002,
for the National Institute of Standards and Technology to carry out
activities authorized by this Act for which funds are not otherwise
specifically authorized to be appropriated by this Act.
II. Purpose of the Bill
The purpose of the bill is to update the Computer Security
Act of 1987 to improve computer security for federal civilian
agencies and the private sector.
III. Background and Need for the Legislation
The Computer Security Act of 1987 gave authority over
computer and communication security standards in federal
civilian agencies to NIST. The Computer Security Enhancement
Act of 2000 strengthens that authority and directs funds to
implement practices and procedures which will ensure that the
federal standards setting process remains open to public input
and analysis and that will provide guidance and assistance on
protection of electronic information to federal civilian
agencies. H.R. 2413 promotes open and public discussion, as
well as the use of commercially available products to meet the
information security needs of the federal civilian agencies.
Since 1993, the General Accounting Office (GAO) has issued
over 35 reports describing serious information security
weaknesses at major federal agencies. In 1999, GAO reported
that during the previous 2 years serious information security
control weaknesses had been reported for most of the federal
agencies. Recently, GAO gave the federal government an overall
grade of D minus for its computer security efforts.
Much has changed in the years since the Computer Security
Act of 1987 was enacted. The proliferation of networked
systems, the Internet, and web access are just a few of the
dramatic advances in information technology that have occurred.
The Computer Security Enhancement Act of 2000 addresses these
changes and provides for greater security for the federal
civilian agencies that base their procurement decisions for
computer security hardware and software on NIST standards. H.R.
2413 also promotes the use of commercially available products
and encourages an open exchange of information between NIST and
the private sector. This renewed emphasis on open discussion
should help facilitate better security in all communities.
IV. Summary of Hearings
On September 30, 1999, the Subcommittee on Technology held
a hearing to review H.R. 2413, the Computer Security
Enhancement Act of 2000, legislation introduced by Chairman
Sensenbrenner, Representatives Morella and Gordon.
Witnesses included Mr. Raymond Kammer, Director, National
Institute of Standards and Technology; Mr. Keith Rhodes,
Director, Office of Computer and Information, Technology
Assessment, U.S. General Accounting Office; Mr. Harris Miller,
President, Information Technology Association of America; and
Dr. George Trubow, Professor and Director, Center for
Information Technology and Privacy Law, The John Marshall Law
School and Member, Computer System Security and Privacy
Advisory Board (CSSPAB), NIST.
Mr. Kammer testifying on behalf of the National Institute
of Standards and Technology, stated that NIST's computer
security program focuses on standards and guidelines, public
key infrastructure and security research. Mr. Kammer noted that
the President has recently requested an additional $39M in FY
2000 for initiatives proposed to protect critical
infrastructure, of which $5M would be for NIST to establish an
Expert Review Team to assist Government-wide agencies in
adhering to Federal computer security requirements. NIST would
consult with OMB and NSA on the team's plan to protect computer
security for Federal agencies. Two million would fund a 15
member team responsible for helping agencies identify
vulnerabilities, plan secure systems and implement critical
infrastructure plans. Three million would establish an
operational fund at NIST for computer security projects among
Federal agencies. Projects would include independent
vulnerability assessments, computer intrusion drill and
emergency funds to cover security fixes for systems identified
to have unacceptable risks.
Mr. Rhodes, testifying on behalf of General Accounting
Office (GAO), stated that H.R. 2413 aims to reinforce the role
of NIST, whose mission is to provide guidance and technical
assistance to government and industry to protect unclassified
information systems. Mr. Rhodes discussed: (1) the urgent need
to strengthen computer security across the Federal Government;
(2) the current and future privacy concerns with any computer
security legislation, (3) GAO's views on the proposed act, and
(4) what can be done to further strengthen security program
management at federal agencies. According to Rhodes, it is
imperative that the Federal Government swiftly implement long-
term solutions both at individual agencies and government-wide
to protect systems and sensitive data. He noted that the need
to protect sensitive data and systems must be weighed against
cost, feasibility, privacy and security interests of citizens
and private businesses as well as national security and law
enforcement agencies. Without computer security, privacy cannot
be assured. Without agreement among users, businesses, law
enforcement, national security and other authorities on
requirements, there is no way to implement new technology or to
establish standards that will be universally accepted. Finally,
Mr. Rhodes stated that it is important to ensure that NIST
retains the ability to develop security standards for
unclassified data and decide which industry standards are
appropriate for Federal agencies and that the agencies
consistently implement such standards.
Mr. Harris, testifying on behalf of the ITAA, stated that
his association and its members support both goals of H.R.
2413, to assist NIST in meeting the computer security needs of
Federal agencies and to allow the Federal Government through
NIST to harness the ingenuity of the private sector to help
address its computer security needs. He noted that computer
security solutions should be industry-led. Mr. Harris
recognized that great opportunities for collaboration between
Federal Government and private industry currently exist and
that there is a need for information security computer
specialists and additional resources. Finally, Mr. Harris
stated there is a need for authentication through digital
signatures and a public key infrastructure.
Profesor Trubow, testifying on behalf of the Computer
System Security and Privacy Advisory Board (CSSPAB), warned
that for the Board to remain effective, it should maintain its
role as an advisory board. He noted that it is appropriate for
the board to be asked for its advice and wisdom. In his
opinion, the board supports the goal of H.R. 2413 to expand
NIST's activities in developing and promoting the use of
information system security technologies. He noted that
attention to privacy must not be overlooked. Finally, Professor
Trubow recommended that ``privacy'' be inserted in the bill in
several areas.
On April 15, 1999, the Subcommittee on Technology held a
hearing on ``The Melissa Virus: Inoculating Our Information
Technology from Emerging Threats.'' The hearing was held to
review computer security threats specifically computer viruses.
Witnesses included: Mr. Raymond Kammer, Director, National
Institutes of Standards and Technology, Mr. Michael Vatis,
Director, National Infrastructure and Protection Center, FBI,
Dr. Richard Pethia, Director, CERT Coordination Center,
Carnegie Mellon University Software Engineering Institute, and
Mr. Keith Rhodes, Technical Director, Office of the Chief
Scientist, U.S. General Accounting Office.
Mr. Raymond Kammer, Director, National Institutes of
Standards and Technology, testified that the Melissa virus is
what is known as a denial of service attack, whereby servers
and routers are literally overwhelmed by e-mail. Mr. Kammer
stressed that we as a nation must maintain a proper perspective
in developing computer security solutions and not target the
problem of the moment. Mr. Kammer stated that NIST has taken a
broad perspective and that the agency has several initiatives
underway to strengthen the IT security infrastructure of the
U.S. economy.
Mr. Michael Vatis, Director, National Infrastructure and
Protection Center, FBI, testified that the Melissa virus is a
macro virus spread through Microsoft Word 97 or Word 2000 e-
mail attachments. He explained that the problem with this
particular virus was its ability to spread quickly. Mr. Vatis
moved on to state that we are fortunate this virus did not do
more damage than it did. However, he added that its occurrence
should serve as a wake up call for both the government and the
private sector, because the virus exploited known
vulnerabilities. Mr. Vatis stated that the notifications and
information provided by the NIPC, CERT, and others demonstrated
the value of cooperative efforts by the private and government
sectors.
Dr. Richard Pethia, Director, CERT Coordination Center,
Carnegie Mellon University Software Engineering Institute,
stated that the Melissa virus was a warning siren of the
increased vulnerability of our networks. He believes that the
press acted responsibly in reporting the outbreak. Dr. Pethia
presumes that there will be a need in the future for enhanced
incident response capability, faster communications, better
analytical tools and techniques to solve this problem. He
contends that if we have multiple outbreaks that spread at
Internet speed, we would not be able to control the virus. He
reiterates that real solutions in the long term can only come
from improvements in technology. Along with virus-proof
software, there is a need to make use of encryption technology
in the form of digital signatures so those messages can be
authenticated.
Mr. Keith Rhodes, Technical Director, Office of the Chief
Scientist, U.S. General Accounting Office testified that the
Melissa virus disrupted the operations of thousands of
companies and some government agencies, but did not permanently
damage systems and did not compromise government data. He
discussed the broader implications of the Melissa virus
including how quickly the virus proliferated due to the
extensive connectivity of today's networks. He believes that
the next virus will propagate faster, do more damage and be
more difficult to detect and to counter. He also claims that it
is imperative that Federal agencies and the government
implement long-term solutions to protect systems and sensitive
data. Furthermore, Mr. Rhodes is a supporter of the GAO's
Information Security Best Practice guides. They offer a
framework for agencies to follow. Sustained government-wide
leadership is needed to ensure that executives understand
risks, monitor agency performs and resolve issues affecting
multiple agencies.
On May 10, 2000 the Subcommittee on Technology held a
hearing entitled, ``The Love Bug Virus: Protecting Lovesick
Computers from Malicious Attack.'' The hearing examined the
features of the ``love bug'' computer virus, explored its
impact on the Federal Government and the private sector, and
examined possible solutions and preventative actions
individuals and organizations should take to prevent emerging
threats form impacting information technology systems and
networks.
Witnesses included: Mr. Keith Rhodes, Technical Director,
Office of the Chief Scientist, U.S. General Accounting Office;
Mr. Harris Miller, President, Information Technology
Association of America; Ms. Sandra England, Senior Vice
President, McAfee--A Network Associates Company; Mr. Peter
Tippett, Chief Technology Officer, ICSA.net.
Mr. Keith Rhodes, Technical Director, Office of the Chief
Scientist, U.S. General Accounting Office, stated that the
world does not practice safe computing. He described how the
``I Love You'' virus worked. He noted that there were 14
variances of this virus some even more damaging. The Love Bug
hit many large corporations such as AT&T, TWA, Ford and the
Washington Post, ABC News, British Parliament, the IMF and at
least 14 other United States Federal Agencies. These viruses
were spreading faster due to the high dependency on our network
systems. Mr. Rhodes claims that there is no silver bullet that
will stop the infection of viruses. Therefore, agencies inside
and outside the government must increase awareness, ensure that
existing controls are operating effectively, ensure that
software patches are brought up to date, use automated scanning
and testing tools to quickly identify problems and be sure that
common vulnerabilities are addressed.
Mr. Harris Miller, President, Information Technology
Association of America, testified that cyber crimes are given
less priority than other types of crime since there is no
actual physical violence. This attitude must change and the
government agencies need to make information security a much
higher priority. He stated that information sharing is the key
challenge. He is working to create an information-sharing
mechanism with over 100 IT companies. ITAA will host the first
global security summit in Washington, D.C. on October 16 and
17. He hopes to establish the same type of international
collaboration that existed with the Y2K bug. ITAA is also
working with the Department of Justice on the Cybercitizen
Partnership to help promote cyber ethics. In his closing
remarks he stated that Cyber-crime must not become an accepted
practice.
Ms. Sandra England, Senior Vice President, McAfee--A
Network Associates Company testified that the McAfee's
Emergency response team, AVERT, immediately responded to the
outbreak of the ``I Love You'' virus. They were able to
dispense a cure within a couple hours of its first detection.
She went on to add that many viruses are detected on a daily
basis and last year alone there were $12 billion in damages due
to various viruses. Ms. England claims that even though viruses
attack on a more frequent basis, not much is being done to
internal policies to respond to these new attacks. The actual
cost from the viruses is hard to assess mainly since it is a
loss of time and productivity. The anti virus companies alone
can not combat this problem. Anti-virus software must be kept
up to date, and signature files must be updated faithfully. She
agreed that more must be done to stop virus writers and in turn
stiffer punishments must be enacted.
Mr. Peter Tippett, Chief Technology Officer, ICSA.net
discussed the costs and risks associated with electronic,
malicious code, privacy, down time, physical and human related
factors. He described ICSA as a new breed of Internet company
that provides security assurances services. Mr. Tippett states
that every product that ICSA certifies can detect, prevent and
recover from every virus that has ever been promulgated.
However, after they are installed into companies they become
only 30% effective. He suggests better education on how to use
such software. He agreed with the other witnesses in stating
that stiffer laws must be invoked on those who choose to write
these malicious codes. ICSA estimates that 65% of Northern
American companies were infected as well as 133,000 desktops.
V. Committee Actions
On Wednesday, October 20, 1999, the Committee on Science,
Subcommittee on Technology convened to mark up H.R. 2413, The
Computer Security Enhancement Act of 1999, to enhance the
ability of the National Institute of Standards and Technology
(NIST) to improve computer security. One amendment was offered
at the mark-up. It was adopted by a voice vote.
1. Mrs. Morella and Mr. Barcia offered an en bloc amendment
that would require NIST to access existing information security
programs at Federal agencies, make recommendations to improve
their security, and report to Congress annually on the
information security status of Federal agencies.
With a quorum present, Chairwoman Morella moved that H.R.
2413, as amended be reported. The motion was adopted by a voice
vote.
On Wednesday, July 26, 2000, the Committee on Science
convened to mark up H.R. 2413. An amendment offered by Mrs.
Morella and Mr. Barcia was offered and adopted by a voice vote.
1. Mrs. Morella and Mr. Barcia offered an amendment, which
consisted of the text of H.R. 2413 as reported by the
Subcommittee on Technology. The amendment was agreed to by a
voice vote.
With a quorum present, Chairman Sensenbrenner moved that
H.R. 2413, as amended be reported. The motion was adopted by a
voice vote.
VI. Summary of Major Provisions of the Bill
H.R. 2413, the Computer Security Enhancement Act of 2000
provides for greater security for the federal civilian agencies
that base their procurement decisions for computer security
hardware and software on NIST standards. The legislation also
promotes the use of commercially available products and
encourages an open exchange of information between NIST and the
private sector. The legislation authorizes a total of
$8,980,000 in FY 2001 and $9,560,000 in FY 2002. Specifically,
the Computer Security Enhancement Act of 2000:
Requires NIST to encourage the acquisition of
commercial off-the-shelf (COTS) products to meet civilian
agency computer security needs. This measures should reduce the
costs of computer security technologies for federal agencies.
Enhances the role of the independent Computer
System Security and Privacy Advisory Board in NIST's decision-
making process by requiring the Board, which is made up of
representatives from industry, federal agencies and other
external organizations, to make formal recommendations
regarding proposed security standards and provide guidance to
NIST on emerging computer security issues.
Clarifies that NIST standards and guidelines are
to be used for the acquisition of computer security
technologies for the Federal Government and are not intended as
restrictions on the production or use of encryption by the
private sector.
Updates the Computer Security Act by including
references to computer networking, which has become an
increasingly important component of the Federal Government
Information technology system.
Establishes a new computer science fellowship
program for graduate and undergraduate students studying
computer security. The bill sets aside $500,000 for the first
year and $500,000 for the second year, to enable NIST to
finance computer security fellowships under an existing NIST
grant program.
Requires the National Research Council (NRC) to
conduct a study to assess the desirability of public key
infrastructures. The NRC would also research the technologies
required for the establishment of such public key
infrastructures.
Requires the Under Secretary of Commerce for
Technology to actively promote the use of technologies by the
Federal Government that will enhance the security of federal
communications networks and information in electronic form; to
establish a clearinghouse of information available to the
public on information security threats; and to promote
development of a market driven consensus standards-based
infrastructure that will enable more widespread use of
encryption technologies for confidentiality and authentication.
Establishes a National Panel for Digital
Signatures for the purpose of exploring all relevant factors
associated with the development of a national digital signature
infrastructure based on uniform standards and of developing
model practices and standards associated with certification
authorities. The Department of Commerce shall appoint the
National Panel and provide necessary administrative support.
VII. Section-by-Section Analysis (By Title and Section)/Committee Views
Sec. 1. Short title
Computer Security Enhancement Act of 2000.
Sec. 2. Findings and purposes
Details the findings and purpose of the bill.
Sec. 3. Voluntary standards for public key management infrastructures
Section 20 of the NIST Act is amended by authorizing NIST
to assist (upon request from the private sector) in
establishing voluntary interoperable standards, guidelines, and
associated methods and techniques to facilitate and expedite
the establishment of non-Federal public key management
infrastructures.
Committee views
Historically, NIST has been most effective when helping the
commercial sector, in a consensus process, to establish
standards. The Committee supports such efforts, so long as they
are fully voluntary and reflect a true consensus process.
Sec. 4. Security of Federal computers and networks
Section 20 of the NIST Act is amended by authorizing NIST
to:
(1) provide guidance and assistance to federal
agencies in the protection of interconnected computer
systems (except for national security systems),
including identification of significant risks thereto;
(2) promote compliance by Federal agencies with
existing Federal computer information security and
privacy guidelines; and,
(3) consult with and assist Federal agencies in
response to efforts related to unauthorized access to
federal computer systems.
Committee views
The Committee believes it is important that NIST remain the
lead agency in securing the information technology
infrastructure of federal civilian agencies. NIST must place
greater emphasis on its duties in this area. NIST should
provide guidance and assistance to federal civilian agencies in
helping to secure their information technology systems.
Sec. 5. Computer security implementation.
Section 20 of the NIST Act is amended to specify the
approaches to be taken by NIST in carrying out its existing
responsibilities for developing standards and guidelines for
the security and privacy of sensitive information in federal
computer systems and for assisting federal agencies in meeting
those standards and guidelines. Specifically, NIST must
emphasize technology-neutral policy guidelines, must actively
promote commercially available products for meeting the
security and privacy requirements of federal agencies and
provide assistance to agencies in the selection of products;
and must develop qualitative and quantitative measures for
assessing the effectiveness of agencies' information security
and privacy programs, perform evaluations of agencies' security
and privacy programs, and promote appropriate accreditation
procedures for agencies' programs. In addition, NIST is
required to develop uniform procedures for determining the
effectiveness of commercially available security products;
establish procedures for certification of private sector
laboratories to perform evaluations to promote the testing of
products and make available the results of such tests to
agencies and to the public.
Committee views
The Committee affirms NIST's lead role in setting policy
guidelines for computer security practices implemented by
federal civilian agencies. The Committee encourages the greater
use of commercially available security products by federal
agencies by directing NIST to promote the use of such products
whenever feasible and appropriate. In order to identify the
most effective security products, the Committee tasks NIST to
establish appropriate evaluation procedures and to establish
requirements to certify the capability of private sector
laboratories to conduct such tests.
The Committee expects NIST to expand its efforts to ensure
the compliance of federal agencies with the information
security and privacy guidelines developed by NIST in accordance
with its statutory responsibilities. The Committee tasks NIST
to develop metrics to assess the effectiveness of agencies'
security and privacy programs, to conduct on-site evaluations
of agencies' programs, and to report to Congress on the results
of these evaluations.
Sec. 6. Computer security review, public meetings, and information
Section 20 of the NIST Act is amended by requiring NIST to
solicit recommendations of the Computer System Security and
Privacy Advisory Board regarding standards and guidelines that
are under consideration for submittal to the Secretary of
Commerce for promulgation as regulations and include such
recommendations with any subsequent submission to the
Secretary. Funds are also authorized for the Board ($1,030,000
for FY 2001 and $1,060,000 for FY 2002) to enable it to act as
a forum for public discussion on emerging issues related to
computer security privacy and cryptography. The Board is
authorized to convene public meetings and to publish reports
and other information for public distribution.
Committee views
The Committee believes that an open and transparent system
should be used by NIST in promulgating federal standards. The
Computer System Security and Privacy Advisory Board (CSSPAB),
acting as an independent board, is uniquely positioned to make
recommendations to the Department of Commerce. This Board will
be charged with submitting its recommendations along with
NIST's proposals to the Secretary of Commerce for promulgation
as regulations. The Board is being provided with resources and
specific direction by the Committee to allow it to operate in
an independent and autonomous fashion to pursue public policy
issues that are important for assuring the security and
integrity of computing and network systems, and the information
they contain. The Board is authorized to convene public
meetings and to publish reports and other information for
public distribution.
The CSSPAB is to report directly to the Committee on
Science of the House of Representatives and the Committee on
Commerce, Science, and Transportation of the Senate. The
Committee emphasizes that CSSPAB reports do not require prior
clearance by OMB or the Commerce Department before they are
transmitted to the Congressional Committees.
Sec. 7. Limitation on participation in requiring encryption standards
Section 20 of the NIST Act is amended by prohibiting NIST
from promulgating, enforcing, or otherwise adopting standards,
or carrying out activities or policies, for the Federal
establishment of encryption standards required for use in
computer systems other than Federal Government computer
systems.
Committee views
NIST does not currently promulgate, enforce or otherwise
adopt standards, or carry out activities or policies, for the
federal establishment of encryption, or computer security
standards required for use in computer systems other than
Federal Government computer systems. It is the Committee's
intention that NIST not be used for such purposes in the
future.
Sec. 8. Miscellaneous amendments
Technical and conforming amendments to Section 20 of the
NIST Act as well as a language change which reasserts NIST's
role as the lead agency for handling standards for civilian
agency computer security.
Committee views
The Committee affirms NIST's role as the lead agency for
handling standards for federal civilian agency computer
security. The Committee believes that it is imperative that
this function remain open to public scrutiny. NIST is the
agency historically charged with setting the standards for
computer security in the civilian agencies and it is the
Committee's intention that NIST direct appropriate resources
and expertise to this area.
Sec. 9. Federal computer system security training
Section 5(b) of the Computer Security Act of 1987 is
amended by adding an emphasis on protecting sensitive
information in Federal databases and Federal computer sites
that are accessible through public networks.
Committee views
The Committee wishes to focus NIST's attention on security
matters which have come about because of the changes in network
information technology systems that have taken place since the
enactment of the Computer Security Act of 1987. The World Wide
Web is just one example of new developments in network
technology programs which raise unique security concerns.
Sec. 10. Computer security fellowship program
Funds are authorized under Section 18 of the NIST Act to
provide grants for research on computer security to students at
institutions of higher learning ($500,000 for FY 2001 and
$500,000 FY 2002).
Committee views
The Committee supports efforts to increase the number of
college and graduate students in the field of computer
security. NIST can play an important, although limited, role in
this effort through its section 18 fellowship program.
Sec. 11. Study of public key infrastructure by the National Research
Council
This section authorizes funds ($450,000 for FY 2001 to
remain available until expended) and sets terms for the
National Research Council of the National Academy of Sciences
to conduct a study of public key infrastructures (PKI) for use
by individuals, businesses, and government.
Committee views
The Committee is aware that the Federal Government is
aggressively promoting the deployment of PKI technology. PKIs
are not yet commonplace in either the private sector or in
government because a number of significant challenges must
still be overcome before the technology can be widely deployed
and implemented. The NRC study will provide valuable
information on the costs, vulnerabilities and scalability
issues of such an infrastructure.
Sec. 12. Promotion of national information security
Requires the Under Secretary of Commerce for Technology to
actively promote the use of technologies that will enhance the
security of communications networks and information in
electronic form; to establish a clearinghouse of information
available to the public on information security threats; and to
promote development of the standards-based infrastructure that
will enable the more widespread use of encryption technologies
for confidentiality and authentication.
Committee views
Through the requirements of section 12, the Committee
intends to designate a central government focus for increasing
public awareness of the need for improving the security of
communications networks and the information accessed through
such networks. The Committee notes that one of the central
findings of the comprehensive 1996 report from the National
Academy of Sciences, Cryptography's Role in Securing the
Information Society, is the relative lack of attention paid to
securing electronic information. Although the technical
solutions for enhancing information security are available, the
public has not been energized about the importance of utilizing
these tools.
H.R. 2413 encourages greater use of commercially available
cryptography products for protection of government information,
which may have the indirect effect of enhancing the general
availability of such technologies. To further increase public
awareness of security threats and to accelerate corrective
action, section 12 of the bill charges the Technology
Administration in the Commerce Department to actively promote
greater use of cryptography and associated technologies by the
private sector. One specific requirement is for the Technology
Administration to establish a clearinghouse of information for
the public on information security threats to networked
computers, including information about procedural and technical
approaches to guard against such threats.
The Committee intends that the Technology Administration
actively promote the development of a national, standards-based
infrastructure to support the uses of encryption technologies
for confidentiality and authentication by working closely with
the private sector and by assisting and supporting the
development of standards through a private-sector oriented,
consensus-based process.
Sec. 13. Electronic authentication infrastructure
Directs NIST to work in consultation with industry to
develop guidelines for electronic authentication
infrastructures for use by federal agencies to ensure the
security of transactions and interoperability with transaction
partners. NIST will develop and maintain a list of conforming
commercially available electronic authentication products used
by federal agencies. NIST will develop criteria/guidelines for
use by agencies for electronic management systems such as
maintaining security of databases and validity of certificates.
Eighteen months after enactment, NIST shall report to Congress
on how agencies are deploying systems which are in accordance
with guidelines developed by the agency. Guidelines developed
by NIST or any Federal agency should be technology neutral.
Establishes a National Panel for Digital Signatures for the
purpose of exploring all relevant factors associated with the
development of a national digital signature infrastructure
based on uniform standards and of developing model practices
and standards associated with certification authorities. The
Technology Administration of the Department of Commerce shall
appoint the National Panel and provide necessary administrative
support.
Committee views
The Committee finds that digital signature technology is
essential for the full use of public networks, such as the
Internet, for commerce and for private communications. While
P.L. 106-229, the Electronic Signatures in Global and National
Commerce Act created the legal framework for the recognition
and acceptance of electronic signatures, it does not address
interoperability and other technical issues. Digital signatures
verify the identity of a business or individual that is
accessed via a network and assure the integrity of the
information being exchanged. In order for digital signature
technology to be deployed, in most cases, a trusted guarantor
of the public identifier, or public key, of the digital
signature must exist. This is the role of the certification
authority.
The Committee is aware that several States have enacted
statutes to regulate certification authorities. Unfortunately,
this has largely been an uncoordinated process resulting in the
placement of varying requirements on certification authorities.
In order for a truly national system to develop, which is
required if use of digital signatures is to become widespread,
the Committee believes that uniform market driven consensus
standards must be in place for the practices and procedures of
the certification authorities. Otherwise, variations in the
requirements for certification authorities will degrade the
overall level of reliability and security of digital
signatures.
To promote the required uniformity, section 13 of the bill
establishes a national panel, under the auspices of the
Technology Administration, to develop private voluntary model
practices and procedures, promote uniformity among
jurisdictions that license certification authorities, and
private voluntary uniform audit standards for certification
authorities. This national panel, with broadly based
representation, including users of digital signature
technology, will provide for the coordination needed to put in
place the national technical infrastructure that is a
prerequisite for the widespread use of digital signatures.
Sec. 14. Source of authorizations
This section authorizes $7 million in FY 2001 and $8
million in FY 2002 for NIST to carry out activities authorized
by this Act for which funds are not otherwise specifically
authorized.
Committee views
In addition to the funds authorized in H.R. 2413, H.R.
2086--the Networking and Information Technology Research and
Development Act of 1999--which has passed the Science Committee
and the House of Representatives--also authorizes funding for
NIST to conduct fundamental computer security research in the
area of advanced encryption standards and algorithms.
VIII. Cost Estimate
Rule XIII, clause 3(d)(2) of the House of Representatives
requires each committee report accompanying each bill or joint
resolution of a public character to contain: (1) an estimate,
made by such committee, of the costs which would be incurred in
carrying out such bill or joint resolution in the fiscal year
in which it is reported, and in each of the five fiscal years
following such fiscal year (or for the authorized duration of
any program authorized by such bill or joint resolution, if
less than five years); (2) a comparison of the estimate of
costs described in subparagraph (1) of this paragraph made by
such committee with an estimate of such costs made by any
Government agency and submitted to such committee; and (3) when
practicable, a comparison of the total estimated funding level
for the relevant program (or programs) with the appropriate
levels under current law. However, House rule XIII, clause
3(d)(3)(B) provides that this requirement does not apply when a
cost estimate and comparison prepared by the Director of the
Congressional Budget Office under section 402 of the
Congressional Budget Act of 1974 has been timely submitted
prior to the filing of the report and included in the report
pursuant to House rule XIII, clause 3(c)(3). A cost estimate
and comparison prepared by the Director of the Congressional
Budget Office under section 402 of the Congressional Budget Act
of 1974 has been timely submitted to the Committee on Science
prior to the filing of this report and is included in this
report pursuant to House rule XIII, clause 3(c)(3).
Rule XIII, clause 3(c)(2) of the House of Representatives
requires each committee report that accompanies a measure
providing new budget authority (other than continuing
appropriations), new spending authority, or new credit
authority, or changes in revenues or tax expenditures to
contain a cost estimate, as required by section 308(a)(1) of
the Congressional Budget Act of 1974 and, when practicable with
respect to estimates of new budget authority, a comparison of
the total estimated funding level for the relevant program (or
programs) to the appropriate levels under current law. H.R.
2413 does not contain any new budget authority, credit
authority, or changes in revenues or tax expenditures. Assuming
that the sums authorized under the bill are appropriated, H.R.
2413 does authorize additional discretionary spending, as
described in the Congressional Budget Office report on the
bill.
IX. Congressional Budget Office Cost Estimate
U.S. Congress,
Congressional Budget Office,
Washington, DC, August 18, 2000.
Hon. F. James Sensenbrenner, Jr.
Chairman, Committee on Science,
House of Representatives, Washington, DC.
Dear Congressman: The Congressional Budget Office has
prepared the enclosed estimate for H.R. 2413, the Computer
Security Enhancement Act of 2000.
If you wish further details on this estimate, we will be
pleased to provide them. The CBO staff contacts are Taman
Morris and Mark Hadley.
Sincerely,
Arlene Holen
(For Dan L. Crippen, Director).
Enclosure.
H.R. 2413--Computer Security Enhancement Act of 2000
Summary: H.R. 2413 would direct the National Institute of
Standards and Technology (NIST) to develop policies to improve
computer security for federal computer systems and would
authorize the appropriation of funds for this purpose in fiscal
years 2001 and 2002.
CBO estimates that implementing the bill would cost $19
million over the 2001-2003 period, assuming appropriation of
the authorized amounts. H.R. 2413 would not affect direct
spending or receipts; therefore, pay-as-you-go procedures would
not apply. The bill contains no intergovernmental or private-
sector mandates as defined in the Unfunded Mandates Reform Act
(UMRA).
Estimated cost to the Federal Government: The estimated
budgetary impact of H.R. 2413 is shown in the following table.
For this estimate, CBO assumes that H.R. 2413 would be enacted
near the start of fiscal year 2001 and that the amounts
authorized will be appropriated each year. Outlays have been
projected on the basis of historical spending patterns for NIST
and information provided by the agency. The cost of this
legislation would fall within budget function 370 (commerce and
housing credit).
----------------------------------------------------------------------------------------------------------------
By fiscal year, in millions of dollars--
--------------------------------------------
2001 2002 2003 2004 2005
----------------------------------------------------------------------------------------------------------------
CHANGES IN SPENDING SUBJECT TO APPROPRIATION
Authorization level................................................ 9 10 0 0 0
Estimated outlays.................................................. 7 10 2 0 0
----------------------------------------------------------------------------------------------------------------
Pay-as-you-go considerations: None.
Intergovernmental and private-sector impact: H.R. 2413
contains no intergovernmental or private-sector mandates as
defined in UMRA. Any costs incurred by states to participate in
the National Policy Panel for Digital Signatures are unlikely
to be significant.
Estimate prepared by: Federal costs: Taman Morris and Mark
Hadley; impact on State, local, and tribal governments:
Victoria Heid Hall; impact on the private sector: Lauren Marks.
Estimate approved by: Peter H. Fontaine, Deputy Assistant
Director for Budget Analysis.
X. Compliance With Public Law 104-4
H.R. 2413 contains no unfunded mandates.
XI. Committee Oversight Findings and Recommendations
Rule XIII, clause 3(c)(1) of the House of Representatives
requires each committee report to include oversight findings
and recommendations required pursuant to clause 2(b)(1) of rule
X. The Committee on Science's oversight findings and
recommendations are reflected in the body of this report.
XII. Oversight Findings and Recommendations by the Committee on
Government Reform
Rule XIII, clause 3(c)(4) of the House of Representatives
requires each committee report to contain a summary of the
oversight findings and recommendations made by the House
Government Reform Committee pursuant to clause 4(c)(2) of rule
X, whenever such findings and recommendations have been
submitted to the Committee in a timely fashion. The Committee
on Science has received no such findings or recommendations
from the Committee on Government Reform.
XIII. Constitutional Authority Statement
Rule XIII, clause 3(d)(1) of the House of Representatives
requires each report of a committee on a bill or joint
resolution of a public character to include a statement citing
the specific powers granted to the Congress in the Constitution
to enact the law proposed by the bill or joint resolution.
Article I, section 8 of the Constitution of the United States
grants Congress the authority to enact H.R. 2413.
XIV. Federal Advisory Committee Statement
H.R. 2413 does not establish nor authorize the
establishment of any advisory committee
XV. Congressional Accountability Act
The Committee finds that H.R. 2413 does not relate to the
terms and conditions of employment or access to public services
or accommodations within the meaning of section 102(b)(3) of
the Congressional Accountability Act (Public Law 104-1).
XVI. Statement on Preemption of State, Local, or Tribal Law
The bill is not intended to preempt any state, local, or
tribal law.
XVII. Changes in Existing Law Made by the Bill, as Reported
In compliance with clause 3(e) of rule XIII of the Rules of
the House of Representatives, changes in existing law made by
the bill, as reported, are shown as follows (existing law
proposed to be omitted is enclosed in black brackets, new
matter is printed in italic, existing law in which no change is
proposed is shown in roman):
SECTION 20 OF THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY ACT
Sec. 20. (a) * * *
(b) In fulfilling subsection (a) of this section, the
Institute is authorized--
(1) to assist the private sector, upon request, in
using and applying the results of the programs and
activities under this section;
(2) upon request from the private sector, to assist
in establishing voluntary interoperable standards,
guidelines, and associated methods and techniques to
facilitate and expedite the establishment of non-
Federal management infrastructures for public keys that
can be used to communicate with and conduct
transactions with the Federal Government;
[(2)] (3) as requested, to provide to operators of
Federal computer systems technical assistance in
implementing the standards and guidelines promulgated
pursuant to section 5131 of the Clinger-Cohen Act of
1996 (40 U.S.C. 1441);
[(3)] (4) to assist, as appropriate, the Office of
Personnel Management in developing regulations
pertaining to training, as required by section 5 of the
Computer Security Act of 1987;
(5) except for national security systems, as defined
in section 5142 of Public Law 104-106 (40 U.S.C. 1452),
to provide guidance and assistance to Federal agencies
for protecting the security and privacy of sensitive
information in interconnected Federal computer systems,
including identification of significant risks thereto;
(6) to promote compliance by Federal agencies with
existing Federal computer information security and
privacy guidelines;
(7) in consultation with appropriate Federal
agencies, assist Federal response efforts related to
unauthorized access to Federal computer systems;
[(4)] (8) to perform research and to conduct studies,
as needed, to determine the nature and extent of the
vulnerabilities of, and to devise techniques for the
cost-effective security and privacy of sensitive
information in Federal computer systems; and
[(5)] (9) to coordinate closely with other agencies
and offices (including, but not limited to, the
Departments of Defense and Energy, the National
Security Agency, the General Accounting Office, the
Office of Technology Assessment, and the Office of
Management and Budget) to the extent that such
coordination will improve computer security and to the
extent necessary for improving such security for
Federal computer systems--
(A) * * *
* * * * * * *
(c)(1) In carrying out subsection (a)(2) and (3), the
Institute shall--
(A) emphasize the development of technology-neutral
policy guidelines for computer security practices by
the Federal agencies;
(B) promote the use of commercially available
products, which appear on the list required by
paragraph (2), to provide for the security and privacy
of sensitive information in Federal computer systems;
(C) develop qualitative and quantitative measures
appropriate for assessing the quality and effectiveness
of information security and privacy programs at Federal
agencies;
(D) perform evaluations and tests at Federal agencies
to assess existing information security and privacy
programs;
(E) promote development of accreditation procedures
for Federal agencies based on the measures developed
under subparagraph (C);
(F) if requested, consult with and provide assistance
to Federal agencies regarding the selection by agencies
of security technologies and products and the
implementation of security practices; and
(G)(i) develop uniform testing procedures suitable
for determining the conformance of commercially
available security products to the guidelines and
standards developed under subsection (a)(2) and (3);
(ii) establish procedures for certification of
private sector laboratories to perform the tests and
evaluations of commercially available security products
developed in accordance with clause (i); and
(iii) promote the testing of commercially available
security products for their conformance with guidelines
and standards developed under subsection (a)(2) and
(3).
(2) The Institute shall maintain and make available to
Federal agencies and to the public a list of commercially
available security products that have been tested by private
sector laboratories certified in accordance with procedures
established under paragraph (1)(G)(ii), and that have been
found to be in conformance with the guidelines and standards
developed under subsection (a)(2) and (3).
(3) The Institute shall annually transmit to the Congress, in
an unclassified format, a report containing--
(A) the findings of the evaluations and tests of
Federal computer systems conducted under this section
during the 12 months preceding the date of the report,
including the frequency of the use of commercially
available security products included on the list
required by paragraph (2);
(B) the planned evaluations and tests under this
section for the 12 months following the date of the
report; and
(C) any recommendations by the Institute to Federal
agencies resulting from the findings described in
subparagraph (A), and the response by the agencies to
those recommendations.
(d)(1) The Institute shall solicit the recommendations of the
Computer System Security and Privacy Advisory Board,
established by section 21, regarding standards and guidelines
that are being considered for submittal to the Secretary in
accordance with subsection (a)(4). The recommendations of the
Board shall accompany standards and guidelines submitted to the
Secretary.
(2) There are authorized to be appropriated to the Secretary
$1,030,000 for fiscal year 2001 and $1,060,000 for fiscal year
2002 to enable the Computer System Security and Privacy
Advisory Board, established by section 21, to identify emerging
issues related to computer security, privacy, and cryptography
and to convene public meetings on those subjects, receive
presentations, and publish reports, digests, and summaries for
public distribution on those subjects.
[(c)] (e) For the purposes of--
(1) developing standards and guidelines for the
protection of sensitive information in Federal computer
systems under subsections (a)(1) and (a)(3), and
(2) performing research and conducting studies under
subsection [(b)(5)] (b)(8),
the Institute [shall] may draw upon computer system technical
security guidelines developed by the National Security Agency
to the extent that the Institute determines that such
guidelines are consistent with the requirements for protecting
sensitive information in Federal computer systems.
[(d)] (f) As used in this section--
(1) the term ``computer system''--
(A) means any equipment or interconnected
system or subsystems of equipment that is used
in the automatic acquisition, storage,
manipulation, management, movement, control,
display, switching, interchange, transmission,
or reception, of data or information; and
(B) includes--
(i) computers and computer networks;
(ii) ancillary equipment;
(iii) software, firmware, and similar
procedures;
(iv) services, including support
services; and
(v) related resources;
* * * * * * *
(g) The Institute shall not promulgate, enforce, or otherwise
adopt standards, or carry out activities or policies, for the
Federal establishment of encryption standards required for use
in computer systems other than Federal Government computer
systems.
----------
SECTION 5 OF THE COMPUTER SECURITY ACT OF 1987
SEC. 5. FEDERAL COMPUTER SYSTEM SECURITY TRAINING.
(a) * * *
(b) Training Objectives.--Training under this section shall
be started within 60 days after the issuance of the regulations
described in subsection (c). Such training shall be designed--
(1) to enhance employees' awareness of the threats to
and vulnerability of computer systems; [and]
(2) to encourage the use of improved computer
security practices[.]; and
(3) to include emphasis on protecting sensitive
information in Federal databases and Federal computer
sites that are accessible through public networks.
* * * * * * *
XVIII. Committee Recommendations
On July 26, 2000 a quorum being present, the Committee on
Science favorably reported H.R. 2413, Computer Security
Enhancement Act of 2000, by a voice vote and recommends its
enactment.
XIX. Proceedings of the Subcommittee Markup
MARKUP ON H.R. 2413, THE COMPUTER SECURITY ENHANCEMENT ACT OF 1999
----------
WEDNESDAY, OCTOBER 20, 1999
House of Representatives,
Committee on Science,
Subcommittee on Technology,
Washington, DC.
The subcommittee met, pursuant to notice, at 10:37 a.m. in
room 2318, Rayburn House Office Building, Hon. Constance A.
Morella (chairwoman of the subcommittee) presiding.
Chairwoman Morella. I am going to convene the Technology
Subcommittee of the Science Committee. Good morning. Pursuant
to notice, the Subcommittee on Technology is meeting today. We
are going to consider H.R. 2413, a bill to amend the National
Institute of Standards and Technology Act, to enhance the
ability of the National Institute of Standards and Technology
to improve computer security.
I ask unanimous consent for the authority to recess at any
point. Hearing no objection, so ordered.
Today we have one item of business to bring before the
Subcommittee; that is, the bill H.R. 2413, a bill to enhance
the ability of the National Institute of Standards and
Technology to improve computer security.
Computer security, as we all know, is an issue that is a
priority not just with the Technology Subcommittee, but also by
the Science Committee. In just this year, the Subcommittee has
held three hearings on this important issue, that has the
potential to disrupt public and private sector businesses, as
well as to undermine the American people's confidence and trust
in our rapidly developing information technology systems.
In April, this Subcommittee met to explore the impact of
the Melissa computer virus and other evolving threats to
computer and information security. In June, in the face of
several well-publicized cyberattacks, we met to review the
security of federal agency websites. And last month, we met to
review the provisions of H.R. 2413, the legislation that we are
marking up today.
In our hearings we repeatedly heard that federal agencies
are not doing enough to protect their critical information
systems from attacks and corruption. The Federal Government is
not alone in its need to secure electronic information; the
corruption of electronic data threatens every sector of our
economy.
H.R. 2413 was introduced in July by myself, Chairman
Sensenbrenner of Wisconsin, and Congressman Gordon of
Tennessee. It strengthens the National Institute of Standards
and Technology's historic role in computer security, which was
established by the Computer Security Act of 1987.
What the bill does is update the decade-old act, while
giving NIST the tools it needs to ensure that appropriate
attention and effort is concentrated on securing our federal
information technology infrastructure.
I don't think it is necessary to go through each of the
details of the bill. I will, if unanimously approved, just
simply submit it all for the record. Hearing no objection, so
ordered.
[A copy of H.R. 2413 follows:]
Chairwoman Morella. It is a very important bill, as we all
know. Last Congress, both the House of Representatives and the
Senate Commerce Committee passed this same legislation without
opposition or amendment, and unfortunately the bill didn't
clear the Senate before the end of the 105th Congress.
While no single piece of legislation can fully protect our
federal civilian computer systems or overcome all barriers to
the creation of an interoperable electronic signature
infrastructure, I think that H.R. 2413 is an important step in
the right direction, so I urge all members to support its swift
passage today, to move the bill on to the full Science
Committee.
I am now pleased to recognize Mr. Barcia, the distinguished
ranking member of the Subcommittee, for any opening statement
he may have.
Mr. Barcia. Thank you very much, Chairwoman Morella. I will
be very brief in my remarks on H.R. 2413.
When the Subcommittee held a hearing on this bill on
September 30th, I raised my concerns about the lack of a strong
focal point to advise agencies on improving computer security
practices and ensuring that such practices are implemented.
H.R. 2413 strengthens the role of NIST in providing federal
agencies with these services. The provisions of H.R. 2413 are
entirely consistent with recommendations made by NIST's Private
Sector Advisory Board and the witnesses at our recent hearing.
In addition, the inclusions of Mr. Gordon's provisions on
electronic authentication technologies improves the security of
federal agencies' electronic transactions. More importantly,
these provisions provide a framework that will enable federal
agencies to begin to effectively implement the Government
Paperwork Elimination Act, which requires them to begin using
electronic authentication technologies.
I would also request that Chairwoman Morella continue to
work with us to clarify Section 7 of this bill. This language
is unduly broad and could be interpreted to prevent NIST from
working with industry to develop test beds and guidelines
related to electronic commerce and computer security. For
example, the language as drafted could be interpreted to
prevent NIST from developing the follow-on to the Digital
Encryption Standard, or DES. The current Digital Encryption
Standard is widely used in industry, and NIST's work in this
area has strong industry support.
No one on this Committee supports the concept of federal
standards that industry must follow, and neither does NIST.
Although the concept behind this section is well-intentioned,
as drafted it would limit NIST's activities to support
industry's development of electronic commerce and computer
security. H.R. 2413 would strengthen the overall security of
federal computer systems and their electronic transactions.
This bill establishes a blueprint for the Federal
Government to become a model for good computer security
practices. I fully support this legislation and urge my
colleagues to support this well-crafted bill.
I want to thank you, Chairwoman Morella, and with your
indulgence I would like to yield the balance of my time to the
distinguished Member from Tennessee, who has invested a great
deal of his time and energy into crafting this legislation and
enhancing and improving the language in it, Representative Bart
Gordon of Tennessee.
Chairwoman Morella. The distinguished Member from Tennessee
is recognized.
Mr. Gordon. Thank you, Mr. Barcia, for the good job you
have done, and Chairwoman Morella, on this bill, and thank you
for yielding to me. I also want to thank the staff for all the
work they have put into this bill.
I know most of you are sitting on the edge of your seats,
waiting for this electronic authentication technology bill to
pass. But for the ones of you who may not have been following
it, let me give you a quick update.
Some years ago we passed the Government Paperwork
Elimination Act. That is going to allow us to reduce a lot of
paperwork within the government so that agencies can
communicate with each other, up and down and across,
electronically. However, we neglected to set any kind of--I
hate to use the word ``standards''--but ability for them to do
so in a way that there is continuity. It doesn't help if
Department of Agriculture at different levels have different
types of authentication so that they can't communicate with
each other. And so what this will do, it would allow NIST to
set up a framework, just simply guidelines, so that the
agencies will know that particular types of--hopefully--
software, off the shelf, will allow them to communicate with
their own agencies as well as others, and also allow them to
set up an appropriate level of security. Obviously, routine
work takes less security needs than other things.
So I think it will help us to really, truly eliminate
paperwork and allow some continuity, and I thank you for
working with me on this provision.
Chairwoman Morella. I thank you, Mr. Gordon, for your
contribution to this bill.
[The statement of Hon. Debbie Stabenow follows:]
I don't think anyone else has any opening statements, so we
will move as quickly as possible.
As we now consider H.R. 2413, I ask unanimous consent that
the bill be considered as read and open to amendment at any
point, and I ask members to proceed with the amendments in the
order on the roster. And therefore, in our desire to move
ahead, I am going to offer an amendment, a Manager's Amendment,
a bipartisan Manager's Amendment, crafted in careful
consideration with the Ranking Member Barcia.
The Clerk will report the amendment.
The Clerk. Amendment to H.R. 2413, offered by Mrs. Morella
and Mr. Barcia----
Chairwoman Morella. I ask unanimous consent to dispense
with the reading.
I recognize myself for five minutes, but I will take less
time than that to explain the amendment.
In cooperation with the Ranking Member Barcia, I am pleased
to offer the bipartisan amendment that has been crafted to
improve the bill. According to the General Accounting Office
and other computer security experts, there is a dire need for
agencies to realize their computer security vulnerabilities and
to take immediate action to address them.
The amendment tasks NIST to utilize their computer security
expertise to assess existing information security programs of
federal agencies, and then to make recommendations to improve
their security. What NIST would do is report to Congress
annually on the information security status of our federal
agencies. We found this to be very, very important.
NIST would also document on the process and progress of
agencies to implement recorded and recommended security
improvements.
[The amendment offered by Mrs. Morella and Mr. Barcia
follows:]
Chairwoman Morella. The rest of my statement I am going to
submit for the record, but frankly, it enhances the role of
NIST in protecting the information security of federal
agencies.
[The statement of Mrs. Morella follows:]
Chairwoman Morella. It doesn't shift any responsibility
away from the agencies, but will also allow for some oversight.
Finally, the amendment makes certain changes to Section 6
of the bill, as recommended by the Computer Systems Security
and Privacy Advisory Board and NIST. I urge all members to
support this bipartisan amendment.
At this point I want to recognize the Ranking Member of the
Subcommittee, Mr. Barcia, to speak on behalf of the amendment.
Before we do that, I want to note the presence of a
recording quorum.
Mr. Barcia.
Mr. Barcia. I want to thank Chairwoman Morella for her
thorough but concise explanation of the en bloc amendment. I,
too, have a more lengthy statement to make in support of the en
bloc amendment, and I certainly would urge my colleagues to
support the amendment.
I would just like to, on the record, though, however, say
that I do have one small reservation. This amendment increases
NIST's responsibilities to assist agencies in protecting their
information systems without providing any additional funding to
carry out these additional responsibilities. Discussions with
the General Accounting Office indicate that security checks of
civilian agencies' information systems would cost around $4.8
million per year. If this Committee is serious about
strengthening this role in this area, we must provide the
resources to enable them to carry out the responsibilities. The
issue of inadequate resources has been the major concern of
NIST's Advisory Board from its beginning.
I would hope that Chairwoman Morella would work with us in
a bipartisan way, as she has in the past, to help resolve this
issue before we proceed to the full Committee level.
With those brief remarks, I want to say I fully support the
en bloc amendment, and in the interest of time will not touch
on the strong recommendations I have in terms of the other
language that has been worked out. I just wanted to go on the
record with that one reservation I have about the resources
being there to carry out the responsibilities we're assigning.
[The statement of Mr. Barcia follows:]
Chairwoman Morella. Thank you, Mr. Barcia. I think
everybody knows that NIST is located in my District, and I,
along with this Committee, have been a strong advocate for it.
As H.R. 2413 moves forward to the full Science Committee for
consideration, I intend to work with our Ranking Member and
with Chairman Sensenbrenner to identify additional funding for
NIST to carry out the important responsibilities required under
the bill. I think it is a very important point that you bring
up.
I wonder if there is any discussion on the amendment?
[No response.]
Chairwoman Morella. If no, the vote occurs on the
amendment. All in favor, say aye.
[Chorus of ayes.]
Chairwoman Morella. Opposed, no.
[No response.]
Chairwoman Morella. The yeas have it. The amendment is
agreed to.
Any further amendments?
[No response.]
Chairwoman Morella. Hearing none, the question is on the
bill, H.R. 2413, as amended. All those in favor will say aye.
[Chorus of ayes.]
Chairwoman Morella. All those opposed will say no.
[No response.]
Chairwoman Morella. In the opinion of the Chair the ayes
have it.
Mr. Barcia.
Mr. Barcia. Yes, Madam Chairwoman. I move that the
Subcommittee favorably report H.R. 2413, as amended, to the
full Committee, and that the Chairwoman take all such necessary
steps to bring the bill before the full Committee for
consideration.
Further, I ask unanimous consent that the staff be
instructed to make all necessary technical and conforming
changes to the bill.
Chairwoman Morella. The Subcommittee has heard the motion.
Those in favor will say aye.
[Chorus of ayes.]
Chairwoman Morella. Those opposed, no.
[No response.]
Chairwoman Morella. The ayes have it. The motion is agreed
to. Without objection, the motion to reconsider is laid upon
the table.
I move that members have two subsequent calendar days in
which to submit supplemental, minority, or additional views on
the measure. Without objection, the motion is adopted.
Mr. Barcia had raised section 7. It was pointed out to me
that--I wanted to just have the record show that section 7 is
necessary because there is a great deal of concern by the
private sector that the Federal Government is interested in
setting standards that would be forced upon the private sector.
And it wasn't long ago when NIST and the National Security
Agency were involved in the Federal Government's so-called
``Clipper Chip'' initiative, and in that case the Federal
Government attempted to set a standard in a manner that gave
them the keys to otherwise private information.
So I am going to include further response to your question
of section 7 for the record.
[Information to be supplied follows:]
Chairwoman Morella. That being the case, the bill is
approved by this Subcommittee in a very expeditious and wise
fashion, and it will be reported to the full Committee, and
staff have the authority to do what has to be done to bring it
to the full Committee for its deliberate and expeditious
passage.
I thank the Subcommittee. You have been just great. There
is now a vote on the Journal, and the Subcommittee is now
adjourned.
[Whereupon, at 10:51 a.m., the Subcommittee was adjourned,
to reconvene at the call of the Chair.]
XX. Proceedings of the Full Committee Markup
BUSINESS MEETING
----------
WEDNESDAY, JULY 26, 2000
House of Representatives,
Committee on Science,
Washington, DC.
The committee met, pursuant to call, at 2:04 p.m. in room
2318, Rayburn House Office Building, Hon. F. James
Sensenbrenner, Jr. (chairman of the committee) presiding.
Chairman Sensenbrenner. We will now go back to H.R. 2413,
the Computer Security Enhancement Act of 1999, as amended by
the Subcommittee on Technology.
This bill has been introduced by myself, Mr. Gordon, Mrs.
Morella, and Mr. Kuykendall. The legislation strengthens the
National Institute of Standards and Technology's historical
role in computer security that was established by the Computer
Security Act of 1987, Public Law 100-235, and updates the act
to give NIST the tools it needs to ensure that appropriate
attention and effort is concentrated on securing our Federal
information technology infrastructure.
Let me point out that this bill is not a knee-jerk reaction
to recent well-publicized computer security problems. In the
last Congress, this bill passed the House and was cleared by a
Senate Committee without opposition or amendment but was unable
to reach the Senate Floor before the 105th Congress adjourned.
Improving the information security of Federal civilian agencies
has been an oversight priority of the Science Committee and I
am now pleased that H.R. 2413 will play an important role in
this effort.
[A copy of the bill H.R. 2413 follows:]
Chairman Sensenbrenner. I will now recognize the gentleman
from Texas, Mr. Hall, for his opening statement on this bill.
The gentleman is recognized for five minutes.
Mr. Hall. Thank you, Mr. Chairman. Before I yield to Mr.
Gordon, I would like to compliment him, Mrs. Morella, and
others for their very hard work on the question of computer
security. This has been a very important topic for the
Committee for about 15 years, and dating back to when this
Committee worked with Congressman Jack Brooks to enact the
first computer security law dealing with federally owned
computers.
H.R. 2413 brings our computer security efforts into the
Internet age by working to upgrade security of Federal computer
systems and networks. Thanks to the ideas of Mr. Gordon and to
others, it will also permit the Federal Government to advance
e-commerce and e-government by providing for secure electronic
authentication technology.
I plan to support the Morella-Gordon amendment in the
nature of a substitute and I urge my colleagues to do so.
I yield the balance of my time to Congressman Bart Gordon.
And before Mr. Gordon reports, I will yield to Mr. Barcia.
[The prepared statement of Mr. Hall follows:]
Statement of Hon. Ralph M. Hall
Mr. Chairman, before, I yield to Mr. Barcia, the Technology
Subcommittee Ranking Member, I would like to complement him,
Mrs. Morella, and Mr. Gordon for their hard work on the
question of computer security. This has been an important topic
for the Committee for 15 years or more, dating to when this
Committee worked with Congressman Jack Brooks to enact the
first computer security law dealing with Federally-owned
computers.
H.R. 2413 brings our computer security efforts into the
Internet age by working to upgrade security of Federal computer
systems and networks. Thanks to the ideas of Mr. Gordon, it
also will permit the Federal government to advance e-Commerce
and e-Government by providing for secure electronic
authentication technologies.
I plan to support the Morella-Gordon amendment in the
nature of a substitute and urge my colleagues to do so as well.
I yield the balance of my time to Congressman Barcia.
Mr. Barcia. Thank you very much, Ranking Member Hall.
Mr. Chairman, I will be very brief. H.R. 2413, the Computer
Security Enhancement Act, represents more than four years of
effort by the Technology Subcommittee. During the past two
years, the Subcommittee has examined the impact of computer
viruses and the lack of good computer security practices at
Federal agencies. H.R. 2413 strengthens the role of NIST in
providing Federal agencies with needed advice on good security
practices.
The provisions of H.R. 2413 are entirely consistent with
recommendations made by NIST's private sector advisory board
and the witnesses who testified at our hearings. The inclusion
of Mr. Gordon's provisions on electronic authentication
technologies also serves to improve the security of Federal
agencies' electronic transactions. In addition, the provisions
provide a framework to enable Federal agencies to effectively
implement the Government Paperwork Elimination Act, which
requires agencies to begin using electronic authentication
technologies.
H.R. 2413 will strengthen the overall security of Federal
computer systems and their electronic transactions. This bill
establishes a blueprint for the Federal Government to become a
model for good computer security and authentication practices.
The Technology Subcommittee reported this bill with unanimous
support.
I also want to say that I support the amendment in the
nature of a substitute to be offered by Representatives Gordon
and Morella, and I would urge all of my colleagues to support
this bill. And once again I thank the Chair of the Subcommittee
for all of her diligent work on this issue and the hearings
that were held as well as Congressman Gordon. And I yield my
time back.
Chairman Sensenbrenner. You have got two minutes left.
Mr. Hall. I yield back my time, sir.
Chairman Sensenbrenner. Okay. Time is yielded back.
Without objection, other members may insert opening
statements at this point in the record.
The Chair is aware of only one amendment in the nature of a
substitute by Mrs. Morella and Mr. Gordon. And at this point,
the Chair recognizes the gentlewoman from Maryland.
Mrs. Morella. Thank you, Mr. Chairman. And I do have an
amendment at the desk.
Chairman Sensenbrenner. The Clerk will report the
amendment.
The Clerk. Amendment in the nature of a substitute to H.R.
2413, offered by Mrs. Morella and Mr. Gordon.
Mrs. Morella. Mr. Chairman, I move that the amendment be
considered as read.
Chairman Sensenbrenner. Without objection. And the
gentlewoman is recognized for five minutes.
Mrs. Morella. Thank you. I am pleased to offer this
bipartisan amendment to improve H.R. 2413. It has been crafted
in cooperation with Congressman Bart Gordon.
First of all, Mr. Chairman, I want to thank you and Mr.
Hall for bringing this bill up. I want to thank Mr. Barcia for
continuing the legacy that began with Mr. Gordon and myself.
This bill, as you mentioned, has passed in the previous
Congress and here it is back again, a new enhanced version
which we hope will get through the House and through the
Senate.
Over the past two years, the Technology Subcommittee, we
have had a series of computer security hearings, including a
specific legislative hearing focusing on this bill. As amended,
H.R. 2413 authorizes $9 million in fiscal year 2001, and $9.5
million in fiscal year 2002 for the National Institute of
Standards and Technology. What these funds would do is they
would allow NIST to promote the use of commercially available
off-the-shelf security products by Federal agencies, have an
independent advisory board review NIST's computer security and
privacy protection efforts and make recommendations, create a
fellowship program in the field of computer security to address
IT worker shortages, establish an expert review team to assist
agencies to identify and fix existing information security
vulnerabilities.
Mr. Chairman, while no single piece of legislation can
fully protect our Federal civilian computer systems, we really
feel that H.R. 2413 is a necessary step in the right direction.
It has already been favorably reported by the Technology
Subcommittee, endorsed by the Information Technology
Association of America, and I strongly urge all members to
support this amendment and this important legislation.
You know, we took care of the Y2K computer glitch but that
had a terminal period of January 1st and February 29th of this
year. But computer security goes beyond, and it is
international in scope, and this legislation is a good step
toward trying to remediate that terrible problem. And I yield
back, Mr. Chairman.
[The statement on the amendment in the nature of a
substitute offered by Mrs. Morella follows:]
I am pleased to offer this bipartisan amendment to improve H.R.
2413 that has been crafted in cooperation with Congressman Bart Gordon.
Over the past two years, the Technology Subcommittee has held a
series of computer security hearings, including a specific legislative
hearing focusing on the bill.
As amended, H.R. 2413 authorizes $9 million in FY 2001 and $9.5
million in FY 2002 for the National Institute of Standards and
Technology.
The funds would allow NIST to:
Promote the use of commercially available off-the-shelf
security products by federal agencies, an initiative strongly
supported by the Information Technology Association of America
and others;
Increase privacy protection by giving an independent advisory
boards more responsibility and resources to review NIST's
computer security efforts and to make recommendations;
Support the development of a well trained workforce by
creating a fellowship program in the field of computer
security;
Study the efforts of the Federal government to develop a
secure, interoperable electronic infrastructure; and finally,
Establish an expert review team to assist agencies to
identify and fix existing information security vulnerabilities.
The General Accounting Office and other computer security experts
have all recognized the need for H.R. 2413.
Mr. Chairman, while no single piece of legislation can fully
protect our federal civilian computer systems; H.R. 2413 is a necessary
step in the right direction.
It has already been favorably reported by the Technology
Subcommittee and I strongly urge all members to support this amendment
to this important legislation.
Thank you.
committee on science full committee markup, july 26, 2000--amendment
roster for h.r. 2413, computer security enhancement act of 1999
No. and sponsor, description, results:
1. Mrs. Morella and Mr. Gordon, amendment to H.R. 2413, adopted by
a voice vote.
______
Amendment in the Nature of a Substitute H.R. 2413 Offered by Mrs.
Morella and Mr. Gordon
Strike all after the enacting clause and insert the following:
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Computer Security Enhancement Act of
2000''.
SEC. 2. FINDINGS AND PURPOSES.
(a) Findings.--The Congress finds the following:
(1) The National Institute of Standards and Technology has
responsibility for developing standards and guidelines needed
to ensure the cost-effective security and privacy of sensitive
information in Federal computer systems.
(2) The Federal Government has an important role in ensuring
the protection of sensitive, but unclassified, information
controlled by Federal agencies.
(3) Technology that is based on the application of
cryptography exists and can be readily provided by private
sector companies to ensure the confidentiality, authenticity,
and integrity of information associated with public and private
activities.
(4) The development and use of encryption technologies by
industry should be driven by market forces rather than by
Government imposed requirements.
(b) Purposes.--The purposes of this Act are to--
(1) reinforce the role of the National Institute of Standards
and Technology in ensuring the security of unclassified
information in Federal computer systems; and
(2) promote technology solutions based on private sector
offerings to protect the security of Federal computer systems.
SEC. 3. VOLUNTARY STANDARDS FOR PUBLIC KEY MANAGEMENT INFRASTRUCTURE.
Section 20(b) of the National Institute of Standards and Technology
Act (15 U.S.C. 278g-3(b)) is amended--
(1) by redesignating paragraphs (2), (3), (4), and (5) as
paragraphs (3), (4), (8), and (9), respectively; and
(2) by inserting after paragraph (1) the following new
paragraph:
``(2) upon request from the private sector, to assist in
establishing voluntary interoperable standards, guidelines, and
associated methods and techniques to facilitate and expedite
the establishment of non-Federal management infrastructures for
public keys that can be used to communicate with and conduct
transactions with the Federal Government;''.
SEC. 4. SECURITY OF FEDERAL COMPUTERS AND NETWORKS.
Section 20(b) of the National Institute of Standards and Technology
Act (15 U.S.C. 278g-3(b)), as amended by section 3 of this Act, is
further amended by inserting after paragraph (4), as so redesignated by
section 3(1) of this Act, the following new paragraphs:
``(5) except for national security systems, as defined in
section 5142 of Public Law 104-106 (40 U.S.C. 1452), to provide
guidance and assistance to Federal agencies for protecting the
security and privacy of sensitive information in interconnected
Federal computer systems, including identification of
significant risks thereto;
``(6) to promote compliance by Federal agencies with existing
Federal computer information security and privacy guidelines;
``(7) in consultation with appropriate Federal agencies,
assist Federal response efforts related to unauthorized access
to Federal computer systems;''.
SEC. 5. COMPUTER SECURITY IMPLEMENTATION.
Section 20 of the National Institute of Standards and Technology Act
(15 U.S.C. 278g-3) is further amended--
(1) by redesignating subsections (c) and (d) as subsections
(e) and (f), respectively; and
(2) by inserting after subsection (b) the following new
subsection:
``(c)(1) In carrying out subsection (a)(2) and (3), the Institute
shall--
``(A) emphasize the development of technology-neutral policy
guidelines for computer security practices by the Federal
agencies;
``(B) promote the use of commercially available products,
which appear on the list required by paragraph (2), to provide
for the security and privacy of sensitive information in
Federal computer systems;
``(C) develop qualitative and quantitative measures
appropriate for assessing the quality and effectiveness of
information security and privacy programs at Federal agencies;
``(D) perform evaluations and tests at Federal agencies to
assess existing information security and privacy programs;
``(E) promote development of accreditation procedures for
Federal agencies based on the measures developed under
subparagraph (C);
``(F) if requested, consult with and provide assistance to
Federal agencies regarding the selection by agencies of
security technologies and products and the implementation of
security practices; and
``(G)(i) develop uniform testing procedures suitable for
determining the conformance of commercially available security
products to the guidelines and standards developed under
subsection (a)(2) and (3);
``(ii) establish procedures for certification of private
sector laboratories to perform the tests and evaluations of
commercially available security products developed in
accordance with clause (i); and
``(iii) promote the testing of commercially available
security products for their conformance with guidelines and
standards developed under subsection (a)(2) and (3).
``(2) The Institute shall maintain and make available to Federal
agencies and to the public a list of commercially available security
products that have been tested by private sector laboratories certified
in accordance with procedures established under paragraph (1)(G)(ii),
and that have been found to be in conformance with the guidelines and
standards developed under subsection (a)(2) and (3).
``(3) The Institute shall annually transmit to the Congress, in an
unclassified format, a report containing--
``(A) the findings of the evaluations and tests of Federal
computer systems conducted under this section during the 12
months preceding the date of the report, including the
frequency of the use of commercially available security
products included on the list required by paragraph (2);
``(B) the planned evaluations and tests under this section
for the 12 months following the date of the report; and
``(C) any recommendations by the Institute to Federal
agencies resulting from the findings described in subparagraph
(A), and the response by the agencies to those
recommendations.''.
SEC. 6. COMPUTER SECURITY REVIEW, PUBLIC MEETINGS, AND INFORMATION.
Section 20 of the National Institute of Standards and Technology Act
(15 U.S.C. 278g-3), as amended by this Act, is further amended by
inserting after subsection (c), as added by section 5 of this Act, the
following new subsection:
``(d)(1) The Institute shall solicit the recommendations of the
Computer System Security and Privacy Advisory Board, established by
section 21, regarding standards and guidelines that are being
considered for submittal to the Secretary in accordance with subsection
(a)(4). The recommendations of the Board shall accompany standards and
guidelines submitted to the Secretary.
``(2) There are authorized to be appropriated to the Secretary
$1,030,000 for fiscal year 2001 and $1,060,000 for fiscal year 2002 to
enable the Computer System Security and Privacy Advisory Board,
established by section 21, to identify emerging issues related to
computer security, privacy, and cryptography and to convene public
meetings on those subjects, receive presentations, and publish reports,
digests, and summaries for public distribution on those subjects.''.
SEC. 7. LIMITATION ON PARTICIPATION IN REQUIRING ENCRYPTION STANDARDS.
Section 20 of the National Institute of Standards and Technology Act
(15 U.S.C. 278g-3), as amended by this Act, is further amended by
adding at the end the following new subsection:
``(g) The Institute shall not promulgate, enforce, or otherwise adopt
standards, or carry out activities or policies, for the Federal
establishment of encryption standards required for use in computer
systems other than Federal Government computer systems.''.
SEC. 8. MISCELLANEOUS AMENDMENTS.
Section 20 of the National Institute of Standards and Technology Act
(15 U.S.C. 278g-3), as amended by this Act, is further amended--
(1) in subsection (b)(8), as so redesignated by section 3(1)
of this Act, by inserting ``to the extent that such
coordination will improve computer security and to the extent
necessary for improving such security for Federal computer
systems'' after ``Management and Budget)'';
(2) in subsection (e), as so redesignated by section 5(1) of
this Act, by striking ``shall draw upon'' and inserting in lieu
thereof ``may draw upon'';
(3) in subsection (e)(2), as so redesignated by section 5(1)
of this Act, by striking ``(b)(5)'' and inserting in lieu
thereof ``(b)(8)''; and
(4) in subsection (f)(1)(B)(i), as so redesignated by section
5(1) of this Act, by inserting ``and computer networks'' after
``computers''.
SEC. 9. FEDERAL COMPUTER SYSTEM SECURITY TRAINING.
Section 5(b) of the Computer Security Act of 1987 (40 U.S.C. 759
note) is amended--
(1) by striking ``and'' at the end of paragraph (1);
(2) by striking the period at the end of paragraph (2) and
inserting in lieu thereof ``; and''; and
(3) by adding at the end the following new paragraph:
``(3) to include emphasis on protecting sensitive information
in Federal databases and Federal computer sites that are
accessible through public networks.''.
SEC. 10. COMPUTER SECURITY FELLOWSHIP PROGRAM.
There are authorized to be appropriated to the Secretary of Commerce
$500,000 for fiscal year 2001 and $500,000 for fiscal year 2002 for the
Director of the National Institute of Standards and Technology for
fellowships, subject to the provisions of section 18 of the National
Institute of Standards and Technology Act (15 U.S.C. 278g-1), to
support students at institutions of higher learning in computer
security. Amounts authorized by this section shall not be subject to
the percentage limitation stated in such section 18.
SEC. 11. STUDY OF PUBLIC KEY INFRASTRUCTURE BY THE NATIONAL RESEARCH
COUNCIL.
(a) Review by National Research Council.--Not later than 90 days
after the date of the enactment of this Act, the Secretary of Commerce
shall enter into a contract with the National Research Council of the
National Academy of Sciences to conduct a study of public key
infrastructures for use by individuals, businesses, and government.
(b) Contents.--The study referred to in subsection (a) shall--
(1) assess technology needed to support public key
infrastructures;
(2) assess current public and private plans for the
deployment of public key infrastructures;
(3) assess interoperability, scalability, and integrity of
private and public entities that are elements of public key
infrastructures;
(4) make recommendations for Federal legislation and other
Federal actions required to ensure the national feasibility and
utility of public key infrastructures; and
(5) address such other matters as the National Research
Council considers relevant to the issues of public key
infrastructure.
(c) Interagency Cooperation With Study.--All agencies of the Federal
Government shall cooperate fully with the National Research Council in
its activities in carrying out the study under this section, including
access by properly cleared individuals to classified information if
necessary.
(d) Report.--Not later than 18 months after the date of the enactment
of this Act, the Secretary of Commerce shall transmit to the Committee
on Science of the House of Representatives and the Committee on
Commerce, Science, and Transportation of the Senate a report setting
forth the findings, conclusions, and recommendations of the National
Research Council for public policy related to public key
infrastructures for use by individuals, businesses, and government.
Such report shall be submitted in unclassified form.
(e) Authorization of Appropriations.--There are authorized to be
appropriated to the Secretary of Commerce $450,000 for fiscal year
2001, to remain available until expended, for carrying out this
section.
SEC. 12. PROMOTION OF NATIONAL INFORMATION SECURITY.
The Under Secretary of Commerce for Technology shall--
(1) promote an increased use of security techniques, such as
risk assessment, and security tools, such as cryptography, to
enhance the protection of the Nation's information
infrastructure;
(2) establish a central repository of information for
dissemination to the public to promote awareness of information
security vulnerabilities and risks; and
(3) promote the development of the national, standards-based
infrastructure needed to support government, commercial, and
private uses of encryption technologies for confidentiality and
authentication.
SEC. 13. ELECTRONIC AUTHENTICATION INFRASTRUCTURE.
(a) Electronic Authentication Infrastructure.--
(1) Guidelines and standards.--Not later than 18 months after
the date of the enactment of this Act, the Director, in
consultation with industry and appropriate Federal agencies,
shall develop electronic authentication infrastructure
guidelines and standards for use by Federal agencies to assist
those agencies to effectively select and utilize electronic
authentication technologies in a manner that is--
(A) adequately secure to meet the needs of those
agencies and their transaction partners; and
(B) interoperable, to the maximum extent possible.
(2) Elements.--The guidelines and standards developed under
paragraph (1) shall include--
(A) protection profiles for cryptographic and
noncryptographic methods of authenticating identity for
electronic authentication products and services;
(B) a core set of interoperability specifications for
the Federal acquisition of electronic authentication
products and services; and
(C) validation criteria to enable Federal agencies to
select cryptographic electronic authentication products
and services appropriate to their needs.
(3) Coordination with national policy panel.--The Director
shall ensure that the development of guidelines and standards
with respect to cryptographic electronic authentication
products and services under this subsection is carried out in
consultation with the National Policy Panel for Digital
Signatures established under subsection (e).
(4) Revisions.--The Director shall periodically review the
guidelines and standards developed under paragraph (1) and
revise them as appropriate.
(b) Listing of Validated Products.--Not later than 30 months after
the date of the enactment of this Act, and thereafter, the Director
shall maintain and make available to Federal agencies and to the public
a list of commercially available electronic authentication products,
and other such products used by Federal agencies, evaluated as
conforming with the guidelines and standards developed under subsection
(a).
(c) Specifications for Electronic Certification and Management
Technologies.--
(1) Specifications.--The Director shall, as appropriate,
establish core specifications for particular electronic
certification and management technologies, or their components,
for use by Federal agencies.
(2) Evaluation.--The Director shall advise Federal agencies
on how to evaluate the conformance with the specifications
established under paragraph (1) of electronic certification and
management technologies, developed for use by Federal agencies
or available for such use.
(3) Maintenance of list.--The Director shall maintain and
make available to Federal agencies a list of electronic
certification and management technologies evaluated as
conforming to the specifications established under paragraph
(1).
(d) Reports.--Not later than 18 months after the date of the
enactment of this Act, and annually thereafter, the Director shall
transmit to the Congress a report that includes--
(1) a description and analysis of the utilization by Federal
agencies of electronic authentication technologies; and
(2) an evaluation of the extent to which Federal agencies'
electronic authentication infrastructures conform to the
guidelines and standards developed under subsection (a)(1).
(e) National Policy Panel for Digital Signatures.--
(1) Establishment.--Not later than 90 days after the date of
the enactment of this Act, the Under Secretary shall establish
a National Policy Panel for Digital Signatures. The Panel shall
be composed of government, academic, and industry technical and
legal experts on the implementation of digital signature
technologies, State officials, including officials from States
which have enacted laws recognizing the use of digital
signatures, and representative individuals from the interested
public.
(2) Responsibilities.--The Panel shall serve as a forum for
exploring all relevant factors associated with the development
of a national digital signature infrastructure based on uniform
guidelines and standards to enable the widespread availability
and use of digital signature systems. The Panel shall develop--
(A) model practices and procedures for certification
authorities to ensure the accuracy, reliability, and
security of operations associated with issuing and
managing digital certificates;
(B) guidelines and standards to ensure consistency
among jurisdictions that license certification
authorities; and
(C) audit procedures for certification authorities.
(3) Coordination.--The Panel shall coordinate its efforts
with those of the Director under subsection (a).
(4) Administrative support.--The Under Secretary shall
provide administrative support to enable the Panel to carry out
its responsibilities.
(5) Report.--Not later than 1 year after the date of the
enactment of this Act, the Under Secretary shall transmit to
the Congress a report containing the recommendations of the
Panel.
(f) Definitions.--For purposes of this section--
(1) the term ``certification authorities'' means issuers of
digital certificates;
(2) the term ``digital certificate'' means an electronic
document that binds an individual's identity to the
individual's key;
(3) the term ``digital signature'' means a mathematically
generated mark utilizing key cryptography techniques that is
unique to both the signatory and the information signed;
(4) the term ``digital signature infrastructure'' means the
software, hardware, and personnel resources, and the
procedures, required to effectively utilize digital
certificates and digital signatures;
(5) the term ``electronic authentication'' means
cryptographic or noncryptographic methods of authenticating
identity in an electronic communication;
(6) the term ``electronic authentication infrastructure''
means the software, hardware, and personnel resources, and the
procedures, required to effectively utilize electronic
authentication technologies;
(7) the term ``electronic certification and management
technologies'' means computer systems, including associated
personnel and procedures, that enable individuals to apply
unique digital signatures to electronic information;
(8) the term ``protection profile'' means a list of security
functions and associated assurance levels used to describe a
product; and
(9) the term ``Under Secretary'' means the Under Secretary of
Commerce for Technology.
SEC. 14. SOURCE OF AUTHORIZATIONS.
There are authorized to be appropriated to the Secretary of Commerce
$7,000,000 for fiscal year 2001 and $8,000,000 for fiscal year 2002,
for the National Institute of Standards and Technology to carry out
activities authorized by this Act for which funds are not otherwise
specifically authorized to be appropriated by this Act.
Chairman Sensenbrenner. The gentlewoman yields back the
balance of her time.
Is there further discussion on the amendment?
The gentleman from Tennessee.
Mr. Gordon. Mr. Chairman, I move to strike the last word.
Chairman Sensenbrenner. The gentleman is recognized for
five minutes.
Mr. Gordon. Thank you. First, I want to thank Chair Morella
for working in such a bipartisan manner on this amendment.
Primarily, the amendment incorporates comments and
clarifications that we received from the Administration on the
electronic authentication provisions in the bill. However, we
also have strengthened this role in improving security
practices at Federal agencies as well as advising them on the
effective deployment of electronic authentication technologies.
The underlying principle of H.R. 2413 and this amendment is
that they recognize that government and the private sector
computer security needs are similar. This amendment ensures
that the private sector has a strong voice in the development
of any electronic authentication guidelines for use by Federal
agencies and that the agencies rely on commercially available
products and services as much as possible.
I also want to thank Chairman Sensenbrenner for his
leadership on this issue and for working closely with me on the
development of this legislation. We both have been motivated by
the importance that we place on the Science Committee to act on
the broad issue of electronic security. Additionally, I want to
thank Mike Quear for the long and good hours of staff work on
this issue. This has been a good bill, is a good amendment, and
it represents sound policy. I urge my colleagues to support
this amendment.
[The prepared statement of Mr. Gordon follows:]
Statement of Hon. Bart Gordon
Mr. Chairman, First, I want to thank Chair Morella for
working in such a bipartisan manner on this amendment.
Primarily, the amendment incorporates comments and
clarifications that we received from the Administration on the
electronic authentication provisions in the bill.
However, we have also strengthened NIST's role in improving
computer security practices at federal agencies as well as
advising them on the effective deployment of electronic
authentication technologies.
The underlying principle of H.R. 2413 and this amendment is
that they recognize that government and private sector computer
security needs are similar.
This amendment ensures that the private sector has a strong
voice in the development of any electronic authentication
guidelines for use by federal agencies and that agencies rely
on commercially available products and services as much as
possible.
I also want to thank chairman Sensenbrenner for his
leadership on this issue and for working closely with me on the
development of this legislation.
We have both been motivated by the importance that we place
on the Science Committee to act on the broad issue of
electronic security.
This is a good bill, a good amendment and it represents
sound policy. I would urge my colleagues to support this
amendment.
Chairman Sensenbrenner. Does the gentleman yield back?
Mr. Gordon. Yes.
Chairman Sensenbrenner. Further discussion on the
amendment?
Ms. Lofgren. Mr. Chairman.
Chairman Sensenbrenner. The gentlewoman from California.
Ms. Lofgren. I move to strike the last word.
Chairman Sensenbrenner. The gentlewoman is recognized for
five minutes.
Ms. Lofgren. Mr. Chairman, I would like to thank members on
both sides of the aisle for working to address some concerns
that this bill in its original form raised for me. I think that
this amendment in the nature of a substitute offered by Mr.
Gordon and Mrs. Morella is a real step in the right direction
and I am very happy to support it.
I look forward to continuing to work with members on the
Committee Report to this bill to clarify that our intentions
are unanimously benign relative to encryption and key recovery.
In particular, I hope that the report will emphasize that we
are in no manner encouraging the promulgation of third party
encryption key recovery systems into the private sector. In
addition, I hope it will express that we do not intend, the
Federal Government, through the force of its purchasing powers,
one of the world's largest contractors, to impose its
encryption standards and regulations on the companies with
which it does business.
I look forward to working further with my colleagues and I
greatly appreciate their tremendous and well-guided efforts on
this bill to this point, and in particular this bipartisan
amendment. And I yield back.
[The prepared statement of Ms. Lofgren follows:]
Statement of Hon. Zoe Lofgren
Mr. Chairman, I would like to thank Members on both sides
of the aisle for working to address some concerns that this
bill in its original form raised for me. I think that this
amendment in the nature of a substitute offered by Mr. Gordon
and Mrs. Morella is a real step in the right direction, and I
am very happy to support it. I look forward to continuing to
work with Members on the Committee Report to this bill to
clarify that our intentions are unanimously benign relative to
encryption technology.
In particular, I hope that the Report will emphasize that
we are in no manner encouraging the promulgation of third-party
encryption key recovery systems into the private sector. In
addition, I hope it will express that we do not intend the
Federal Government, through the force of its purchasing powers
as one of the world's largest contractors, to impose its
encryption standards and regulations on companies with which it
does business. I look forward to working further with my
colleagues and I greatly appreciate their tremendous and well-
guided efforts on this bill to this point and, in particular,
this bipartisan amendment.
Chairman Sensenbrenner. Will the gentlewoman yield?
Ms. Lofgren. I certainly will, sir.
Chairman Sensenbrenner. The Chair enthusiastically endorses
the request of the gentlewoman from California to put the
language in the Report language so that we can make it quite
clear that this is a cooperative venture rather than a hammer
in the hand of the Federal Government.
Ms. Lofgren. Thank you, Mr. Chairman. I yield back.
Mrs. Morella. Mr. Chairman.
Chairman Sensenbrenner. The gentlewoman from Maryland has
already been recognized on this amendment. Somebody else want
to move to strike the last word?
Mr. Etheridge. I move to strike the last word.
Chairman Sensenbrenner. The gentleman from North Carolina
is recognized for five minutes.
Mr. Etheridge. I yield to the lady from Maryland.
Mrs. Morella. I thank the gentleman for yielding. And I
really only need probably about 30 seconds simply to indicate
that I do understand the concerns that the gentlewoman from
California posed with regard to Section 7. I just want to
reiterate that it was really intended to be a safeguard to
reflect the concerns, what she was offering, the concerns of
the private sector and to reiterate the fact that it is not
intended to prevent NIST from working with industry to develop
voluntary--voluntary encryption standards and guidelines. So I
emphasize on a voluntary basis. I yield back. I thank the
gentleman from North Carolina.
Chairman Sensenbrenner. Further discussion on the
amendment?
[No response.]
Chairman Sensenbrenner. Hearing none, all those in favor of
the amendment in the nature of a substitute by Mrs. Morella and
Mr. Gordon will signify by saying aye.
[Chorus of ayes.]
Chairman Sensenbrenner. Opposed, no.
[No response.]
Chairman Sensenbrenner. The ayes have it, and the amendment
is agreed to.
Are there further amendments to the bill?
[No response.]
Chairman Sensenbrenner. Hearing none, the Chair recognizes
the gentleman from Michigan for purposes of a motion.
Mr. Barcia. Thank you, Mr. Chairman. I move that the
Committee favorably report H.R. 2413, as amended, to the House
with the recommendation that the bill as amended do pass.
Furthermore, I move that staff be instructed to prepare the
legislative report and make necessary technical and conforming
amendments, and that the Chairman take all necessary steps to
bring the bill before the House for consideration.
Chairman Sensenbrenner. You have heard the motion of the
gentleman from Michigan to report the bill favorably. Is there
any discussion on the motion?
[No response.]
Chairman Sensenbrenner. Hearing none, the Chair notes the
presence of a reporting quorum. Those in favor will say aye.
[Chorus of ayes.]
Chairman Sensenbrenner. Opposed, no.
[No response.]
Chairman Sensenbrenner. The ayes appear to have it. The
ayes have it, and the bill is reported favorably.
Without objection, members will have two subsequent
calendar days in which to submit supplemental, minority,
additional, or dissenting views on the measure.
Without objection, the bill will be reported in the form of
a single amendment in the nature of a substitute reflecting
amendments adopted today.
And finally, without objection, pursuant to clause 1 of
Rule 22 of the Rules of the House, the Committee authorizes the
Chairman to offer such motions as may be necessary in the House
to go to conference with the Senate on the bill just reported.
Without objection, these unanimous consents are agreed to.