[House Report 107-497]
[From the U.S. Government Publishing Office]
107th Congress Report
HOUSE OF REPRESENTATIVES
2d Session 107-497
======================================================================
CYBER SECURITY ENHANCEMENT ACT OF 2002
_______
June 11, 2002.--Committed to the Committee of the Whole House on the
State of the Union and ordered to be printed
_______
Mr. Sensenbrenner, from the Committee on the Judiciary, submitted the
following
R E P O R T
[To accompany H.R. 3482]
[Including cost estimate of the Congressional Budget Office]
The Committee on the Judiciary, to whom was referred the
bill (H.R. 3482) to provide greater cybersecurity, having
considered the same, reports favorably thereon with an
amendment and recommends that the bill as amended do pass.
CONTENTS
Page
The Amendment.................................................... 1
Purpose and Summary.............................................. 6
Background and Need for the Legislation.......................... 7
Hearings......................................................... 8
Committee Consideration.......................................... 8
Vote of the Committee............................................ 9
Committee Oversight Findings..................................... 9
Performance Goals and Objectives................................. 9
New Budget Authority and Tax Expenditures........................ 9
Congressional Budget Office Cost Estimate........................ 9
Constitutional Authority Statement............................... 11
Section-by-Section Analysis and Discussion....................... 11
Agency Views..................................................... 21
Changes in Existing Law Made by the Bill, as Reported............ 27
Markup Transcript................................................ 32
The amendment is as follows:
Strike all after the enacting clause and insert the
following:
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Cyber Security Enhancement Act of
2002''.
TITLE I--COMPUTER CRIME
SEC. 101. AMENDMENT OF SENTENCING GUIDELINES RELATING TO CERTAIN
COMPUTER CRIMES.
(a) Directive to the United States Sentencing Commission.--Pursuant
to its authority under section 994(p) of title 28, United States Code,
and in accordance with this section, the United States Sentencing
Commission shall review and, if appropriate, amend its guidelines and
its policy statements applicable to persons convicted of an offense
under section 1030 of title 18, United States Code.
(b) Requirements.--In carrying out this section, the Sentencing
Commission shall--
(1) ensure that the sentencing guidelines and policy
statements reflect the serious nature of the offenses described
in subsection (a), the growing incidence of such offenses, and
the need for an effective deterrent and appropriate punishment
to prevent such offenses;
(2) consider the following factors and the extent to which
the guidelines may or may not account for them--
(A) the potential and actual loss resulting from
the offense;
(B) the level of sophistication and planning
involved in the offense;
(C) whether the offense was committed for purposes
of commercial advantage or private financial benefit;
(D) whether the defendant acted with malicious
intent to cause harm in committing the offense;
(E) the extent to which the offense violated the
privacy rights of individuals harmed;
(F) whether the offense involved a computer used by
the government in furtherance of national defense,
national security, or the administration of justice;
(G) whether the violation was intended to or had
the effect of significantly interfering with or
disrupting a critical infrastructure; and
(H) whether the violation was intended to or had
the effect of creating a threat to public health or
safety, or injury to any person;
(3) assure reasonable consistency with other relevant
directives and with other sentencing guidelines;
(4) account for any additional aggravating or mitigating
circumstances that might justify exceptions to the generally
applicable sentencing ranges;
(5) make any necessary conforming changes to the sentencing
guidelines; and
(6) assure that the guidelines adequately meet the purposes
of sentencing as set forth in section 3553(a)(2) of title 18,
United States Code.
SEC. 101A. STUDY AND REPORT ON COMPUTER CRIMES.
Not later than May 1, 2003, the United States Sentencing Commission
shall submit a brief report to Congress that explains any actions taken
by the Sentencing Commission in response to this Act and includes any
recommendations the Commission may have regarding statutory penalties
for offenses under section 1030 of title 18, United States Code.
SEC. 102. EMERGENCY DISCLOSURE EXCEPTION.
(a) In General.--Section 2702(b) of title 18, United States Code,
is amended--
(1) by striking ``or'' at the end of paragraph (5);
(2) by striking subparagraph (C) of paragraph (6);
(3) in paragraph (6), by inserting ``or'' at the end of
subparagraph (A); and
(4) by inserting after paragraph (6) the following:
``(7) to a Federal, State, or local governmental entity, if
the provider, in good faith, believes that an emergency
involving danger of death or serious physical injury to any
person requires disclosure without delay of communications
relating to the emergency.''.
(b) Reporting of Disclosures.--A government entity that receives a
disclosure under this section shall file, no later than 90 days after
such disclosure, a report to the Attorney General stating the
subparagraph under which the disclosure was made, the date of the
disclosure, the entity to which the disclosure was made, the number of
customers or subscribers to whom the information disclosed pertained,
and the number of communications, if any, that were disclosed. The
Attorney General shall publish all such reports into a single report to
be submitted to Congress one year after enactment of the bill.
SEC. 103. GOOD FAITH EXCEPTION.
Section 2520(d)(3) of title 18, United States Code, is amended by
inserting ``or 2511(2)(i)'' after ``2511(3)''.
SEC. 104. NATIONAL INFRASTRUCTURE PROTECTION CENTER.
(a) In General.--The Attorney General shall establish and maintain
a National Infrastructure Protection Center (hereinafter in this
section referred to as the ``Center'') to serve as a national focal
point for threat assessment, warning, investigation, and response to
attacks on the Nation's critical infrastructure for both physical and
cyber sources.
(b) Authorization of Appropriations.--There are authorized to be
appropriated for fiscal year 2003 to carry out this section,
$125,000,000.
SEC. 105. INTERNET ADVERTISING OF ILLEGAL DEVICES.
Section 2512(1)(c) of title 18, United States Code, is amended--
(1) by inserting ``or disseminates by electronic means''
after ``or other publication''; and
(2) by inserting ``knowing the content of the advertisement
and'' before ``knowing or having reason to know''.
SEC. 106. STRENGTHENING PENALTIES.
Section 1030(c) of title 18, United States Code, is amended--
(1) by striking ``and'' at the end of paragraph (3);
(2) in each of subparagraphs (A) and (C) of paragraph (4),
by inserting ``except as provided in paragraph (5),'' before
``a fine under this title'';
(3) by striking the period at the end of paragraph (4)(C)
and inserting ``; and''; and
(4) by adding at the end the following:
``(5)(A) if the offender knowingly or recklessly causes or
attempts to cause serious bodily injury from conduct in
violation of subsection (a)(5)(A)(i), a fine under this title
or imprisonment for not more than 20 years, or both; and
``(B) if the offender knowingly or recklessly causes or
attempts to cause death from conduct in violation of subsection
(a)(5)(A)(i), a fine under this title or imprisonment for any
term of years or for life, or both.''.
SEC. 107. PROVIDER ASSISTANCE.
(a) Section 2703.--Section 2703(e) of title 18, United States Code,
is amended by inserting ``, statutory authorization'' after
``subpoena''.
(b) Section 2511.--Section 2511(2)(a)(ii) of title 18, United
States Code, is amended by inserting ``, statutory authorization,''
after ``court order'' the last place it appears.
SEC. 108. EMERGENCIES.
Section 3125(a)(1) of title 18, United States Code, is amended--
(1) by striking ``or'' at the end of subparagraph (A);
(2) by striking the comma at the end of subparagraph (B)
and inserting a semicolon; and
(3) by adding at the end the following:
``(C) an immediate threat to a national security
interest; or
``(D) an ongoing attack on a protected computer (as
defined in section 1030) that constitutes a crime
punishable by a term of imprisonment greater than one
year;''.
SEC. 109. PROTECTING PRIVACY.
(a) Section 2511.--Section 2511(4) of title 18, United States Code,
is amended--
(1) by striking paragraph (b); and
(2) by redesignating paragraph (c) as paragraph (b).
(b) Section 2701.--Section 2701(b) of title 18, United States Code,
is amended--
(1) in paragraph (1), by inserting ``, or in furtherance of
any criminal or tortious act in violation of the Constitution
or laws of the United States or any State'' after ``commercial
gain'';
(2) in paragraph (1)(A), by striking ``one year'' and
inserting ``5 years'';
(3) in paragraph (1)(B), by striking ``two years'' and
inserting ``10 years''; and
(4) so that paragraph (2) reads as follows:
``(2) in any other case--
``(A) a fine under this title or imprisonment for
not more than one year or both, in the case of a first
offense under this paragraph; and
``(B) a fine under this title or imprisonment for
not more than 5 years, or both, in the case of an
offense under this subparagraph that occurs after a
conviction of another offense under this section.''.
(c) Presence of Officer at Service and Execution of Warrants for
Communications and Customer Records.--Section 3105 of title 18, United
States Code, is amended by adding at the end the following: ``The
presence of an officer is not required for service or execution of a
warrant under section 2703 when the provider of electronic
communications service or remote computing service produces the
information required in the warrant.''.
TITLE II--OFFICE OF SCIENCE AND TECHNOLOGY
SEC. 201. ESTABLISHMENT OF OFFICE; DIRECTOR.
(a) Establishment.--
(1) In general.--There is hereby established within the
Department of Justice an Office of Science and Technology
(hereinafter in this title referred to as the ``Office'').
(2) Authority.--The Office shall be under the general
authority of the Assistant Attorney General, Office of Justice
Programs, and shall be independent of the National Institute of
Justice.
(b) Director.--The Office shall be headed by a Director, who shall
be an individual appointed based on approval by the Office of Personnel
Management of the executive qualifications of the individual.
SEC. 202. MISSION OF OFFICE; DUTIES.
(a) Mission.--The mission of the Office shall be--
(1) to serve as the national focal point for work on law
enforcement technology; and
(2) to carry out programs that, through the provision of
equipment, training, and technical assistance, improve the
safety and effectiveness of law enforcement technology and
improve access to such technology by Federal, State, and local
law enforcement agencies.
(b) Duties.--In carrying out its mission, the Office shall have the
following duties:
(1) To provide recommendations and advice to the Attorney
General.
(2) To establish and maintain advisory groups (which shall
be exempt from the provisions of the Federal Advisory Committee
Act (5 U.S.C. App.)) to assess the law enforcement technology
needs of Federal, State, and local law enforcement agencies.
(3) To establish and maintain performance standards in
accordance with the National Technology Transfer and
Advancement Act of 1995 (Public Law 104-113) for, and test and
evaluate law enforcement technologies that may be used by,
Federal, State, and local law enforcement agencies.
(4) To establish and maintain a program to certify,
validate, and mark or otherwise recognize law enforcement
technology products that conform to standards used by the
Office in accordance with the National Technology Transfer and
Advancement Act of 1995 (Public Law 104-113), which may, in the
discretion of the Office, allow for supplier declaration of
conformity with such standards.
(5) To work with other entities within the Department of
Justice, other Federal agencies, and the executive office of
the President to establish a coordinated Federal approach on
issues related to law enforcement technology.
(6) To carry out research, development, testing, and
evaluation in fields that would improve the safety,
effectiveness, and efficiency of law enforcement technologies
used by Federal, State, and local law enforcement agencies,
including, but not limited to--
(A) weapons capable of preventing use by
unauthorized persons, including personalized guns;
(B) protective apparel;
(C) bullet-resistant and explosion-resistant glass;
(D) monitoring systems and alarm systems capable of
providing precise location information;
(E) wire and wireless interoperable communication
technologies;
(F) tools and techniques that facilitate
investigative and forensic work, including computer
forensics;
(G) equipment for particular use in
counterterrorism, including devices and technologies to
disable terrorist devices;
(H) guides to assist State and local law
enforcement agencies;
(I) DNA identification technologies; and
(J) tools and techniques that facilitate
investigations of computer crime.
(7) To administer a program of research, development,
testing, and demonstration to improve the interoperability of
voice and data public safety communications.
(8) To serve on the Technical Support Working Group of the
Department of Defense, and on other relevant interagency
panels, as requested.
(9) To develop, and disseminate to State and local law
enforcement agencies, technical assistance and training
materials for law enforcement personnel, including prosecutors.
(10) To operate the regional National Law Enforcement and
Corrections Technology Centers and, to the extent necessary,
establish additional centers through a competitive process.
(11) To administer a program of acquisition, research,
development, and dissemination of advanced investigative
analysis and forensic tools to assist State and local law
enforcement agencies in combating cybercrime.
(12) To support research fellowships in support of its
mission.
(13) To serve as a clearinghouse for information on law
enforcement technologies.
(14) To represent the United States and State and local law
enforcement agencies, as requested, in international activities
concerning law enforcement technology.
(15) To enter into contracts and cooperative agreements and
provide grants, which may require in-kind or cash matches from
the recipient, as necessary to carry out its mission.
(16) To carry out other duties assigned by the Attorney
General to accomplish the mission of the Office.
(c) Competition Required.--Except as otherwise expressly provided
by law, all research and development carried out by or through the
Office shall be carried out on a competitive basis.
(d) Information From Federal Agencies.--Federal agencies shall,
upon request from the Office and in accordance with Federal law,
provide the Office with any data, reports, or other information
requested, unless compliance with such request is otherwise prohibited
by law.
(e) Publications.--Decisions concerning publications issued by the
Office shall rest solely with the Director of the Office.
(f) Transfer of Funds.--The Office may transfer funds to other
Federal agencies or provide funding to non-Federal entities through
grants, cooperative agreements, or contracts to carry out its duties
under this section.
(g) Annual Report.--The Director of the Office shall include with
the budget justification materials submitted to Congress in support of
the Department of Justice budget for each fiscal year (as submitted
with the budget of the President under section 1105(a) of title 31,
United States Code) a report on the activities of the Office. Each such
report shall include the following:
(1) For the period of 5 fiscal years beginning with the
fiscal year for which the budget is submitted--
(A) the Director's assessment of the needs of
Federal, State, and local law enforcement agencies for
assistance with respect to law enforcement technology
and other matters consistent with the mission of the
Office; and
(B) a strategic plan for meeting such needs of such
law enforcement agencies.
(2) For the fiscal year preceding the fiscal year for which
such budget is submitted, a description of the activities
carried out by the Office and an evaluation of the extent to
which those activities successfully meet the needs assessed
under paragraph (1)(A) in previous reports.
SEC. 203. DEFINITION OF LAW ENFORCEMENT TECHNOLOGY.
For the purposes of this title, the term ``law enforcement
technology'' includes investigative and forensic technologies,
corrections technologies, and technologies that support the judicial
process.
SEC. 204. ABOLISHMENT OF OFFICE OF SCIENCE AND TECHNOLOGY OF NATIONAL
INSTITUTE OF JUSTICE; TRANSFER OF FUNCTIONS.
(a) Transfers From Office Within NIJ.--The Office of Science and
Technology of the National Institute of Justice is hereby abolished,
and all functions and activities performed immediately before the date
of the enactment of this Act by the Office of Science and Technology of
the National Institute of Justice are hereby transferred to the Office.
(b) Authority To Transfer Additional Functions.--The Attorney
General may transfer to the Office any other program or activity of the
Department of Justice that the Attorney General, in consultation with
the Committee on the Judiciary of the Senate and the Committee on the
Judiciary of the House of Representatives, determines to be consistent
with the mission of the Office.
(c) Transfer of Funds.--
(1) In general.--Any balance of appropriations that the
Attorney General determines is available and needed to finance
or discharge a function, power, or duty of the Office or a
program or activity that is transferred to the Office shall be
transferred to the Office and used for any purpose for which
those appropriations were originally available. Balances of
appropriations so transferred shall--
(A) be credited to any applicable appropriation
account of the Office; or
(B) be credited to a new account that may be
established on the books of the Department of the
Treasury;
and shall be merged with the funds already credited to that
account and accounted for as one fund.
(2) Limitations.--Balances of appropriations credited to an
account under paragraph (1)(A) are subject only to such
limitations as are specifically applicable to that account.
Balances of appropriations credited to an account under
paragraph (1)(B) are subject only to such limitations as are
applicable to the appropriations from which they are
transferred.
(d) Transfer of Personnel and Assets.--With respect to any
function, power, or duty, or any program or activity, that is
transferred to the Office, those employees and assets of the element of
the Department of Justice from which the transfer is made that the
Attorney General determines are needed to perform that function, power,
or duty, or for that program or activity, as the case may be, shall be
transferred to the Office.
(e) Report on Implementation.--Not later than 1 year after the date
of the enactment of this Act, the Attorney General shall submit to the
Committee on the Judiciary of the Senate and the Committee on the
Judiciary of the House of Representatives a report on the
implementation of this title. The report shall--
(1) identify each transfer carried out pursuant to
subsection (b);
(2) provide an accounting of the amounts and sources of
funding available to the Office to carry out its mission under
existing authorizations and appropriations, and set forth the
future funding needs of the Office;
(3) include such other information and recommendations as
the Attorney General considers appropriate.
SEC. 205. NATIONAL LAW ENFORCEMENT AND CORRECTIONS TECHNOLOGY CENTERS.
(a) In General.--The Director of the Office shall operate and
support National Law Enforcement and Corrections Technology Centers
(hereinafter in this section referred to as ``Centers'') and, to the
extent necessary, establish new centers through a merit-based,
competitive process.
(b) Purpose of Centers.--The purpose of the Centers shall be to--
(1) support research and development of law enforcement
technology;
(2) support the transfer and implementation of technology;
(3) assist in the development and dissemination of
guidelines and technological standards; and
(4) provide technology assistance, information, and support
for law enforcement, corrections, and criminal justice
purposes.
(c) Annual Meeting.--Each year, the Director shall convene a
meeting of the Centers in order to foster collaboration and
communication between Center participants.
(d) Report.--Not later than 12 months after the date of the
enactment of this Act, the Director shall transmit to the Congress a
report assessing the effectiveness of the existing system of Centers
and identify the number of Centers necessary to meet the technology
needs of Federal, State, and local law enforcement in the United
States.
SEC. 206. COORDINATION WITH OTHER ENTITIES WITHIN DEPARTMENT OF
JUSTICE.
Section 102 of the Omnibus Crime Control and Safe Streets Act of
1968 (42 U.S.C. 3712) is amended in subsection (a)(5) by inserting
``coordinate and'' before ``provide''.
Purpose and Summary
H.R. 3482, the ``Cyber Security Enhancement Act of 2002,''
would increase penalties for cybercrimes to better reflect the
seriousness of the crime; enhance law enforcement efforts
through better coordination; provide the authority and
resources for the National Infrastructure Protection Center to
serve as a national focal point for threat assessment, warning,
investigation, and response to attacks on the nation's critical
infrastructure from both physical and cyber sources; and make
the Office of Science and Technology an independent office to
serve as the national focal point for law enforcement science
and technology and to assist in the development and
dissemination of law enforcement technology, and to make
technical assistance available to Federal, State, and local law
enforcement agencies.
Background and Need for the Legislation
Since the beginning of the 107th Congress, the Subcommittee
on Crime, Terrorism, and Homeland Security has examined the
need for legislation to update and improve Federal law to
protect the nation from cyber-crime and -terrorism.
On May 24, 2001, the Subcommittee heard from three State
and local officials on law enforcement efforts and needs to
fight cybercrime, expressing views from the police, the
prosecutors and the State governments. The witnesses were
Michael T. McCaul, the Texas Deputy Attorney General for
Criminal Justice; the Honorable Joseph I. Cassilly, the State's
Attorney for Harford County, Maryland and Chairman of the Cyber
Crime Committee for the National District Attorneys
Association; and Ronald R. Stevens, the Senior Investigator for
the Bureau of Criminal Investigation for the New York State
Police, Computer Crime Unit. All three testified with regard to
the need for better resources, training, standards, and
equipment.
On June 12, 2001, officials from three Federal agencies
testified before the Subcommittee. The witnesses were Michael
Chertoff, the Assistant Attorney General of the Criminal
Division for the Department of Justice; Thomas T. Kubic, the
Deputy Assistant Director of the Criminal Investigative
Division for the Federal Bureau of Investigation; and James A.
Savage, Jr., the Deputy Special Agent in Charge of the
Financial Crimes Division for United States Secret Service.
These three witnesses agreed that Federal laws regarding the
processes and procedures to investigate and prosecute
cybercrime were outdated in certain areas.
Alan Davidson, Associate Director at the Center for
Democracy and Technology (CDT), a Washington, DC, non-profit
group interested in civil liberties and human rights on the
Internet and other new digital media, also testified. He urged
the Subcommittee to consider privacy issues when drafting new
legislation and updating the law. At a February 12, 2002
legislative hearing on H.R. 3482, the ``Cyber Security
Enhancement Act of 2002,'' Mr. Davidson testified that the
``[Center for Democracy and Technology (CDT)] commends this
Committee for holding this hearing, and for the relatively
measured approach taken in H.R. 3482. We agree that computer
crime and security is a serious problem that requires serious
Government response.''
On June 14, 2001, representatives from the business
community testified about the problems they face with
cybercrime. The hearing focused on the efforts and concerns of
private industry with regard to this issue. The witnesses
agreed that sharing information was key to successfully
addressing and preventing cybercrime. Additionally, the
witnesses urged Congress to examine stricter penalties for
cybercrime.
The three hearings highlighted the growing threat of
cybercrime and cyberterrorism against our citizens and our
nation and the definitive need for legislation. Criminals use
computers and other types of technology to target the income
and well-being of American citizens, the nation's economy,
America's national security, and our critical infrastructure.
On September 20, 2001, H.R. 2915, ``the Public Safety and
Cyber Security Enhancement Act of 2002'' was introduced to
address the concerns brought forth in the hearings. Most of
H.R. 2915 was adopted as part of the USA PATRIOT Act \1\, the
anti-terrorism bill, that was enacted in October 26, 2001.
There remained some additional issues that were not addressed.
---------------------------------------------------------------------------
\1\ Pub. L No. 107-56.
---------------------------------------------------------------------------
H.R. 3482, ``the Cyber Security Enhancement Act of 2002,''
responds to the previous hearings and ongoing discussions with
law enforcement, industry, and academia representatives and the
need to address issues not covered in the USA PATRIOT Act.
While technology has improved the standard of living for
the United States and her citizens, it has also assisted
criminals and terrorists with their nefarious activities.
Terrorists and high-tech vandals use computers and other
technology to terrorize and harass businesses, private citizens
and the Government, which costs the taxpayers millions. For
example, hackers are invading the privacy of our citizens'
homes to program personal computers into ``zombie computers.''
These zombie computers are then used for the denial-of-service
attacks that bombard a target site with nonsense data. In
February 2000, a denial-of-service attack on Yahoo and other
companies cost millions of dollars. These types of attacks not
only threaten our economy, but also our public safety. An
attack on an emergency service network could prevent prompt
responses to people in life threatening situations, causing
injury or death.
The protection of our national security, critical
infrastructure and economic base is essential. The terrorist
attacks on September 11th severely affected our economy and
demonstrated a need to evaluate and improve our security. A
terrorist or criminal cyber attack could further harm our
economy and critical infrastructure. It is imperative that the
penalties and law enforcement capabilities are adequate to
prevent and deter such attacks.
Hearings
The Committee's Subcommittee on Crime held 1 day of
hearings on H.R. 3482 on February 12, 2002. Testimony was
received from four witnesses: John G. Malcolm, Deputy Assistant
Attorney General, Criminal Division of the Department of
Justice; Susan Kelley Koeppen, Corporate Attorney, Microsoft
Corporation; Clint Smith, Vice President and Chief Network
Counsel of WorldCom; and Alan Davidson, Staff Counsel, Center
for Democracy and Technology.
Committee Consideration
On February 26, 2002, the Subcommittee on Crime met in open
session and ordered favorably reported the bill H.R. 3482, as
amended, by a voice vote, a quorum being present. On May 1,
2002, the Committee met in open session and ordered favorably
reported the bill H.R. 3482, with an amendment in the nature of
a substitute, by voice vote, a quorum being present.
Vote of the Committee
There were no recorded votes on H.R. 3482.
Committee Oversight Findings
In compliance with clause 3(c)(1) of rule XIII of the Rules
of the House of Representatives, the Committee reports that the
findings and recommendations of the Committee, based on
oversight activities under clause 2(b)(1) of rule X of the
Rules of the House of Representatives, are incorporated in the
descriptive portions of this report.
Performance Goals and Objectives
The bill is intended to improve the ability of Federal,
State and local law enforcement efforts to deter, prevent and
resolve cyber attacks carried out by terrorists and other
criminals. The bill will implement accountability in the
management of grants for technology investment at the State and
local levels through assessments and better Federal grant
management. Additionally, the bill will improve the protection
of the nation's critical infrastructure from cyber and physical
attacks.
New Budget Authority and Tax Expenditures
Clause 3(c)(2) of House rule XII is inapplicable because
this legislation does not provide new budgetary authority or
increased tax expenditures.
Congressional Budget Office Cost Estimate
In compliance with clause 3(c)(3) of rule XIII of the Rules
of the House of Representatives, the Committee sets forth, with
respect to the bill, H.R. 3482, the following estimate and
comparison prepared by the Director of the Congressional Budget
Office under section 402 of the Congressional Budget Act of
1974:
U.S. Congress,
Congressional Budget Office,
Washington, DC, May 22, 2002.
Hon. F. James Sensenbrenner, Jr., Chairman,
Committee on the Judiciary,
House of Representatives, Washington, DC.
Dear Mr. Chairman: The Congressional Budget Office has
prepared the enclosed cost estimate for H.R. 3482, the Cyber
Security Enhancement Act of 2002.
If you wish further details on this estimate, we will be
pleased to provide them. The CBO staff contact is Mark
Grabowicz, who can be reached at 226-2860.
Sincerely,
Dan L. Crippen, Director.
Enclosure
cc:
Honorable John Conyers, Jr.
Ranking Member
H.R. 3482--Cyber Security Enhancement Act of 2002.
SUMMARY
H.R. 3482 would authorize the appropriation of $125 million
for fiscal year 2003 for the National Infrastructure Protection
Center (NIPC) in the Department of Justice. The bill also would
establish new federal crimes and would increase penalties for
unauthorized use of computers and related offenses.
CBO estimates that implementing H.R. 3482 would cost $125
million over the 2003-2004 period, subject to appropriation of
the authorized amount. Enacting the bill also would affect
direct spending and receipts, but CBO estimates that any such
effects would not be significant. Because the bill would affect
direct spending and receipts, pay-as-you-go procedures would
apply.
H.R. 3482 would impose reporting requirements on State and
local government agencies that receive certain disclosures from
providers of electronic communication services. Such a
requirement would constitute an intergovernmental mandate as
defined in the Unfunded Mandates Reform Act (UMRA). CBO
estimates that the cost of complying with these new reporting
requirements would not likely be significant, and would not
exceed the threshold established in UMRA ($58 million in 2002,
adjusted annually for inflation). Overall, the bill would
benefit State, local, and tribal governments by providing
technological assistance and training materials to State and
local law enforcement agencies. H.R. 3482 contains no new
private-sector mandates as defined in UMRA.
ESTIMATED COST TO THE FEDERAL GOVERNMENT
The estimated budgetary impact of H.R. 3482 is shown in the
following table. CBO assumes that the amounts authorized for
the NIPC will be appropriated by the start of fiscal year 2003.
We expect that outlays will occur somewhat more slowly than the
historical rate of spending for this program because of the
increase in funding compared to the 2002 level. The costs of
this legislation fall within budget function 750
(administration of justice).
By Fiscal Year, in Millions of Dollars
------------------------------------------------------------------------
2002 2003 2004 2005 2006 2007
------------------------------------------------------------------------
SPENDING SUBJECT TO APPROPRIATION
Spending for NIPC Under
Current Law
Budget Authority \1\ 90 0 0 0 0 0
Estimated Outlays 75 25 0 0 0 0
Proposed Changes
Authorization Level 0 125 0 0 0 0
Estimated Outlays 0 88 38 0 0 0
Spending for NIPC Under H.R.
3482
Authorization Level 90 125 0 0 0 0
Estimated Outlays 75 113 38 0 0 0
------------------------------------------------------------------------
1. The 2002 level is the amount appropriated for that year for the
National Infrastructure Protection Center.
Enacting H.R. 3482 could increase collections of criminal
fines for unauthorized use of computers and other offenses. CBO
estimates that any additional collections would not be
significant. Criminal fines are recorded as receipts and
deposited in the Crime Victims Fund, then later spent.
PAY-AS-YOU-GO CONSIDERATIONS
The Balanced Budget and Emergency Deficit Control Act
specifies pay-as-you-go procedures for legislation affecting
direct spending and receipts. These procedures would apply to
H.R. 3482 because it would affect both direct spending and
receipts, but CBO estimates that the annual amount of such
changes would not be significant.
ESTIMATED IMPACT ON STATE, LOCAL, AND TRIBAL GOVERNMENTS
H.R. 3482 would impose reporting requirements on State and
local government agencies that receive certain disclosures from
providers of electronic communication services. Such a
requirement would constitute an intergovernmental mandate as
defined in UMRA. CBO estimates that the cost of complying with
these new reporting requirements would not likely be
significant, and would not exceed the threshold established in
UMRA ($58 million in 2002, adjusted annually for inflation).
Overall, the bill would benefit State, local, and tribal
governments by providing technological assistance and training
materials to State and local law enforcement agencies.
ESTIMATED IMPACT ON THE PRIVATE SECTOR
H.R. 3482 contains no new private-sector mandates as
defined in UMRA.
ESTIMATE PREPARED BY:
Federal Costs: Mark Grabowicz (226-2860)
Impact on State, Local, and Tribal Governments: Angela Seitz
(225-3220)
Impact on the Private Sector: Paige Piper/Bach (226-2960)
ESTIMATE APPROVED BY:
Peter H. Fontaine
Deputy Assistant Director for Budget Analysis
Constitutional Authority Statement
Pursuant to clause 3(d)(1) of rule XIII of the Rules of the
House of Representatives, the Committee finds the authority for
this legislation in article I, section 8, of the Constitution.
Section-by-Section Analysis and Discussion
Sec. 1. Short Title.
This Act may be cited as the ``Cyber Security Enhancement
Act of 2002.''
TITLE I--COMPUTER CRIME
Sec. 101. Amendment of Sentencing Guidelines relating to Certain
Computer Crimes.
This section would direct the United States Sentencing
Commission to review, and if appropriate amend, the Federal
sentencing guidelines to provide a wider range of criteria for
sentencing of those convicted for cybercrimes under 18 U.S.C.
Sec. 1030. The Committee is concerned that the sentencing
guidelines do not adequately account for the serious nature of
computer crimes. Computer crimes can cost businesses millions
of dollars, can harm the nation's economy, threaten public
safety, and violate the privacy of individuals.
Recognizing the growing threats posed by cybercrime,
Congress, in the USA PATRIOT Act,\2\ increased maximum
penalties for certain violations of 18 U.S.C. Sec. 1030 that
can threaten lives as well as national security. Additionally,
the USA PATRIOT Act added three new violations under section
1030 where the offense involved an attack on computers used by
the Government in furtherance of national defense, national
security, or the administration of justice. This section of the
bill reflects those changes.
---------------------------------------------------------------------------
\2\ Uniting and Strengthening America by Providing Appropriate
Tools Required to Intercept and Obstruct Terrorism. Pub. L. No. 107-56.
---------------------------------------------------------------------------
This section of the bill also reflects the enhanced
penalties for cybercrime under H.R. 3482. In section 106, the
bill enhances the maximum penalty for cybercrimes where an
offender of 18 U.S.C. Sec. 1030 knowingly or recklessly causes
or attempts to cause death or serious bodily injury through a
cyber attack. This section also covers the grave threat that
cyber attacks pose to critical infrastructures.
The Committee believes that the United States Sentencing
Commission must review the guidelines to ensure that they
appropriately reflect the grievous nature of cyber attacks. The
Committee believes that these new guidelines will allows judges
to better account for the seriousness of a computer crime.
Judges will be able to consider, among other things, the level
of sophistication of the offense, whether the defendant acted
with malicious intent to cause harm in committing the offense,
and the extent to which the privacy rights of the victims of
the crime were violated.
This section also requires the U.S. Sentencing Commission
to submit by May 1, 2003, to Congress a brief report that
explains any actions taken by the Sentencing Commission in
response to this act.
Sec. 102. Emergency Disclosure Exception.
Under current law, communication providers are prohibited
from disclosing electronic stored communications unless the
disclosure is under a specified exception. One of those
exceptions, 18 U.S.C. Sec. 2702(b)(6)(C), provides that a
communication service provider may disclose a communication to
a law enforcement agency if the provider reasonably believes
that an emergency involving immediate danger of death or
serious physical injury to any person requires disclosure of
the information without delay. Communication providers
expressed concern to the Committee that the standard was too
difficult for them to meet and that, as a result, providers may
not disclose information relating emergencies, such as a
biological terrorist attack, to the appropriate Government
officials.
This section would amend the current law to allow
communications providers to disclose communications to a
Federal, State or local government entity in emergency
situations. The provider could only disclose communications
that relate to the emergency if the provider, in good faith,
believes that an emergency exists and that the emergency
involves a danger of death or serious physical injury which
requires disclosure without delay.
Specifically, this section would make three changes to
current law to enhance cooperation with law enforcement and
communications providers. First, it would change the legal
standard for providers to determine whether there is an
emergency from ``reasonable'' to ``good faith.'' Second it
would remove the requirement that a provider determine what is
or is not an immediate danger. Third, the provision would allow
the provider to disclose the information to any Government
entity, such as the Centers Disease Control (CDC), as well as
to law enforcement.
Based upon the testimony presented to the Subcommittee on
Crime at the February 12, 2002 hearing, the Committee believes
that changing the standard for providers from reasonable to
good faith is an appropriate and a necessary change. As Susan
Koeppen testified, providers are concerned that
``communications providers or Internet Service Providers may be
unnecessarily constrained in making decisions in good faith to
disclose information in an emergency situation involving the
danger of death or serious physical injury which requires
immediate disclosure of that information.'' She went on to
testify that section 102 made ``several improvements to
existing law that will enable such providers to make decisions
promptly and without hesitation in emergency situations.''
The Committee finds that certain emergencies may make it
more appropriate for a provider to call the CDC or a hospital
instead of, or in addition to, law enforcement, and thus the
notification restriction should not be limited to law
enforcement.
Additionally, the word ``immediate'' is not needed. The
language of the bill requires that the provider, in good faith,
believes (1) that there is an emergency, (2) that emergency
involves danger of death or serious physical injury, and (3)
that the emergency requires disclosure of the communications
without delay. The American Heritage College dictionary defines
``emergency'' as ``a serious situation or occurrence that
happens unexpectedly and demands immediate action.''
Furthermore, the provider must have a good faith belief
that the information should be disclosed without delay.
Accordingly, the Committee believes Congress should not add
an additional ``immediate'' requirement that makes the provider
determine whether or not the danger itself is immediate. For
example, if someone plans to bomb an elementary school next
week, then the communications provider should be able to
disclose that information and not have to guess whether an
action which is to occur a week later constitutes ``an
immediate'' danger or not. In such a case, law enforcement may
need all the time it can get to locate the perpetrator and
prevent the crime. Another example is where an individual sends
an e-mail to another person describing an upcoming terrorist
attack he or she is planning, but does not put a date on the
attack. A terrorist attack would clearly constitute an
emergency that threatens life or limb, but the timing of the
attack may not be evident. The attack could be planned for
tomorrow or for a year from now. It is clear that there is a
danger, but the immediacy of that danger is unclear.
Accordingly, this section changes current law to reflect
the fact that if a provider, in good faith, believes there is
an emergency, the provider should not be held liable. The
Committee would note that section 102 of this bill does not
change the standard or lower the standard for law enforcement
behavior. This section, instead, requires that a communications
provider must have a ``good faith'' belief that there is an
emergency involving danger of death or serious physical injury
to any person that requires disclosure without delay. This
section is aimed at protecting providers who in good faith
attempt to assist law enforcement with an emergency situation.
This section does not reduce the standard under which law
enforcement must act. If police abuse that standard, there are
appropriate consequences. The courts have applied a judicially
created exclusionary rule for years. As the Supreme Court
stated the rule exists as a ``judicially created remedy
designed to safeguard Fourth amendment rights generally through
its deterrent effect. . . .'' \3\
---------------------------------------------------------------------------
\3\ United States v. Leon, 468 U.S. 897, 906 (1984), quoting United
States v. Calandra, 414 U.S. 338,348 (1974), quoted with approval in
Illinois v. Krull, 480 340, 347 (1987); see also Terry v. Ohio, 392
U.S. 1, 12-4 (1968); United States v. Janis, 428 U.S. 433, 446 (1976).
---------------------------------------------------------------------------
Any criminal evidence that is secured, directly or
indirectly, in violation of the Fourth amendment, may not be
admitted against a defendant in a criminal proceeding. A police
officer who makes a false claim to a communications provider
that there is an emergency that authorizes the disclosure of
information under section 102 of the Cyber Security Enhancement
Act has conducted an illegal search and seizure. The police
officer must have a reasonable belief to make such a claim and
if she or he does not, the evidence would be subject to the
existing judicially created exclusionary rule.
Finally, this section would require Government officials to
report quarterly to the Attorney General for the first year
after enactment of the bill. At the end of that year, the
Attorney General would send a report on the quarterly reports
to Congress. This is a one time reporting requirement for the
Attorney General.
Sec. 103. Good Faith Exception.
This section would update the ``good faith reliance''
defense in 18 U.S.C. Sec. 2520(d) so that the new computer
trespasser law \4\ created in section 217 of the USA PATRIOT
Act is also covered. Current law provides that a communications
provider that relies in good faith on a court order or other
listed authorization has a complete defense against civil or
criminal action brought under this chapter or any other law. It
appears that the current defense, as written, would not cover a
provider acting in good faith under the new computer trespasser
law to assist law enforcement.
---------------------------------------------------------------------------
\4\ Prior to the enactment of the USA PATRIOT Act, victims of a
computer trespasser attack were not able to authorize law enforcement
to intercept the trespassers communications. Rather law enforcement
would have had to go to get a court order to help the owners of systems
providing communication services protect their own systems. The USA
PATRIOT Act amended the law to clarify that law enforcement may
intercept such communications when authorized by the victims.
---------------------------------------------------------------------------
This section clarifies that communications providers, who
assist law enforcement officials under the new computer
trespasser are covered. This language was included in the House
version of the PATRIOT Act \5\ that was reported unanimously
out of Committee. The final version of the USA PATRIOT Act,
however, adopted the Senate language that did not include this
provision.
---------------------------------------------------------------------------
\5\ Provide Appropriate Tools Required to Intercept and Obstruct
Terrorism, H.R. 2975, H. Rep. No. 107-236, Part 1.
---------------------------------------------------------------------------
This section simply clarifies that communications providers
assisting law-enforcement under this section will continue to
be covered by the good faith reliance defense under 18 U.S.C.
Sec. 2520.
Sec. 104. National Infrastructure Protection Center.
This section authorizes the Attorney General to establish
and maintain a National Infrastructure Protection Center (NIPC)
to serve as a national focal point for threat assessment,
warning, investigation, and response to attacks on the nation's
critical infrastructure from both physical and cyber sources.
This section authorizes the appropriation of $125,000,000 for
fiscal year 2003.
The Committee believes that information sharing is a key to
protecting the security of the nation. The NIPC facilitates
information sharing to protect the critical infrastructure of
the nation. It was created in 1998, but it was not authorized.
In addition to working with Federal, State and local Government
officials, NIPC works with private sector infrastructure owners
and operators.
The Committee believes that the war on terrorism demands
additional efforts to protect the nation's critical
infrastructure. By authorizing NIPC, the Congress demonstrates
its support for this important task.
Sec. 105. Internet Advertising of Illegal Devices.
Section 105 was included to address a statutory loophole
that allows for the distribution of advertisements of illegal
interception devices through contemporary means of
communication. This section would amend 18 U.S.C.
Sec. 2512(1)(c) to make the language technology neutral and
close the existing loophole to further protect privacy. Under
current law, 18 U.S.C. Sec. 2512(1)(c) prohibits the
advertisement of illegal interception devices in any magazine,
newspaper, handbill, or other publication. The current law,
however, does not mention advertising such devices on the
Internet. This section would correct that loophole and ensure
consistent treatment among advertising mediums by amending 18
U.S.C. Sec. 2512(1)(c) to include the advertisements
disseminated by electronic means.
Sec. 106. Increased Penalty.
This section amends 18 U.S.C. Sec. 1030(c) to allow for
criminal penalties to be increased if the offender knowingly or
recklessly causes or attempts to cause death or serious bodily
injury through a cyber attack. When a terrorist or other
criminal attacks a computer system that, for instance, controls
the 9-1-1 telephone systems, and causes a death or deaths, the
current 10-year prison term may not be enough. This section
provides the flexibility for a more severe punishment when the
computer crime is severe. The Committee believes that cyber
attacks can pose a serious threat to life and limb and that the
penalties should reflect that threat.
Sec. 107. Provider Assistance.
This section would ensure that providers of communications
remain covered under 18 U.S.C. Sec. 2703(e), a ``no cause of
action provision,'' which protects providers from law suits
when they legally assist law enforcement with an investigation
under the new emergency disclosure exception created in section
212 of the USA PATRIOT Act. Under current law, there is a ``no
cause of action [protection] against providers disclosing
information . . . in accordance with the terms of a court
order, warrant, subpoena, or certification under [chapter
121].'' Section 107 would add information disclosed under
``statutory authorization,'' to cover providers that contact
authorities in emergency situations. This language was
previously included in the House version of the PATRIOT Act
that was reported unanimously out of Committee. The final
version of the USA PATRIOT Act, however, adopted the Senate
language that did not include this provision.
This section would also ensure that providers of
communications remain covered under 18 U.S.C.
Sec. 2511(2)(a)(ii), another ``no cause of action'' provision
which protects providers from law suits when they are legally
assisting law enforcement with an investigation under the new
computer trespasser provision, Sec. 2511(2)(i), created in the
USA PATRIOT Act.
Sec. 108. Emergencies.
This section amends 18 U.S.C. Sec. 3125(a)(1) to expand
when law enforcement may use pen registers and trap and trace
devices in an emergency situation. Law enforcement uses pen
registers and trap and trace devices to provide information
about the source or destination of a communication without
capturing the content of the communication. This is the least
invasive method of surveillance of electronic communications
and is indispensable to investigations. Trap and trace devices
can identify, for example, the source of phone calls placed by
a kidnapper in order to identify his whereabouts. In ordinary
circumstances, any attorney for the Government may obtain a
pen/trap order by certifying to a court that the information
collected will be relevant to a criminal investigation. In an
emergency, law enforcement authorities may install a pen/trap
device for forty-eight hours while court authorization is
sought.
This amendment expands the list of situations during which
an emergency pen/trap can be used by adding immediate threats
to national security interests and ongoing attacks on protected
computers. Under current law, threats to national security
interests already justify the emergency use of a full-content
wiretap--a much more invasive tool than a pen/trap.\6\
---------------------------------------------------------------------------
\6\ 18 U.S.C. Sec. 2518 (7)(a)(ii).
---------------------------------------------------------------------------
The Committee notes that this section in no way changes the
limitations under current law on the emergency use of this
authority. Those limitations are: (1) a Government official
authorizing an emergency pen/trap must determine that there are
grounds upon which a court could enter a pen/trap order; \7\
(2) emergency authorization lasts only forty-eight hours,
within which time a court order must be obtained for the
surveillance to continue; \8\ and (3) it is a violation of the
statute to fail to apply for an order within forty-eight hours
of installation or use of the device.\9\
---------------------------------------------------------------------------
\7\ 18 U.S.C. Sec. 3125(a)(2).
\8\ 18 U.S.C. Sec. 3125(b).
\9\ 18 U.S.C. Sec. 3125(c).
---------------------------------------------------------------------------
Sec. 109. Protecting Privacy.
Section 109(a) would amend 18 U.S.C. Sec. 2511(4)(b) to
raise the penalties for a person who illegally intercepts cell-
phone conversations. Under current law, Sec. 2511(4)(b)
provides lesser penalties for certain wiretap violations. For
example, while most illegal wiretapping constitutes a 5-year
felony, the statute punishes first time offenders who intercept
a cellular phone call with a mere fine. The requirement that
violations be committed intentionally \10\ ensures that mere
inadvertent overhearing of a brief portion of a communication
is not criminalized. The Committee believes that the special
penalty scheme for cell phone violations should be eliminated
and that all wire interceptions should be treated equally.
Therefore, this section makes the statutory maximum penalty for
all such offenses the same regardless of the technology used.
---------------------------------------------------------------------------
\10\ See 18 U.S.C. Sec. 2511(1)(a)-(d).
---------------------------------------------------------------------------
Section 109(b) amends 18 U.S.C. Sec. 2701 to increase
penalties for a person who invades the privacy of another
person's stored communications. Under current law, subsection
2701(b) defines the penalties when an individual invades the
privacy of others by accessing communications in ``electronic
storage.'' Such privacy invasions include, for example, the
reading of an e-mail stored on an e-mail server awaiting
delivery to its recipient. Thus, a system administrator for a
company would violate this provision if, outside of his regular
duties, he used his access to the computer system to read the
CEO's e-mail and use the information contained in those e-mails
for his own financial gain.
The Committee believes that this section is necessary
because current law punishes what are often very significant
privacy invasions as misdemeanors. Under current law, where the
invasion of privacy occurs for commercial gain or advantage or
malicious destruction, the maximum penalty is 1 year
imprisonment for first time offenders. Violators without these
mental states receive a maximum of 6 months in jail. The
current penalty structure, in which all first-time offenses are
misdemeanors, does not adequately reflect the seriousness of
the offense. According to the Department of Justice, few (if
any) prosecutions have been brought for this violation,
limiting the deterrent effect of the statute. In addition, in
order to qualify for the enhanced penalty provision, a violator
must have the intent to cause damage or to benefit financially
from the action. This list of aggravating mental states does
not include those who violate the statute in furtherance of any
criminal or tortious act.
The amendments to 2701(b) raise the maximum criminal
penalties to 5 years where the actor has the aggravating mental
state (ten years for repeat offenders) and to 1 year for other
violations (five years for repeat offenders). The amendments
would assure that individuals who violate this section in
furtherance of some other criminal or tortious act are
appropriately punished. The Committee believes this change in
the law will provide judges with the flexibility and discretion
to impose more serious penalties for more serious crimes.
Section 109(c) amends 18 U.S.C. Sec. 3105, a 1917
provision, to clarify that a law enforcement officer does not
need to be present for a warrant to be serviced or executed
under the Electronic Communications Privacy Act (ECPA). Due to
the nature of electronic communications, much of this
information is in the possession of Internet Provider Services
(ISPs) and law enforcement officials often serve such warrants
over facsimile machines and are not present at the site of the
ISP. In a recent child pornography case, a Minnesota Federal
district court, in U.S. v. Bach,\11\ however, ruled that this
procedure was an unreasonable search and seizure. The Court
found that a police officer had to be present at the time. This
subsection makes it clear that a police officer does not have
to be present at the time a warrant is served under ECPA.
---------------------------------------------------------------------------
\11\ United States v. Bach, No. 01-221, (PAM/ESS) 2001 U.S. Dist.
LEXIS 21853 (D. Minn. Dec. 14, 2001).
---------------------------------------------------------------------------
TITLE II--OFFICE OF SCIENCE AND TECHNOLOGY
Sec. 201. Establishment of Office; Director.
This section establishes the Office of Science and
Technology (OST) as an independent office. The office will be
under the general authority of the Assistant Attorney General,
Office of Justice Programs (OJP), and shall no longer be housed
in the National Institute of Justice (NIJ).
The mission of the OST is to provide State and local law
enforcement access to new technologies and to help develop
those new technologies. Currently, OST is housed in NIJ, which
was created in 1968, in the Omnibus Crime Control and Safe
Streets Act to support Federal criminal justice research. The
mission of NIJ is to improve police work and the judicial
system and to gain a better understanding of criminal behavior.
NIJ was created when technology was not the overriding
priority. Today, technology is a priority and the establishment
of OST as an independent office will ensure that technology is
treated as a priority.
The Committee believes that there is a need for a real
reform of the OJP programs and the way those programs are
managed. The change proposed by this bill is part of a larger
restructuring process. It will help the OJP to focus the
necessary resources on the development of technology and hard
science research.
At hearings held on reforming OJP, the former Assistant
Attorney General for OJP, Laurie Robinson, testified that this
is one area OJP really needs to reorganize. States need to have
a more clear direction as to how and where to obtain technology
grants. This section will assist that process. Additionally,
the Committee believes that this change will help focus at OJP
on the important area of technology research and at the same
time maintain the core functions for which NIJ was established.
Today, the duties of NIJ are to:
L[research] the nature and impact of crime and
delinquency;
L[develop] applied technologies, standards and
tools for criminal justice practitioners;
L[evaluate] existing programs and responses to
crime;
L[test] innovative concepts and program models
in the field;
L[assist] policymakers, program partners, and
justice agencies; and
L[disseminate] knowledge to many
audiences.\12\
---------------------------------------------------------------------------
\12\ http://www.ojp.usdoj.gov/nij/about.htm (June 6, 2002).
NIJ would continue to carry out all of its functions except
for the development of applied technologies, standards, and
tools. These would be the responsibilities of OST.
Additionally, one of the NIJ's responsibilities is to evaluate
existing programs. To avoid a conflict of interest and allow
NIJ to evaluate the work of OST, it makes sense to transfer OST
outside of NIJ. This change will allow NIJ to maintain its
integrity as an independent evaluator of OJP.
Sec. 202. Mission of Office; Duties.
This section establishes the mission and duties of OST to
serve as the national focal point to improve law enforcement
technology and to make technical assistance available to
Federal, State, and local law enforcement agencies. This
section was modified by the Committee with regard to
subsections (3) and (4) to clarify that OST may use input from
industry in developing technology standards; however, the
Committee does not intend this modification to prevent OST from
independently developing whatever standards it deems
appropriate for law enforcement technology and equipment.
This section requires the Office to award research and
development work on a competitive basis. Additionally, it
requires the Director of the OST to provide to Congress a needs
assessment for Federal, State and local law enforcement and a
strategic plan for meeting those needs.
Sec. 203. Definition of Law Enforcement Technology.
This section defines ``law enforcement technology'' to
include investigative and forensic technologies, corrections
technologies, and technologies that support the judicial
process.
Sec. 204. Abolishment of Office of Science and Technology of National
Institute of Justice, Transfer of Functions.
This section transfers OST and all of its assets and
personnel out of the NIJ within OJP to be a separate office
within OJP. The Attorney General shall have the authority under
this section to transfer any other program or activity he or
she determines is appropriate for this office and provide a
report to Congress on its implementation after 1 year. The
Committee believes that the Attorney General should review all
law enforcement technology programs within the Department,
including such programs as the Office of Community Oriented
Policing Services (COPS).
Sec. 205. National Law Enforcement And Corrections Technology Centers.
This section requires the Director of the OST to operate
and support National Law Enforcement and Corrections Technology
Centers. These centers support research, development, and
implementation of technology to assist law enforcement. This
bill will require the Director of the OST to make
recommendations regarding the effectiveness of the centers and
the need for additional centers.
Presently, OST uses the existing National Law Enforcement
and Corrections Technology Centers as one of the primary
mechanisms to accomplish its mission. Currently, there are five
regional centers and one national office.
Sec. 206. Coordination with Other Entities within Department of
Justice.
This section provides that the Assistant Attorney General
shall coordinate the activities of the various bureaus whose
functions relate to technology programs. In several hearings
regarding the operations of OJP, it became apparent that the
lack of coordination among the various bureaus and offices at
OJP creates confusion and unnecessary duplication. The
Committee believes that requiring more coordination among the
various offices will increase efficiency and effectiveness of
the programs.
Agency Views
Changes in Existing Law Made by the Bill, as Reported
In compliance with clause 3(e) of rule XIII of the Rules of
the House of Representatives, changes in existing law made by
the bill, as reported, are shown as follows (existing law
proposed to be omitted is enclosed in black brackets, new
matter is printed in italics, existing law in which no change
is proposed is shown in roman):
TITLE 18, UNITED STATES CODE
* * * * * * *
PART I--CRIMES
* * * * * * *
CHAPTER 47--FRAUD AND FALSE STATEMENTS
* * * * * * *
Sec. 1030. Fraud and related activity in connection with computers
(a) * * *
* * * * * * *
(c) The punishment for an offense under subsection (a) or
(b) of this section is--
(1) * * *
* * * * * * *
(3)(A) a fine under this title or imprisonment for
not more than five years, or both, in the case of an
offense under subsection (a)(4) or (a)(7) of this
section which does not occur after a conviction for
another offense under this section, or an attempt to
commit an offense punishable under this subparagraph;
and
(B) a fine under this title or imprisonment for not
more than ten years, or both, in the case of an offense
under subsection (a)(4) (a)(5)(A)(iii), or (a)(7) of
this section which occurs after a conviction for
another offense under this section, or an attempt to
commit an offense punishable under this subparagraph;
[and]
(4)(A) except as provided in paragraph (5), a fine
under this title, imprisonment for not more than 10
years, or both, in the case of an offense under
subsection (a)(5)(A)(i), or an attempt to commit an
offense punishable under that subsection;
(B) a fine under this title, imprisonment for not
more than 5 years, or both, in the case of an offense
under subsection (a)(5)(A)(ii), or an attempt to commit
an offense punishable under that subsection;
(C) except as provided in paragraph (5), a fine
under this title, imprisonment for not more than 20
years, or both, in the case of an offense under
subsection (a)(5)(A)(i) or (a)(5)(A)(ii), or an attempt
to commit an offense punishable under either
subsection, that occurs after a conviction for another
offense under this section[.]; and
(5)(A) if the offender knowingly or recklessly
causes or attempts to cause serious bodily injury from
conduct in violation of subsection (a)(5)(A)(i), a fine
under this title or imprisonment for not more than 20
years, or both; and
(B) if the offender knowingly or recklessly causes
or attempts to cause death from conduct in violation of
subsection (a)(5)(A)(i), a fine under this title or
imprisonment for any term of years or for life, or
both.
* * * * * * *
CHAPTER 119--WIRE AND ELECTRONIC COMMUNICATIONS INTERCEPTION AND
INTERCEPTION OF ORAL COMMUNICATIONS
* * * * * * *
Sec. 2511. Interception and disclosure of wire, oral, or electronic
communications prohibited
(1) * * *
(2)(a)(i) * * *
(ii) Notwithstanding any other law, providers of wire or
electronic communication service, their officers, employees,
and agents, landlords, custodians, or other persons, are
authorized to provide information, facilities, or technical
assistance to persons authorized by law to intercept wire,
oral, or electronic communications or to conduct electronic
surveillance, as defined in section 101 of the Foreign
Intelligence Surveillance Act of 1978, if such provider, its
officers, employees, or agents, landlord, custodian, or other
specified person, has been provided with--
(A) * * *
* * * * * * *
setting forth the period of time during which the provision of
the information, facilities, or technical assistance is
authorized and specifying the information, facilities, or
technical assistance required. No provider of wire or
electronic communication service, officer, employee, or agent
thereof, or landlord, custodian, or other specified person
shall disclose the existence of any interception or
surveillance or the device used to accomplish the interception
or surveillance with respect to which the person has been
furnished a court order or certification under this chapter,
except as may otherwise be required by legal process and then
only after prior notification to the Attorney General or to the
principal prosecuting attorney of a State or any political
subdivision of a State, as may be appropriate. Any such
disclosure, shall render such person liable for the civil
damages provided for in section 2520. No cause of action shall
lie in any court against any provider of wire or electronic
communication service, its officers, employees, or agents,
landlord, custodian, or other specified person for providing
information, facilities, or assistance in accordance with the
terms of a court order, statutory authorization, or
certification under this chapter.
* * * * * * *
(4)(a) * * *
[(b) If the offense is a first offense under paragraph (a)
of this subsection and is not for a tortious or illegal purpose
or for purposes of direct or indirect commercial advantage or
private commercial gain, and the wire or electronic
communication with respect to which the offense under paragraph
(a) is a radio communication that is not scrambled, encrypted,
or transmitted using modulation techniques the essential
parameters of which have been withheld from the public with the
intention of preserving the privacy of such communication,
then--
[(i) if the communication is not the radio portion
of a cellular telephone communication, a cordless
telephone communication that is transmitted between the
cordless telephone handset and the base unit, a public
land mobile radio service communication or a paging
service communication, and the conduct is not that
described in subsection (5), the offender shall be
fined under this title or imprisoned not more than one
year, or both; and
[(ii) if the communication is the radio portion of
a cellular telephone communication, a cordless
telephone communication that is transmitted between the
cordless telephone handset and the base unit, a public
land mobile radio service communication or a paging
service communication, the offender shall be fined
under this title.]
[(c)] (b) Conduct otherwise an offense under this
subsection that consists of or relates to the interception of a
satellite transmission that is not encrypted or scrambled and
that is transmitted--
(i) * * *
* * * * * * *
Sec. 2512. Manufacture, distribution, possession, and advertising of
wire, oral, or electronic communication
intercepting devices prohibited
(1) Except as otherwise specifically provided in this
chapter, any person who intentionally--
(a) * * *
* * * * * * *
(c) places in any newspaper, magazine, handbill, or
other publication or disseminates by electronic means
any advertisement of--
(i) any electronic, mechanical, or other
device knowing the content of the advertisement
and knowing or having reason to know that the
design of such device renders it primarily
useful for the purpose of the surreptitious
interception of wire, oral, or electronic
communications; or
* * * * * * *
Sec. 2520. Recovery of civil damages authorized
(a) * * *
* * * * * * *
(d) Defense.--A good faith reliance on--
(1) * * *
* * * * * * *
(3) a good faith determination that section 2511(3)
or 2511(2)(i) of this title permitted the conduct
complained of;
* * * * * * *
CHAPTER 121--STORED WIRE AND ELECTRONIC COMMUNICATIONS AND
TRANSACTIONAL RECORDS ACCESS
* * * * * * *
Sec. 2701. Unlawful access to stored communications
(a) * * *
(b) Punishment.--The punishment for an offense under
subsection (a) of this section is--
(1) if the offense is committed for purposes of
commercial advantage, malicious destruction or damage,
or private commercial gain, or in furtherance of any
criminal or tortious act in violation of the
Constitution or laws of the United States or any
State--
(A) a fine under this title or imprisonment
for not more than [one year] 5 years, or both,
in the case of a first offense under this
subparagraph; and
(B) a fine under this title or imprisonment
for not more than [two years] 10 years, or
both, for any subsequent offense under this
subparagraph; and
[(2) a fine under this title or imprisonment for
not more than six months, or both, in any other case.]
(2) in any other case--
(A) a fine under this title or imprisonment
for not more than one year or both, in the case
of a first offense under this paragraph; and
(B) a fine under this title or imprisonment
for not more than 5 years, or both, in the case
of an offense under this subparagraph that
occurs after a conviction of another offense
under this section.
* * * * * * *
Sec. 2702. Voluntary disclosure of customer communications or records
(a) * * *
(b) Exceptions for disclosure of communications.-- A
provider described in subsection (a) may divulge the contents
of a communication--
(1) * * *
* * * * * * *
(5) as may be necessarily incident to the rendition
of the service or to the protection of the rights or
property of the provider of that service; [or]
(6) to a law enforcement agency--
(A) if the contents--
(i) were inadvertently obtained by
the service provider; and
(ii) appear to pertain to the
commission of a crime; or
(B) if required by section 227 of the Crime
Control Act of 1990; or
[(C) if the provider reasonably believes
that an emergency involving immediate danger of
death or serious physical injury to any person
requires disclosure of the information without
delay.]
(7) to a Federal, State, or local governmental
entity, if the provider, in good faith, believes that
an emergency involving danger of death or serious
physical injury to any person requires disclosure
without delay of communications relating to the
emergency.
* * * * * * *
Sec. 2703. Required disclosure of customer communications or records
(a) * * *
* * * * * * *
(e) No Cause of Action Against a Provider Disclosing
Information Under This Chapter.--No cause of action shall lie
in any court against any provider of wire or electronic
communication service, its officers, employees, agents, or
other specified persons for providing information, facilities,
or assistance in accordance with the terms of a court order,
warrant, subpoena, statutory authorization, or certification
under this chapter.
* * * * * * *
PART II--CRIMINAL PROCEDURE
* * * * * * *
CHAPTER 205--SEARCHES AND SEIZURES
* * * * * * *
Sec. 3105. Persons authorized to serve search warrant
A search warrant may in all cases be served by any of the
officers mentioned in its direction or by an officer authorized
by law to serve such warrant, but by no other person, except in
aid of the officer on his requiring it, he being present and
acting in its execution. The presence of an officer is not
required for service or execution of a warrant under section
2703 when the provider of electronic communications service or
remote computing service produces the information required in
the warrant.
* * * * * * *
CHAPTER 206--PEN REGISTERS AND TRAP AND TRACE DEVICES
* * * * * * *
Sec. 3125. Emergency pen register and trap and trace device
installation
(a) Notwithstanding any other provision of this chapter,
any investigative or law enforcement officer, specially
designated by the Attorney General, the Deputy Attorney
General, the Associate Attorney General, any Assistant Attorney
General, any acting Assistant Attorney General, or any Deputy
Assistant Attorney General, or by the principal prosecuting
attorney of any State or subdivision thereof acting pursuant to
a statute of that State, who reasonably determines that--
(1) an emergency situation exists that involves--
(A) immediate danger of death or serious
bodily injury to any person; [or]
(B) conspiratorial activities
characteristic of organized crime[,];
(C) an immediate threat to a national
security interest; or
(D) an ongoing attack on a protected
computer (as defined in section 1030) that
constitutes a crime punishable by a term of
imprisonment greater than one year;
* * * * * * *
----------
SECTION 102 OF THE OMNIBUS CRIME CONTROL AND SAFE STREETS ACT OF 1968
duties and functions of assistant attorney general
Sec. 102. (a) The Assistant Attorney General shall--
(1) * * *
* * * * * * *
(5) coordinate and provide staff support to
coordinate the activities of the Office and the Bureau
of Justice Assistance, the National Institute of
Justice, the Bureau of Justice Statistics, and the
Office of Juvenile Justice and Delinquency Prevention;
and
* * * * * * *
Markup Transcript
BUSINESS MEETING
WEDNESDAY, MAY 8, 2002
House of Representatives,
Committee on the Judiciary,
Washington, DC.
The Committee met, pursuant to notice, at 10:03 a.m., in
Room 2141, Rayburn House Office Building, Hon. F. James
Sensenbrenner, Jr. [Chairman of the Committee] presiding.
Chairman Sensenbrenner. [Presiding.] The Committee will be
in order.
When the Committee last recessed, the Judicial Improvement
Act had been favorably reported.
The next item on the agenda is H.R. 3482, the ``Cyber
Security Enhancement Act of 2001.'' The Chair recognizes the
gentleman from Texas, Mr. Smith, Chairman of the Subcommittee
on Crime, Terrorism, and Homeland Security, for a motion.
Mr. Smith. Thank you, Mr. Chairman.
Mr. Chairman, the Subcommittee on Crime, Terrorism, and
Homeland Security reports favorably the bill H.R. 3482 with a
single amendment in the nature of a substitute and moves its
favorable recommendation to the full House.
Chairman Sensenbrenner. Without objection, the bill will be
considered as read and open for amendment at any point. And the
Subcommittee amendment in the nature of a substitute, which the
Members have before them, will be considered as read and
considered as the original text for purposes of amendment.
[The amendment follows:]
Chairman Sensenbrenner. The Chair recognizes the gentleman
from Texas, Mr. Smith, to strike the last word.
Mr. Smith. Thank you, Mr. Chairman.
H.R. 3482, the ``Cyber Security Enhancement Act of 2002,''
will strengthen penalties to better reflect the seriousness of
cyberattacks. It will assist State and local law enforcement
through better grant management, accountability, and
dissemination of technical advice and information; will help
protect the Nation's critical infrastructure; and will enhance
privacy protections. H.R. 3482 was approved by the Subcommittee
on a voice vote.
Last summer, the Subcommittee on Crime held three hearings
on the growing threat of cybercrime and cyberterrorism. In
fact, the Subcommittee held more hearings on the subject of
cybercrime than any other issue. Cybercrime knows no borders or
restraints and can harm the Nation's economy and endanger the
public's health and safety.
Cybercrime is a growing concern, but many are reluctant to
report it. A recent survey conducted by the FBI and the
Computer Security Institute revealed most corporations and
Government agencies had been victims of computer hackers, but
they rarely report these security breaches to authorities.
While nearly 90 percent of the respondents detected
breaches in the last year, only 34 percent reported the
attacks. Common forms of attack included denials of services,
viruses and worms, financial fraud, and Web site defacement.
But businesses and Government agencies aren't the only
victims. Last year, Mr. Chairman, nearly 10,000 Americans
reported losing $18 million on online scams. Law enforcement
officials and private industry representatives agree that
better coordination, cooperation, and information sharing are
needed, as well as stronger penalties for cyberattacks.
In this legislation, penalties are strengthened by
directing the United States Sentencing Commission to review
and, if appropriate, amend its guidelines to provide a wider
range of criteria in sentencing cybercrimes. It also increases
penalties for those who cause or attempt to cause death or
serious bodily injury through cyberattacks.
This bill contains provisions that protect Internet service
providers who, for example, share information about potential
terrorist attacks when they legally assist law enforcement
officers under the new USA PATRIOT Act.
Finally, the bill helps protect the Nation's critical
infrastructure by providing State and local law enforcement
personnel access to new technologies through better grant
management and accountability.
So, Mr. Chairman, I urge my colleagues to support this bill
and yield back the balance of my time.
Chairman Sensenbrenner. Without objection, all Members may
insert opening statements in the record at this point in time.
And since there are no Members from the minority present,
without objection, we will set this bill temporarily aside,
because I know that there are some amendments that the minority
wishes to offer.
Well, I see the gentleman from Virginia present.
Are there amendments?
Ms. Hart. Mr. Chairman?
Mr. Smith. Mr. Chairman, I have----
Ms. Hart. Mr. Chairman?
Chairman Sensenbrenner. Does the gentleman from Texas, the
Subcommittee Chair, have an amendment?
Mr. Smith. Yes, Mr. Chairman. I ask unanimous consent that
my amendment in the nature of a substitute be considered as
read.
Chairman Sensenbrenner. Already been given--the gentleman
from Texas has an amendment at the desk.
The Clerk will report the amendment.
The Clerk. Amendment in the nature of a substitute to H.R.
3482. Strike all after the enacting clause and insert the
following----
Chairman Sensenbrenner. Without objection, the amendment
will be considered as read and open for amendment at any point.
[The amendment follows:]
Chairman Sensenbrenner. And without objection, this
amendment in the nature of a substitute will be considered the
original text for purposes of amendment.
Hearing no objection, so ordered.
The gentleman from Texas is recognized for 5 minutes.
Mr. Smith. Thank you, Mr. Chairman.
I offer this amendment in the nature of a substitute at the
suggestion of legislative counsel. This amendment makes only a
few discrete changes to the bill.
First, section 102 is amended at the request of the Center
for Democracy and Technology. The amendment clarifies that if a
communication provider believes in good faith that a life-
threatening emergency exists and discloses electronically
stored information relating to the emergency to a Federal,
State or local government official, then the provider will not
be held liable.
Second, section 105 is amended technically to clarify that
dissemination by electronic means is another form of
publication.
Third, section 107 is amended to strike the reimbursement
provisions in the remedies section. Neither industry nor the
Department of Justice have been able to agree on the nature of
the problem here or on a solution. It will be better to request
a study by the General Accounting Office on both the issue of
compliance by communication providers and preserving records
and the issue of reimbursement by the Government entities that
request the providers' compliance.
Mr. Chairman, I believe this amendment strengthens the bill
and urge my colleagues to support it.
I yield back the balance of my time.
Chairman Sensenbrenner. Are there any amendments to this
new amendment in the nature of a substitute?
The gentleman from Virginia.
Mr. Scott. Mr. Chairman, I have an amendment at the desk.
Chairman Sensenbrenner. The clerk will report the
amendment. Is the clerk clear which amendment to report?
Mr. Scott. I just have one.
Chairman Sensenbrenner. The clerk will report the
amendment.
The Clerk. Amendment to the amendment in the nature of the
substitute to H.R. 3482, offered by Mr. Scott. On page 4, at
the end of section 102, insert the following new subsection:
(c) Reporting of disclosures----
Chairman Sensenbrenner. Without objection, the amendment is
considered as read.
[The amendment follows:]
Chairman Sensenbrenner. And the gentleman from Virginia is
recognized for 5 minutes.
Mr. Scott. Thank you, Mr. Chairman.
I'm pleased to join you in convening this markup of the
cybersecurity act of 2001. And generally, I support the concept
of allowing Internet service providers to give information to
law enforcement officials when there is an emergency--of death
or serious bodily injury.
Under the current law, an ISP can only release information
if it reasonably believes that immediate danger exists. And I
support that change, too--believe it's in good faith.
If the FBI presents information that the ISP believes, if
true, could present a threat of death or serious injury, the
ISP dispatcher on duty shouldn't have to wake up the corporate
counsel to determine what to do. They ought to give up the
information. If there's time to do all the--check with the
corporate counsel, then the FBI could have just gone to the
magistrate or judge and gotten a search warrant.
Mr. Chairman, I agree with the bill. This amendment
clarifies one part of it. It's been, as I understand it, worked
with staff, requiring reporting disclosures, so that the
Attorney General will report each year how often these
procedures are used, so we have some handle on what we're
dealing with.
Ms. Lofgren. Would the gentleman yield for a question?
Mr. Scott. I yield.
Ms. Lofgren. Is it the intent of the amendment that this
publication would be the number but not necessarily the
entities that disclose? There'd be anonymity, a compilation, or
not?
Mr. Scott. It says the number of customers or subscribers,
not the name of the customer or subscriber.
Ms. Lofgren. Well, it says: report to the Attorney General,
stating the subparagraph under which the disclosure was made.
I think it's ambiguous. I want to make sure--I think it's
fine to have a compilation, but if we have the individual
entities, I think it would be a deterrent.
Mr. Scott. The intent is the number of customers or
subscribers whom the information disclosed pertained, the
number of communications. Where it says ``entity,'' that's the
Government entity.
Ms. Lofgren. Okay, thank you very much.
Mr. Scott. Thank you.
Chairman Sensenbrenner. Does the gentleman yield back?
Mr. Scott. I yield back.
Chairman Sensenbrenner. The gentleman from Texas?
Mr. Smith. Mr. Chairman, I'm going to express a couple of
concerns about this amendment.
Chairman Sensenbrenner. The gentleman is recognized for 5
minutes.
Mr. Smith. Thank you, Mr. Chairman.
Let me ask the gentleman from Virginia--and I will say that
I haven't seen this amendment until right now, and it comes as
a surprise to me--that it seems to me--a couple of the concerns
that I had would be, first of all, unfunded mandates, in the
sense that we're adding burdens to State and local governments
to compile all this information. And I sort of have a
Constitutional objection to that.
It also seems that we're setting a precedent here in
requiring reports that might impose a burden on the
Administration and just add to the bureaucracy rather than
solving any particular problem.
And I appreciate what the gentleman is trying to do. But as
I recall, if the gentleman is trying to find out whether
there's been an abuse of the process or whether there's been
violations of an individual's civil liberties and so forth,
that just reporting the items that the gentleman has in this
amendment is not going to necessarily disclose that. And so
what I would like to do is to work in good faith with the
gentleman to refine the language, so that we can--if the
gentleman--and it's a worthy goal--try to ferret out any abuse
by law enforcement officials without overreaching.
Mr. Scott. Will the gentleman yield?
Mr. Smith. I'd be happy to yield.
Mr. Scott. This anticipates that if a Government entity
takes advantage of the section, within 90 days, they'll report
that fact to the Attorney General. And the Attorney General
shall publish a 1-year summary, a single report, not an annual
report, a single report, so that we can get a handle on what
happened during the first year of the use of this section.
It is not anticipated that this section would be used very
often, so there shouldn't be--if there is in fact an
administrative burden, that means it is being used a lot more
than you and I anticipate that it would be used.
But we just say that, if the Government entity gets
information, they'll just let the Attorney General know, and
the Attorney General will wrap it up in one report and publish
it, so it should not be a burden.
Mr. Smith. Well, it may not be as much of a burden as it
would be if they were doing these reports on a regular basis.
Mr. Chairman, I think I am not going to object to this
amendment and urge my colleagues to support it, with the
understanding, I might say, if I may engage the gentleman from
Virginia in a colloquy, that he is not going to seek to do this
in future years; this will be a one-time evaluation of the
process.
Mr. Smith. Well, the expectation is that, if things go
well, you would not need to. But if there is abuse--you would
have to pass a new law to get an additional--additional
reports. So, I mean, the thing essentially sunsets itself.
Mr. Smith. Okay.
Okay, Mr. Chairman, I'm going to acknowledge that my
colleague from Virginia is acting in good faith and not trying
to increase the burden on the Government, and I won't object to
this.
Chairman Sensenbrenner. The question is on the Scott
amendment to the amendment in the nature of a substitute.
Those in favor will say aye.
Opposed, no.
The ayes appear to have it. Thy ayes have it, and the
amendment to the amendment in the nature of a substitute is
agreed to.
Are there further amendments?
Ms. Hart. Mr. Chairman?
Chairman Sensenbrenner. The gentlewoman from Pennsylvania.
Ms. Hart. Mr. Chairman, I have an amendment at the desk.
Chairman Sensenbrenner. The Clerk will report the
amendment.
The Clerk. Amendment to the Subcommittee amendment in the
nature of a substitute to H.R. 3482, offered by Ms. Hart, Mr.
Berman, and Ms. Lofgren.
Chairman Sensenbrenner. Without objection, the amendment is
considered as read.
[The amendment follows:]
Chairman Sensenbrenner. And the gentlewoman from
Pennsylvania is recognized for 5 minutes.
Ms. Hart. Thank you, Mr. Chairman.
My amendment is also sponsored by Mr. Berman and Ms.
Lofgren. It addresses an ambiguity in the current law for
warrants issued under the Electronic Communications Privacy
Act. The amendment also addresses issues we raised in the
passage of the USA PATRIOT Act. It would clarify that a law
enforcement officer does not need to be present for a warrant
executed under the Electronic Communications Privacy Act.
With increased communications through e-mail and other
activities on the Internet, acquiring access to this
information is essential for any successful investigation. Much
of this information is in the hands of a third party ISP, and
law enforcement must obtain this information directly from that
ISP. While the ECPA search warrants are issued by neutral
magistrates, they are not generally executed like traditional
search warrants. Law enforcement officials do not routinely
enter the ISP's centers; rather, the ISP accepts the warrant,
assigns it to network technicians to search for the requested
information, then delivers that information in a suitable
format to the officer.
Recently, though, a Michigan Federal district court, in
U.S. v. Bach, ruled that an officer must actually be present
during the execution of the ECPA search warrants. That really
does change what practice has been.
The court had applied a provision originally passed in
1917, which is intended to require officers to be present
during the execution of coercive, physical search. Not only has
this notion never before been recognized by a court, but it
raises a variety of additional problems that my amendment would
seek to resolve.
First, the 1917 provision was designed to protect privacy,
but application of that provision to the ECPA warrant actually
hinders individual privacy. If an officer is required to be
present during the execution of that warrant, they will have
access to all information, including the information of
additional consumers who aren't named in that warrant, that is,
that the ISP's technician has to review to fill the
requirements of the warrant. The court's ruling actually harms
the privacy rights of individuals.
Second, requiring that an officer be present raises a
variety of practical problems for the execution of the warrant.
Investigations will be halted until a law enforcement officer
arrives at each location. More than one ISP may have relevant
information, and that information may be stored in more than
one location, meaning that an officer must be at each location.
This is a drain on the resources of law enforcement agencies.
Third, the requirement imperils any pending case where a
law enforcement official has acquired information from an ISP
without meeting the requirement established by that court.
Finally, this amendment is practical, as it puts into law
established and very workable practice. A large ISP may receive
as many as 500 requests a month for what is fairly
straightforward information.
To require law enforcement to be present when each
amendment is executed is not practical.
The amendment clarifies, again, that an officer need not be
present during the execution of a warrant granted under the
ECPA. It helps law enforcement, it helps ISPs, and most
importantly, it protects the private information of the
consumers that are involved with that ISP.
And I ask for the support of the amendment, and I yield
back.
Chairman Sensenbrenner. The gentlewoman from California.
Ms. Lofgren. Mr. Chairman, I am strongly supportive of this
amendment.
Chairman Sensenbrenner. The gentlewoman is recognized for 5
minutes.
Ms. Lofgren. I want to thank my colleagues, Mr. Berman and
Ms. Hart, for co-sponsoring it.
And I think this is a perfect example of how laws created
long ago for the off-line world really don't make any sense in
the online world. It doesn't make a lot of sense that law
enforcement that should be present in a physical search,
because they have, potentially, a role to play, would have to
be present, overlooking a technician's should and, for the most
part, not even understanding, probably, what that technician is
doing.
So I think this does no harm and certainly does a lot of
good in being efficient. And I strongly support the amendment
and thank the gentlelady for taking the lead on this, and would
yield additional time to Mr. Berman.
Mr. Berman. I thank the gentlelady for yielding, and I'll
be very brief, because I think the author of the amendment
described it quite completely and well.
It's a direct result of a court interpretation, and it's
somewhat counterintuitive, because while you might normally
want to think that it makes sense to have an officer serve the
warrant, when you're dealing with the ISPs, they're getting
thousands of warrants, so it's very inefficient in terms of
time. But it also raises some privacy concerns, because it
allows that officer to have access to communications that are
outside the scope of the investigation.
So both from an efficiency point of view and a privacy
point of view, I think this amendment is appropriate and urge
its passage. And I yield back to the gentlelady.
Ms. Lofgren. Thank you. And, Mr. Chairman, to avoid asking
for an additional 5 minutes, I would also like to praise the
underlying bill, the provision establishing the National Law
Enforcement Corrections Technology Center.
Recently, I had occasion to try and discover, or at least
have validated, a technology that is being deployed for
biometrics. And there's a lot of technology in Silicon Valley;
this is a technology that is not coming out of Silicon Valley.
In fact, it's licensed to a firm in Massachusetts--having to do
with iris scans. And it looks to be the cheapest and most
reliable form of biometrics.
And yet, we would not want to deploy it without some kind
of assessment or validation from a disinterested party. I asked
NIST to take a look at the technology and to tell me whether or
not it was as good as it appeared and was claimed.
But I would just like to note that the establishment of
this National Law Enforcement Corrections Technology Center in
the underlying bill is an excellent advance to make sure that
we are deploying the right technology in law enforcement as
well as other security agencies.
So not only will this amendment make the execution of
warrants tech-friendly, the underlying bill also improves it.
And I yield back my time.
Chairman Sensenbrenner. The question is on agreeing to the
amendment offered by the gentlewoman from Pennsylvania.
Those in favor will say aye.
Opposed, no.
The ayes appear to have it. The ayes have it, and the
amendment is agreed to.
Are there further amendments?
If there are no further amendments, the Chair notes the
presence of a reporting quorum. The question is on the
amendment in the nature of a substitute as amended.
Those in favor will say aye.
Opposed, no.
The ayes appear to have it. The ayes have it.
The question now occurs on the motion to report the bill
H.R. 3482 favorably as amended by the amendment in the nature
of a substitute.
All in favor will say aye.
Opposed, no.
The ayes appear to have it. The ayes have it, and the
motion to report favorably is agreed to.
Without objection, the Chairman is authorized to move to go
to conference pursuant to House rules. Without objection, the
staff is directed to make any technical and conforming changes,
and all Members will be given 2 days, as provided by House
rules, in which to submit additional, dissenting, supplemental,
or minority views.