COMPUTER SECURITY ACT OF 1987

June 11, 1987 - Ordered to be printed

Mr. Roe, from the Committee on Science, Space, and Technology,

submitted the following

REPORT

[To accompany H.R. 145 which on January 6, 1987, was referred jointly to the Committee on Science, Space, and Technology and the Committee on Government Operations]

[Including cost estimate of the Congressional Budget Office]

The Committee on Science, Space, and Technology, to whom was referred the bill (H.R. 145) to provide for a computer standards program within the National Bureau of Standards, to provide for Government-wide computer security, and to provide for the training in security matters of persons who are involved in the management, operation, and use of Federal Computer systems, and for other purposes, having considered the same, report favorably thereon with an amendment and recommend that the bill as amended do pass.

SECTION 1. SHORT TITLE

The Act may be cited as the "Computer Security Act of 1987".

SEC. 2 PURPOSE

(a) IN GENERAL

The Congress declares that improving the security and privacy of sensitive information in Federal computer systems is in the public interest, and hereby creates a means for establishing minimum acceptable security practices for such systems, without limiting the scope of security measures already planned or in use.

(b) SPECIFIC PURPOSES

The Act of March 3, 1901, (15 U.S.C. 271-278h), is amended-

Section 111(d) of the Federal Property and Administrative Services Act of 1949 (40 U.S.C. 759(d)) is amended to read as follows:

"(d)(1) The Secretary of Commerce shall, on the basis of standards and guidelines developed by the National Bureau of Standards pursuant to section 20(a) (2) and (3) of the National Bureau of Standards Act, promulgate standards and guidelines pertaining to Federal computer systems, making such standards compulsory and binding to the extent to which the Secretary determines necessary to improve the efficiency of operation or security and privacy of Federal computer systems. The President may disapprove or modify such standards and guidelines if he determines such action to be in the public interest. The President's authority to disapprove or modify such standards and guidelines may not be delegated. Notice of such disapproval or modification shall be submitted promptly to the Committee on Government Operations of the House of Representatives and the Committee on Governmental Affairs of the Senate and shall be published promptly in the Federal Register. Upon receiving notice of such disapproval or modification, the Secretary of Commerce shall immediately rescind or modify such standards or guidelines as directed by the President.

"(2) The head of a Federal agency may employ standards for the cost effective security and privacy of sensitive information in a Federal computer system within or under the supervision of that agency that ar more stringent than the standards promulgated by the Secretary of Commerce, if such standards contain, at a minimum, the provisions of those applicable standards made compulsory and binding by the Secretary of Commerce.

"(3) The standards determined to be compulsory and binding may be waived by the Secretary of Commerce in writing upon a determination that compliance would adversely affect the accomplishment of the mission of an operator of a Federal computer system, or cause a major adverse financial impact on the operator which is not offset by government-wide savings. The Secretary may delegate to the head of one or more Federal agencies authority to waive such standards to the extent to which the Secretary determines such action to be necessary and desirable to allow for timely and effect implementation of Federal computer systems standards. The head of such agency may redelegate such authority only to a senior official designated pursuant to section 3506(b) of title 44, United States Code. Notice of each such waiver and delegation shall be transmitted promptly to the Committee on Government Operations of the House of Representatives and the Committee on Governmental Affairs of the Senate and shall be published promptly in the Federal Register.

"(4) The Administrator shall revise the Federal information resources management regulations (41 CFR ch. 201) to be consistent with the standards and guidelines promulgated by the Secretary of Commerce under this subsection.

"(5) As used in this subsection, the terms 'Federal computer system' and 'operator of a Federal computer system' have the meanings given in section 20(d) of the National Bureau of Standards Act.".

SEC. 5. FEDERAL COMPUTER SYSTEM SECURITY TRAINING

(a) In General

SEC. 6. ADDITIONAL RESPONSIBILITIES FOR COMPUTER SYSTEMS SECURITY AND PRIVACY.

(a) IDENTIFICATION OF SYSTEMS

(b) SECURITY PLAN

SEC. 7. DEFINITIONS

As used in this Act, the terms "computer system", "Federal computer system", "operator of a Federal computer system", "sensitive information", and "Federal agency" have the meanings given in section 20(d) of the National Bureau of Standards Act (as added by section 3 of this Act).

SEC. 8. RULES OF CONSTRUCTION OF ACT

Nothing in this Act, or in any amendment made by this Act, shall

Computers and information systems have so permeated today's society that there is virtually no sector which does not rely heavily on their use. This includes the Federal Government, which currently has over 17,000 medium- and large-scale computers and will have almost 500,000 microcomputers by 1990, according to a 1985 report by the General Services Administration, entitled "ADP Management of Information Systems".

The Federal Government is the largest single user of computers in the world. Its investment in automated systems technology is so large that about l.6 percent of the 1986 budget was spent on automated data processing (ADP) equipment and services, or more than 15 billion dollars. This budget, included ADP for defense and national security, education, national energy programs, social welfare, and tax problems.

As the role of the Federal Government has become broader, the need to automate and the corresponding need to secure data also has grown. In recent years, Congress and the executive agencies have directed their attention to Federal computer systems in a number of areas, including investigating and commenting on their integrity and security. Both Section 111(f) of the Federal Property and Administrative Service Act of 1949 (as amended by the Brooks Act of 1965) and the Paperwork Reduction Act of represented attempts by Congress to address the issues of automating information in Federal agencies and creating an efficient method of storing and disseminating this information. In October 1984, Congress passed the first Federal computer crime legislation, the Counterfeit Access Device and Computer Fraud Act of 1984 (P.L. 98-473). That law has been amended by the Computer Fraud and Abuse Act of 1986 (P.L. 99-474). This law prohibited "unauthorized access" into "Federal interest computers" affecting national security data, financial data, and other data stored in these computers. In addition, penalties were established for pirated "bulletin boards" containing information which might lead to the fraud or abuse of data in a computer.

Within the Federal Government several agencies have been charged with the responsibility for establishing computer security controls and standards. The Office of Management and Budget (OMB) has overall responsibility for computer security policy. The General Services Administration (GSA) also issues regulations for physical security of computer facilities, and ensures that security hardware and software meet certain technological and fiscal specifications. In defense and national security, the National Security Agency (NSA) has traditionally been responsible for the security of classified information, including that processed by and stored within computers. Recently, NSA has been given the responsibility to establish and maintain technical standards for secure, or "trusted" computers. NSA does this through its administration of the Department of Defense (DOD) National Computer Security Center. NSA also will work with industries at the DOD Computer Security Center to develop security standards for private sector use.

At the Department of Commerce, the National Bureau of Standards' (NBS) Institute of Computer Science and Technology (ICST) has developed computer and processing standards, such as the Data Encryption Standard (DES), which protects data transferred between automated information systems. The Federal Information Processing Standards (FIPS) developed by the ICST provide specific codes, language, procedures, and techniques for Federal and private sector information systems managers. Also at the Department of Commerce, the National Telecommunications and Information Administration (NTIA) has the responsibility for analyzing, developing, implementing and applying executive branch policy for telecommunications in the Federal Government.

CURRENT FEDERAL ROLE

This mixture of laws, regulations, and responsible agencies has raised concern that Federal computer security policy is lacking direction and forcefulness in some areas, yet has created overlapping and duplication of effort in other areas. Recently, Federal regulations and directives have been issued and congressional legislation has been introduced to address the lack of coordination of Federal ADP systems.

On March 15, 1985, OMB issued a draft circular intended "to provide a general framework of management of information resources." This circular combined and updated previous OMB circulars, including OMB Circular A-71 (originally issued in July 1978). The final OMB circular, A130, was issued on December 12, 1985. Appendix III of the circular addressed Federal Government computer security. Those responsible for implementing of this circular include the Department of Commerce, Department of Defense, General Services Administration, and the Office of Personnel Management, in addition to OMB.

On September 17, 1984, the executive branch issued National Security Decision Directive 145 (NSDD-145), "National Policy on Telecommunications and Automated Information Systems Security". This directive is aimed at safeguarding automated information systems with a special focus on protecting those Federal systems accessed via (and dependent on) network communications. NSDD-145 creates a National Telecommunications and Information Systems Security Committee (NTISSC), a panel of 22 voting representatives from 12 defense/intelligence agencies and 10 civilian agencies. An Assistant Secretary of Defense chairs NTISSC, and the Director of the National Security Agency acts as the National Manager for implementing policy under NSDD-145. The NTISSC is empowered to issue operating policies to assure the security of telecommunications and automated information systems that process and communicate both classified national security information and other sensitive information.

On June 27, 1985, Representative Dan Glickman, then chairman of the Subcommittee on Transportation, Aviation and Materials, House Committee on Science and Technology, introduced H.R. 2889, the Computer Security and Training Act of 1985. The intent of this legislation was to establish NBS as the focal point for developing training guidelines for Federal employees who are involved in management, operation, and use of automated information processing systems. This legislation was based in part on hearings which the subcommittee conducted in 1983 and a 1984 subcommittee report which had recommended increased ADP training and awareness in Federal agencies. The Subcommittee on Transportation, Aviation and Materials held hearings on H.R. 2889 on September 24, 1984, June 17, 1985, and October 29 and jointly with the Subcommittee on Science, Research and Technology on October 30, 1985. At the end of the 99th Congress, under House procedures, the bill was brought up for consideration under suspension of rules, the bill failed to obtain the two-thirds vote required and the bill went no further.

On October 29, 1986, National Security Adviser John Poindexter issued National Telecommunications Information Systems and Security (NTISS) policy Directive No. 2. This directive would have added a new "sensitive but unclassified" category of Federal information, setting new classification criteria for information formerly unclassified. It would not only have affected managers, users, and programmers of information systems within the Federal Government, but there was concern that it could have been extended to private sector contractors of the Federal Government as well, potentially restricting the type of information and data released. However, on March 16, 1987, National Security Adviser Frank Carlucci rescinded NTISS Directive No. 2, following negotiations with the committees having jurisdiction over H.R. 145.

On January 6, 1987, Representative Dan Glickman introduced H.R. 145, the Computer Security act of 1987. This legislation, based in part on H.R. 2889 introduced during the 99th Congress would assign the National Bureau of Standards responsibility for developing standards and guidelines for the security of Federal computer systems, drawing upon technical guidelines developed by the National Security Agency, when such guide lines are consistent with the requirements for protecting sensitive information. H.R. 145 also provides for a Computer Systems Advisory Board to identify emerging Federal computer security and privacy issues, advise NBS on these issues, report its findings to the Office of Management and Budget (OMB), NSA, and Congress. The bill also would amend the Brooks Act of 1965 by updating the term "computer"; require establishment of security plans by all operators of Federal computer systems that contain sensitive information; and require mandatory periodic training for all persons involved in management, use, or operation of Federal computer systems that contain sensitive information.

****************************************************************

II. ISSUES RAISED DURING THE HEARINGS

During the 99th Congress, the Subcommittee on Transportation, Aviation and Materials held hearings on Federal computer and communications privacy and security on September 24, 1984, June 27, 1985, and October 29 and jointly with the Subcommittee on Science, Research and Technology on October 30, 1985. During the 100th Congress, the Subcommittee on Transportation, Aviation, and Materials, and the Subcommittee on Science, Research and Technology of the House Science, Space, and Technology Committee held hearings on H.R. 145 on February 26, 1987. The Subcommittee on Transportation, Aviation, and Materials held an additional hearing on May 19, 1987, before final consideration of H.R. 145 by the full House Science, Space and Technology Committee.

These hearings touched upon four major issues: (1) the current state of computer security in the Federal Government; (2) the role of the National Security Agency (NSA) in setting Federal computer security; (3) the issue of privacy and security, particularly with a new "sensitive but unclassified" criteria; and (4) the role of the Federal Government in adequately training Federal employees and heightening awareness of computer security.

FEDERAL COMPUTER CRIME AND SECURITY

99th Congress

Over the course of the 99th Congress, there was a heightened awareness both inside and outside the Federal Government that current computer security measures were inadequate. The American Bar Association, the Inspector General's Office of the Department of Health and Human Services, computer crime experts such as Donn Parker, and industry representatives have repeatedly cited the lack of management, controls, and coordination of computer security in both the private sector and in the Federal Government.

During the September 24, 1984 hearings, John Tompkins, chairman of the Task Force on Computer Crime of the American Bar Association (ABA), commented on a survey conducted by the ABA on the state of computer crime in government and the private sector. The ABA report was one of the first extensive studies done on the number of "known and verifiable losses" which have resulted from computer crimes, and the results of the survey included responses from 13 Federal agencies and 28 State and local agencies. Although the results of the survey indicated a wide range of losses by respondents, several consistent factors emerged: that "insiders" having access to computer systems are the more likely perpetrators of fraud and abuse; that there is a proliferation of computers in government; that such security systems as currently exist do not facilitate detection of computer crimes; that security systems themselves often are vulnerable and inadequate; and that a lack of awareness and concern by the public as well as computer systems managers, are contributing to these problems. Mr. Tompkins noted that, although the ABA did not state any formal recommendations, the conclusions reached by the respondents to the ABA survey indicated: the need for Federal computer crime legislation; the need to adequately train and supervise personnel in data processing; and the large overall cost and expense of computer fraud and abuse.

Richard Kusserow, Inspector General for the Department of Health and Human Services, also testified on the nature of fraud and abuse in Federal computer systems. AS Inspector General for the largest Federal civil agency, Mr. Kusserow's office has been involved with auditing computer systems, reducing costs, and insuring the integrity of HHS ADP systems. As Mr. Kusserow stated at the September 24 hearings:

We must ensure that agency managers in overseeing programs that use computerized systems, do audit the systems, do look and make sure that the controls are functioning, and that we in the inspector general community, using our auditors and investigators, follow up to make sure it's being done. I think that in all of these areas is has not been done nearly enough.

Also, as chairman of the President's Council on Integrity and Efficiency investigating computer crime in the Federal Government, Mr. Kusserow testified on September 24, 1984, and again on October 29, 1985, on a study he directed which examined computer-related fraud and abuse in general, and a subsequent study in which the Inspector General's office interviewed those who had been convicted of Federal computer fraud and abuse. The results of these studies are consistent with the findings of the ABA study: that Federal computer fraud and abuse is often committed by insiders within the Federal agency; that training for computer security and awareness of vulnerabilities in computer systems were lacking; and that internal controls for computer security need to be increased. The profile of Federal computer criminals shows that they are young, considered good employees, and often use co-conspirators, that many who commit these crimes never think about the consequences of being caught, or if they consider the consequences, assess the risk of being caught as minimal. As Mr. Kusserow stated in the October 29 hearing:

One of the most disturbing findings from this study is that the work environment provided the perpetrators with the opportunity to commit their crime. We asked the perpetrators about computer security where they had committed their crime . . . Virtually all of them had been aware of security efforts but most said they had been weak. So, they make the judgment that, although there may have been security efforts in their agencies, they were weak and could not be counted upon to act as a deterrence for them to committing the crime.

The General Accounting Office also testified during the hearings on June 27, 1985, and October 29 and 30, 1985. GAO has conducted several studies on a computer crime and security in the Federal Government, including a 1985 survey of 25 computer systems in 17 Federal civil agencies, to evaluate the state of computer security and integrity of these systems. This survey was conducted by GAO using two questionnaires and subsequent interviews, promising anonymous to the agencies so the systems could not be compromised after public disclosure. GAO indicated that:

Generally, the results of our survey showed that each of the systems is vulnerable to abuse, destruction, error, fraud, and waste. Specifically we found that: key management responsibilities were missing. For example, many agencies do not use a risk management approach as part of implementing a security program; and actual safeguards needed to protect systems from potential threats were not always in place. For example, computerized techniques, such as passwords, allowing access to systems were not periodically changed.

GAO categorized Federal computer security methods into management and three basic safeguard components: physical, technical, and administrative. No agency met all of the management responsibilities outlined in the questionnaire, and only five of the 25 systems evaluated contained an element of physical, technical and administrative control. Only two of the systems provide what GAO described as adequate training for computer employees. GAO further characterized the systems as very vulnerable, and given the minimal oversight and coordination between agencies, GAO found that there is a lack of a balanced approach to security of Federal computer systems.

The testimony by the ABA, the Inspector General's office of HHS, and GAO clearly indicated that Federal systems are in danger because of improper use and negligence. Other witnesses from both the public and private sector testified during the hearings that they also found computer security in general and Federal computer security specifically remains vulnerable and open to fraud and abuse, despite stated efforts by representatives of the Federal agencies to remedy this problem.

100th Congress

After the hearings on H.R. 2889 during the 99th Congress, the House Science and Technology Committee requested that GAO review how successfully appropriate security controls are being incorporated into mission-critical, sensitive systems now being developed in Federal civilian agencies. GAO proceeded to evaluate nine Federal civilian agencies to determine the effectiveness of computer security controls.

GAO evaluators determined during the course of this study that currently there is a lack of effective guidance for assessing whether appropriate security controls are initiated during the development of computer systems. None of the nine agencies reviewed treated information security as one of its functional requirements. According to GAO, six of the nine agencies studied did not address, or inadequately addressed, the sensitivity of the information to be handled in a computer system. Eight of the nine agencies performed no risk analysis of the computer systems in the agency.

Thomas B. Giammo, Associated Director, Information Management and Technology Division of GAO stated during testimony:

Mr. Chairman, our review suggests that the practices currently being used by civilian agencies in the development of mission-critical, sensitive systems will not assure that the appropriate security controls are being successfully incorporated into these systems. Specifically, we reviewed the practices currently being used at nine civilian agencies in the development of nine specific systems. We found that the practices in use at all nine agencies had permitted decisions critical to the specification, design, and construction of all nine systems to be made without adequate management consideration of important security issues.

This evaluation of Federal civilian agencies' lack of computer security planning and management supports the previous GAO study on Federal civilian agency computer security. It also corroborates testimony from other witnesses during hearings on H.R. 145 regarding the need for incorporating security controls into mission-sensitive critical computer systems.

ROLE OF THE NATIONAL SECURITY AGENCY (NSA)

With the introduction of NSDD-145, the prominent role of the NSA in establishing Federal computer security in civilian agencies became a subject of debate among computer security experts. The Subcommittee on Transportation, Aviation and Materials devoted an entire day of hearings to this subject on June 27, 1985, during which representatives from NSA and DOD testified. The role of NSA under NSDD-145 was a topic mentioned during the hearings on October 29 and 30, 1985. The role of NSA under NSDD-145 was further examined during hearings on H.R. 145 on February 26, 1987.

99th Congress

Donald Latham, Chairman of the National Telecommunications and Information Systems Security Committee (NTISSC), Walter Deeley, Deputy Director for Communications Security, NSA, and Robert Brotzman, Director, DOD National Computer Security Center, testified on why NSDD-145 was necessary to coordinate Federal computer security. Citing a lack of overall coordination among Federal agencies, the high risk of compromising, losing or destroying Federal agency data, and the overall vulnerability of Federal computer security systems, they emphasized that the NSA had the experience and expertise to administer Federal computer security programs. As Mr. Latham stated:

We have provided cryptographic devices for protection of classified data, as Mr. Deeley will explain further. While we have done a reasonable job in some areas, there are still many areas that are left uncovered and there is more emphasis needed here.

We have put in controls for tighter access to unclassified data through network access controls and things like this, so that the so-called hackers can't go in and just play havoc with our data.

We are fostering very much a security awareness program. We are instituting training programs at the national level as well as the local level, I'll say, within service schools and across the various agencies. And we are looking at more rigorous ways of clearing people who have access to computer systems and telecommunications network security devices.

Other witnesses appearing before the subcommittee expressed concerns that NSDD-145 would hamper efforts to adequately administer Federal computer security. One area of concern is that NSDD-145 will create conflict with other Federal security regulations, notably Transmittal Memorandum 1 to OMB Circular A-71 (which has since been embodied in OMB Circular A-130, published December 12, 1985). Although both NSDD-145 and the OMB circular are broadly constructed, the emphasis in the OMB circular for planning and implementing Federal computer security rests with civil agencies, primarily with OMB and the Department of Commerce. In NSDD-145, the Director of NSA and the Secretary of Defense have primary roles. NSDD-145 does incorporate many of the lead Federal agencies on its NTISSC panel; but not all agencies are included. When Warren Reed, Director, Information Management and Technology Division, General Accounting Office, testified on the GAO survey on Federal computer security, he stated that the issuance of NSDD-145 might create confusion among the Federal agencies over which agency has jurisdiction over security functions. Mr. Reed stated that this could be a large or small problem, and may interfere with other Federal statutes and regulations which have given this jurisdiction to NBS. Raymond Wyrsch, Senior Attorney, Office of General Counsel at GAO, stated:

* * * we do have laws on the books, the Brooks Act and the Paperwork Reduction Act, and there are very distinct responsibilities that have been placed on these agencies, namely OMB has been given the general oversight authority, if you will to set government policy.

* * * And I don't know if anyone is really in the position to say with any degree of conclusiveness now, on what are the other agencies supposed to do if you have inconsistent or conflicting guidance that may be issued. There have been various pronouncements that have been made by the Secretary of Commerce over the years dealing with ADP standards.

Representative Jack Brooks, Chairman of the Subcommittee on Legislation and National Security of the House Government Operations Committee, and author of the Brooks Act, highlighted these concerns during his testimony on NSDD-145: "NSA has a propensity and a tendency to classify everything." GAO witnesses also expressed concern that a lack of definition of "unclassified information considered sensitive" in civil agencies may be interpreted either broadly or narrowly, significantly affecting how agencies store and disseminate information contained in computer and telecommunications systems. However, Lt. Gen. Odom, Director of NSA, has stated in a letter to Chairman Fuqua on February 25, 1986: ". . . the Systems Steering Group, the senior governmental body created by NSDD-145 for information security matters, has concluded that each government department or agency must make its own determination as to what constitutes sensitive information to that department or agency mission or operation."

Other witnesses, including representatives from the American Civil Liberties Union and the Institute of Electrical and Electronics Engineers, expressed similar concerns over the "unclassified but sensitive" categorization of computerized data and how that will affect citizens' access to public information or freedom to exchange scientific information.

There has been some controversy over the review process for NSDD-145. Expressing concern that issuing National Security Decision Directive 145 effectively circumvents the review process that OMB Circular A-71 went through, Subcommittee Chairman Glickman noted during testimony given on June 27, that a document which ordinarily might be called a regulation, if labeled a national security directive, may avoid the Administrative Procedures Act, all public notification requirements, and Congressional oversight. Also, Mr. Richard P. Kusserow, Inspector General of HHS, stated at the October 29 hearing that "I haven't seen it, and I have not had any input in the process". Still the review process spanned nearly a year and Dr. Robert E. Conley, who was chairman of the Subgroup on Telecommunications Security created under NSDD-145 while he was with the Treasury Department, said at the same hearing that "we invited all of the government agencies to attend the meetings". Thus, although there is no question that Federal computer security is a vital national issue, use of NSDD-145 as an instrument for setting policy, without legislative or agency debate and review, has raised concerns in the Congress.

100th Congress

During the 100th Congress, the debate regarding NSDD-145 and the role of NSA in setting computer security policy for Federal civilian agencies has continued. H.R. 145 states that the responsibility for developing standards and guidelines for the security and privacy of Federal computer systems rests with NBS, with technical advice and assistance coming from NSA "where appropriate". The hearings before the Subcommittee on Transportation, Aviation, and Materials and the Subcommittee on Science, Research and Technology on H.R. 145 at the beginning of the 100th Congress continued to focus on the role of NSA oversight in computer security among the Federal agencies.

Donald Latham, Chairman of the National Telecommunications and Information Systems Security Committee (NTISSC) and Lt. General William Odom, Director of the National Security Agency, testified at the February 26, 1987 hearings on the role of the NSA, the function of NSDD-145, and the form of technical assistance which the defense and military security agencies provide for the Federal Government. Also on February 26, 1987, Raymond Kammer, Deputy Director of the National Bureau of Standards, testified before the two Subcommittees on the role of NBS and his position on NTISS Directive No. 2 and its effect on Federal information security.

Mr. Latham's statement before the House Subcommittees outlined the role of NSA under NSDD-145. Mr. Latham stated that the civilian agencies are represented on two committees created under NSDD-145. These include the Systems Security Steering Group which consists entirely of civilian members of the President's Cabinet (see table 1), which sets overall information security policy for Federal agencies, and the National Telecommunications Information Systems Security Committee (NTISSC) (see table 2 for membership), under which NSA is the National Manager and assists NTISSC in implementing actual Federal computer security. Mr. Latham stated during questioning from Subcommittee Members:

TABLE 1.-SYSTEMS SECURITY STEERING GROUP

Chairman: The Honorable Frank C. Carlucci, Assistant to the President for National Security Affairs.

Executive Secretary: Lieutenant General William E. Odom, USA, National Manager for Telecommunications and Automated Information Systems Security.

Member: The Honorable George P. Shultz, Secretary of State;

The Honorable James A. Baker III, Secretary of the Treasury;

The Honorable Casper W. Weinberger, Secretary of Defense; The Honorable Edwin Meese III, Attorney General; The Honorable James C. Miller III, Director, Office of Management and Budget; and Robert Gates, Acting Director of Central Intelligence.

TABLE 2.-NATIONAL TELECOMMUNICATIONS AND

INFORMATION SYSTEMS SECURITY COMMITTEE (NTISSC)

Chairman: The Honorable Donald C. Latham, Assistant Secretary of Defense C3I. Executive Secretary: John C. Wobensmith.

Members: NSC, Department of State, Department of the Treasury, Department of Defense, Office of Management and Budget, Department of Justice, Department of Commerce, Department of Transportation, Department of Energy, Director of Central Intelligence, General Services Administration, Office of the Joint Chiefs of Staff, Department of the ARmy, Department of the Navy, Department of the Air Force, United States Marine Corps, National Security Agency, Defense Intelligence Agency, Federal Bureau of Investigation, Federal Emergency Management Agency, and National Communications System.

Observers: Federal Communications Commission, Intelligence Community Staff, Defense Communications Agency, National Aeronautics and Space Administration, Nuclear Regulatory Commission, Chairman, SAISS, and Chairman, STS. The Steering Group is chaired by the Assistant to the President for National Security Affairs and then is composed of all civilians from various cabinet level departments that are on the Steering Committee-Treasury, Defense, State, and so on-so that there is, in fact, at the very top of the NSDD-145 structure a group of cabinet level civilians who actually operate the mechanisms that are laid out in 145.

General Odom, in his testimony before the Subcommittee, described the role of the Department of Defense's National Computer Center and the services this Center provides both military and civilian agencies in the Federal Government. Under NSDD-145, the Assistant Secretary of Defense for Command, Control, Communications and Intelligence (C31) chairs NTISSC.

Both Mr. Latham and General Odom, while testifying on the respective roles of NSA and DOD, stated that their main concern with an enhanced role for NBS, as outlined in H.R. 145, would be to duplicate efforts in computer security in the Federal Government. Both Mr. Latham and General Odom praised the role of NBS in providing standards for Federal computer systems, including security. However, both felt that many of the responsibilities outlined for NBS under H.R. 145 are identical to the responsibilities already provided for under NSDD-145, and that NSA and DOD currently are handling these responsibilities capably. In response to a question on how the respective roles of NSA and NBS might be affected under H.R. 145, General Odom stated:

Well, it is my general impression that it would give NBS responsibility for a lot of things we are now doing and would essentially build a duplication, presumably for two different sectors. In other words, you're building computers that are secure for civilian agencies, non-military or intelligence activities, and you would be securing computers or developing a program for those in the Defense Department.

However, despite the concern for duplication and potential overlap of computer security technology and services, there are those who are still concerned that civilian and defense and military computer security policies in the Federal Government should be separated. Specifically, there is concern that, for the sake of a unified Federal computer security policy, the military and defense would gain preeminence over Federal civilian agencies. Representative Glickman stated in his opening remarks before the first panel of witnesses.

* * * the basic concept of this bill, civilian preeminence in determining standards for classified information is the heart of what we are trying to do, not military preeminence * * *

Raymond Kammer, Deputy Director of the National Bureau of Standards, commented on the role of NBS in setting Federal computer security, particularly the role of the Institute of Computer Sciences and Technology at NBS in developing a civilian telecommunications and computer security program. Mr. Kammer stated that he believed that H.R. 145, rather than causing duplication between NBS and NSA, complemented the two agencies.

According to Mr. Kammer:

The bill removes the potential for conflict between the Department of Commerce and the Director of the National Security Agency (NSA) in his capacity as National Manager under National Security Directive 145 (NSDD 145). Conflict has not yet arisen because the level of cooperation between NBS and the National Manager to develop security standards has been satisfactory. We have worked well together.

Mr. Kammer emphasized that there are some technical skills which NSA has which NBS does not have, nor is likely to acquire. Mr. Kammer also responded to questioning on the NBS budget by stating that a larger program involving reimbursable funding, in which Federal agencies pay NBS directly for services contracted out, would be an appropriate method for increasing the Federal civilian computer security budget at NBS.

David Pronko, President of PE Systems, a supplier of encryption devices for both military and private sector communications, added a private sector viewpoint. He was asked to characterize the relative strengths and weaknesses of NSA and NBS with respect to providing security for military and civilian computers. He said:

From the communications security point of view, I feel that NSA has-my own personal view-a much more pragmatic approach and a more methodical approach on handling the communications security. AT NBS, you have really more of a laissez faire approach to it, and here again, it is probably brought about by private industry working within that system.

INFORMATION PRIVACY AND SECURITY

During the Subcommittee hearings on the 99th Congress, several questions were raised about a possible "sensitive but unclassified" categorization of Federal information. When NTISS Directive No. 2 was issued in late 1986, providing a mechanism for a "sensitive but unclassified" category, interest and concern both in the Federal Government and in the private sector grew.

This concern was voiced by several witnesses during the hearings on February 26, 1987. The definitions of "sensitive but unclassified" used in NTISS Directive No. 2 and in H.R. 145 initially appear similar. H.R. 145 defines "sensitive" information as "any information, the loss, misuse, or unauthorized access of which could adversely affect the national interest or the conduct of Federal programs . . . " NTISS Directive No. 2 cited that "sensitive" information is that information in which the "disclosure, loss, misuse, alteration, or destruction could adversely affect national security or other Federal Government interests." But NTISS Directive No. 2 goes on to add that government interests may be those related, but not limited to:

. . . the wide range of government or government-derived economic, human, financial, industrial, agricultural, technological, and law enforcement information, as well as the privacy or confidentiality of personal or commercial proprietary information provided to the U.S. Government by its citizens.

This additional range of activities, along with the intent of classifying this information as "sensitive", concerned many witnesses during the hearings on H. 145. Mr. Kammer of NBS stated:

The definition of sensitive data that's contained in the Poindexter Directive is a totally-in my point of view, at least-is a totally inclusionary definition. There is no data that anyone would spend money on that is not covered by that definition. Therefore, civil data is covered; therefore, the Brooks Act and the Privacy Act are either in conflict with it, or one is superior to the other.

One group of witnesses which responded to the definition of "sensitive" information during the hearings on February 26, 1987 included Jack Simpson, President of Mead Data Central, Inc.;

Kenneth Allen, Senior Vice President, Government Relations, Information Industry Association; Ms. Ceryl Helsing, Information Security Manager, BankAmerica Corporation and Chairman, Data Security Committee, American Bankers Association; and Mr. Geoffrey Turner, Communications Security manager, BankAmerica Corporation. They raised concerns that NSA would apply the "sensitive but unclassified" categorization to commercial databanks (such as NEXIS), which provide a wide range of data on Federal Government policies and laws; as well as raising concerns about the role of NSA in recertifying the Data Encryption Standard (DES), a method of encrypting data in information systems, developed by NBS. NSA had stated it would not recertify DES after 1988.

Many commercial databases are online services in which a user, gaining access to the database through a computer, can retrieve information on a wide variety of subjects. Corporations, news media, Federal, State and Local governments, and the legal, medical and accounting professions use these services for timely and current information. Providers of these services feel that restrictions on the type of information which may be made available to the general public will hurt that industry. Mr. Simpson stated in testimony:

Such new restrictive and unwarranted policies and the unilateral control of the Defense Community threaten to bring this industry to a halt and would negate the significant productivity gains being made in many sectors of our economy including legal, financial, government, medical, and the scientific and technological community.

Mr. Simpson and others also stated that they were not opposed to the restriction of classified data by the national security and defense communities in the Federal Government. But Mr. Simpson stated that no "magical transformation" occurs when unclassified data is entered into a computer; if it is already unclassified in print form, it does not become more important or crucial because it is entered into a computer database. Mr. Simpson opposed the "sensitive" categorization in NTISS Directive No. 2, and supported H.R. 145 during testimony.

The failure to recertify DES and NSA also was criticized by several witnesses during the February 26, 1986 hearings. Failure to recertify is seen by many in the private sector as an attempt by NSA to infringe on a security process for transmitting data. Mr. Turner, commenting on the ability of BankAmerica to safely and expeditiously transfer funds through DES, claimed that a failure to recertify by NSA has led to a "slowdown" in the security of electronic funds transfer and further encryption technology development and use in the financial community. Ms. Helsing also echoed these concerns, and strongly supported the concept of a Computer Security and Privacy Advisory Board, with some minor changes, as recommended by H.R. 145, as a formal measure for private sector communication with the Federal Government on such issues as data encryption.

Other witnesses were concerned that an expanded "sensitive but unclassified" definition would impinge upon personal liberties, as well as the free flow of information vital to scientific and industrial development. Mr. Jerry Berman of the American Civil Liberties Union and Mr. John Richardson of the Institute of Electrical and Electronics Engineers, testified during the 100th Congress on this issue.

Mr. Berman, in his opposition to NSDD-145 and NTISS Directive No. 2, testified that currently there are statutes which protect classified information from disclosure: "If it's classified, protect it. If it's proprietary, trade secrets, there are statutes on the books." Mr. Berman stated that a broad and vague definition would lead to a restriction of information, less free access to information, and less right to know, and he supported H.R. 145 for passage into law. Mr. Berman also stated that since NSA has no public charter, that statutory power to NSA for categorizing sensitive information would lead to a situation in which citizens would not have redress to overturn decisions restricting sensitive information.

Mr. Richardson, also testifying on February 26, 1987, opposed NTISS Directive No. 2, and supported H.R. 145, because of concerns which the IEEE has that a new categorization of information as sensitive might restrict the free flow of information vital to U.S. economic survival. Mr. Richardson stated:

The IEEE thinks, in this regard, that the unabridged dissemination of unclassified scientific and technical information is crucial for the continued advancement of U.S. industry, and we oppose restraints on its exchange.

Mr. Richardson stated that such exchanges would be severely restricted under NTISS Directive No. 2. He stated that both government and non-government information might qualify for this classification, and supported H.R. 145 as an alternative to separate the protection of computer systems which deal with national security information, from those computer systems dealing with non-national security information. Mr. Richardson also expressed some dissatisfaction with the definition of "sensitive" as outlined in H.R. 145, believing that it was, like the NTISS definition, too broad and general.

These witnesses, representing a variety of perspectives and concerns, felt that NTISS Directive No. 2, with its expanded definition of "sensitive" data, would impair the use of data bases, the ability to encrypt data, the protection of civil liberties, and the free flow of scientific and technical information. All supported the general intent of H.R. 145. The subsequent rescinding of NTISS Directive No. 2 in March, 1987, resulted in part from this opposition over the nature and intent of this directive.

TRAINING FOR FEDERAL COMPUTER SYSTEMS USERS

Testimony from the hearings during the 99th Congress emphasized the need for greater training of personnel responsible for computer security training of personnel in the Federal Government. GAO, ABA, the Inspector General of HHS, and others commented on the current state of Federal computer training during the course of the Subcommittee on Transportation, Aviation and Materials hearings.

H.R. 2889, as introduced by Representative Glickman during the 99th Congress, would have established a focus within the Federal Government at the National Bureau of Standards for computer security research, and development of computer security guidelines. The intent of this provision was to ensure that agencies would better train personnel in the vulnerabilities of computer and communication systems. On the last day of testimony before the two subcommittees on October 30, 1985, witnesses dealt directly with H.R. 2889 and the need for Federal computer security training.

There is little argument that such training is needed or that in some areas, that much is needed to supplement existing training procedures. Most of the witnesses testifying on the current state of Federal computer security commented that computer security training the Federal Government is either inadequate or nonexistent and that such training is necessary. William Franklin, Associate Director, Information Management and Technology Division, GAO, stated on October 30:

There can be little question that extensive and continuing security research and training are essential if we are to gain reasonable assurance that our computerized information is properly safeguarded in storage, processing and transmission.

However, there was concern that the creation of a new structure within the Federal Government might add unnecessarily to its overall cost and bureaucracy. Several witnesses stated that existing Federal computer training facilities, such as those at NSA, should be used to train Federal employees. Robert Brotzman, Assistant Director for Computer Security at the National Computer Security Center at NSA, described the security program at the Computer Security Center. This program assists civilian and military agencies, as well as outside contractors with sensitive data, to develop secure information and communication systems. As Mr. Brotzman stated:

The knowledge base that we have now will support an effective training program, and it will support the substantial improvement in the security of computer systems operated by and for the United States Government.

James Burrows, Director, Institute for Computer Sciences and Technology (ICST), of the NBS, spoke on the computer training and security programs at the ICST. As part of its mandate to develop computer security standards and guidelines, the ICST assists Federal agencies in developing computer security programs. This includes both software and hardware development, system interfaces, personal identification and authentication of users. The Department of Commerce opposed the structure of H.R. 2889 because of its interpretation that the Brooks Act and other legislation makes a Federal computer training and awareness mandate for NBS unnecessary. However, Mr. Burrows did state that NSDD-145 could be "slightly confusing in who has control" of overall Federal security management among the agencies. Mr. Burrows also stated that, to date, NSDD-145 has had little adverse effect on NBS' activities in computer security and training.

Several of the witnesses did speak in favor of Federal computer training legislation, although they also suggested changes in the language and intent of H.R. 2889. Donn Parker, a computer crime and security expert at SRI International, also spoke on October 30 on computer security in general, while testifying on H.R. 2889. Mr. Parker made several observations: that it is the information, not the technology, which needs security; that information must be considered secure before it goes into the computer; that technology controls to date are inadequate-it is the management of "human controls" which need improvement; that most information systems employees consider security a detriment to productivity, therefore, that measures must be taken to incorporate computer security into personnel performance evaluations; that each individual must be held accountable for taking security precautions, to ensure that these measures are taken; that advisory and counseling provisions within an organization can short-circuit the stresses and problems which may drive someone to commit a computer crime; that all information systems workers, not just computer programmers, should be trained in securing systems; and that training should be broadened to include a wider range of potential vulnerabilities, including the full civil, military, and private sector prospective of computer training and awareness.

William Franklin of GAO also addressed H.R. 2889:

We endorse the bill's purpose in requiring the National Bureau of Standards to establish and conduct a computer security research program in the Federal Government and the requirement that each Federal agency provide mandatory periodic training in computer security.

Testimony during the 100th Congress also touched upon the current state of computer security and the need for training of Federal employees. This issue was discussed specifically during the May 19, 1987 testimony by GAO of its investigation of the computer security policies of nine Federal agencies. Other witnesses, during the hearings on February 26, 1987, on H.R. 145, stated that the overall responsibility for civilian Federal computer security policies should rest in the civilian agencies. Under H.R. 145, the focus for training civilian Federal agency personnel for computer security again would be placed with the National Bureau of Standards. The need for a strong computer security training program for Federal employees is still seen as a necessary and vital aspect of ensuring Federal computer security.

David Pronko, President of PE Systems, responded to a question about whether NSA or NBS could provide the training envisioned in H.R. 145.

At this stage, from what I've seen and in my earlier comments, I'm not sure either has a leg on the other as far as the computer security training right now. It seems that the NSA within the last few years has gained a foot hold in that arena, due to their programs.

III. NEED FOR LEGISLATION

PURPOSE

The purpose of H.R. 145, the Computer Security Act of 1987, as amended, is to improve the security and privacy of sensitive information in Federal computer systems. It achieves this purpose through improved training, aimed at raising the awareness of Federal workers about computer system security, by establishing a focal point within the government for developing computer system security standards and guidelines to protect sensitive information, and by requiring agencies to establish computer system security plans.

To explain what these mean, it is first necessary to examine several underlying concepts that define and scope the boundaries of the bill's coverage. First, the primary objective of the bill is controlling unauthorized use of the information in Federal computer systems, rather than merely protecting the computer systems themselves. Although computer hardware and software have real value and certainly must be safeguarded, it is the data stored, manipulated, displayed and transmitted by computer systems that represent the greatest vulnerability. Nevertheless, computer systems are the instrumentality through which security measures are usually applied. Therefore, the bill makes distinctions both about which computer systems are included as well as about what kinds of information are subject to the bill's provisions.

Second, the term "computer system" as used throughout the bill is defined to be essentially identical to the term "automatic data processing equipment" in Section 111 of the Federal Property and Administrative Services Act of 1949 (Brooks Act). A computer system is described structurally to include traditional hardware (computers and ancillary equipment), software, firmware, procedures for use of the system by people, services intended to provide support to the operation of the system, and related resources as defined in regulations issued by the Administrator of General Services. A computer system is also described functionally to include any equipment or interconnected system or subsystems used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information.

The term "federal computer system" is used to delineate the reach of the bill to include federal agencies, contractors of federal agencies, and other organizations that process information using a computer system on behalf of the federal government to accomplish a federal government function. The latter category is limited to cases where there is a direct federal interest. Examples would include state agencies that disburse federal funds, monitor compliance with federal regulations on behalf of the federal government, collect statistical information for the purpose of federal funding decisions, or act in some other way as a direct extension of the federal government. The measures used for protecting sensitive information in such cases, just as elsewhere, must be cost effectively applied and commensurate with the risk and magnitude of harm. The term "operator of a federal computer system" denotes an agency or institution that owns or otherwise possesses a federal computer system, rather than an individual who physically operates the machine. The term "sensitive information" is used to limit the kinds of information which are covered by the bill. It is intended to guide the National Bureau of Standards as to the kinds of information it should address in the standards development process. It is not intended to authorize establishment of a formal new category of information. (See discussion on Rules of Construction.) Sensitive information is defined as unclassified information which, if lost, misused, accessed or modified in an unauthorized way, could adversely affect the national interest the conduct of federal programs or the privacy of individuals.* Examples include information which if modified, destroyed or disclosed in an unauthorized manner could cause:

Loss of Life; Loss of property or funds by unlawful means; Violation of personal privacy or civil rights; Gaining of an unfair commercial advantage; Loss of advanced technology, useful to a competitor; or Disclosure of proprietary information entrusted to the government.

The definition of sensitive information allows the possibility that some unclassified information may not be sensitive. Each operator of a federal computer system must make a determination (as described later) as to which unclassified information in its possession is sensitive. Sensitive information does not include nor does the bill apply to classified information for which extensive standards-setting authority already exists. These mechanisms are unaffected by H.R. 145.

ADDITIONS TO NBS ORGANIC ACT

H.R. 145 amends the Act of March 3, 1901, creating the National Bureau of Standards, to add the mission of developing standards, guidelines and associated methods and techniques for computer systems to the list of authorized activities of the agency. The reason for this language is to provide specific authorization for activities that are widely acknowledged as necessary in the computer age, but which are conducted currently under general authorities contained in the Act. It is intended to authorize NBS to study the means of automatic computation (computer science) independent of the technology involved. Therefore, this clarification of NBS' Organic Act sets out the NBS mission in computer science in general and does not focus on computer security.

But which has not been specifically authorized under criteria established by Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. The bill also adds three new sections to the Act of March 3,

1901. Section 20 provides a hierarchy enumeration of NBS' responsibilities. At the top of the hierarchy is the mission of developing standards, and associated methods and techniques for computer systems generally. An example would be the "Open Systems Interconnection" (OSI) standards for computer networking, which the Bureau develops technically (with extensive private sector input) and presents to the American National Standards Institute, and through it to the International Standards Organization, for adoption. This statement of responsibility is intended to conform Section 20 with the above addition to the list of authorized activities.

At the next hierarchical level NBS is responsible for developing uniform standards and guidelines, in all areas other than security, for federal computer systems. As before, this delineation of responsibility is intended to conform Section 20 and to provide specific authority for activities that are currently carried out under general provisions of the Organic Act. The product of this effort is the Federal Information Processing Standards (FIPS) which are used government-wide.

In current practice, some computer standards developed by NBS become compulsory under authority of OMB pursuant to the Brooks Act and the Paperwork Reduction Act. The process outlined in H.R. 145--which includes standards development by NBS and subsequent promulgation by the Secretary of Commerce under redrafted authority in the Brooks Act (to be described later)--is essentially the same as current practice, but is spelled out more explicitly.

Systems involving intelligence activities, cryptologic activities related to national security, direct command and control of military forces, equipment that is integral to a weapons system or direct fulfillment of military or intelligence missions (except routine administrative and business functions) are exempted from this provision. Such systems are highly specialized in their functions and have been traditionally exempted from government-wide standards and regulations applying to general purpose computer systems. Therefore, the boundary of NBS' responsibility for non-security standards is drawn so as to exclude such defense-related, special-purpose systems.

The third hierarchial level spells out explicitly, and thereby gives special emphasis to, responsibility for standards and guidelines in the computer security arena. It assigns to NBS responsibility within the federal government for developing technical, management, physical and administrative standards and guidelines designed to achieve, in a cost-effective way, the security and privacy of sensitive information in federal computer systems. The purpose of the standards and guidelines is to control loss and unauthorized modification or disclosure of sensitive information and to prevent computer-related fraud and abuse.

H.R. 145 contains a redrafted version of section 111(d) of the Federal Property and Administrative Services Act of 1949. The chief purpose is to establish an orderly process for promulgating standards and guidelines pertaining to Federal computer systems. Specifically, the Secretary of Commerce is charged with issuing standards and guidelines based on the standards and guidelines developed by NBS, pursuant to two subsections in the amendment to the NBS Act. As explained, those subsections formalize NBS' responsibility for developing both non-security and security standards and guidelines. The Secretary is authorized to make certain standards compulsory and binding as needed to improve the efficiency of operation or security and privacy of federal computer systems. The President may disapprove or modify the standards and guidelines if he determines such action to be in the public interest.

As described earlier, the amendment contains relief from strict compliance with these standards, when agencies already employ standards that are more stringent. An example is the instance where the unclassified operations of a mixed system are conducted under a subset of the rules used during classified operations, provided the subset is tougher than the standards mandated by the Secretary.

Further relief is provided by language authorizing the Secretary of Commerce to waive the compulsory standards when compliance would adversely affect an operator's mission or cause major financial impact on the operator that is not offset by government-wide savings. The Secretary may delegate this authority to agency heads when necessary and desirable to achieve timely and effective implementation of measures to improve federal computer system security and privacy. Agency heads may redelegate this authority only to certain high level officials, designated pursuant to the Paperwork Reduction Act for the purpose of carrying out the agencies information management activities under that Act. The need for delegation authority arises from Committee concerns about the administrative burden on NBS. Under normal procedures, the Secretary can be expected to rely on NBS for technical evaluation of any requests for waiver. The Committee expects NBS to devote the bulk of its energy to producing computer systems standards, rather than to such compliance determinations. Accordingly, the amendment to the Brooks Act allows the Secretary flexibility to delegate the waiver authority.

The amendment ties the process for developing and promulgating computer system standards to the requirement for an integrated information resources management system, as set forth in the Paperwork Reduction Act. To achieve this, the Administrator of General Services is charged with developing and implementing policies on federal computer systems and revising the federal information resources management regulations to reflect the standards and guidelines emanating from the Secretary of Commerce.

TRAINING

One of the fundamental purposes of H.R. 145 is improved computer security awareness and use of accepted computer security practice by all persons involved in management, use, or operation of federal computer systems that contain sensitive information. As indicated, the Committee found in its hearings that training in these areas is a particular weakness at most agencies. A GAO study revealed, for example, that only two of twenty-five major federal computer systems surveyed had adequate training programs. For this reason, the bill contains a requirement that each Federal agency provide for the periodic training of all employees involved with the management, use or operation of each Federal computer system within or under the supervision of that agency. The objectives of the training are to enhance employees' awareness of the threats and vulnerabilities of computer systems and to encourage the use of improved security practices.

The process envisioned in the bill starts with NBS, which is responsible for developing training guidelines based on its research and study of vulnerabilities and countermeasures. Within six months of enactment and using these guidelines, the Office of Personnel Management must issue regulations covering such areas as training objectives for various categories of employee, general guidance concerning course content and frequency of training. Strictly speaking, the regulations issued by OPM under this section apply only to Federal civilian employees. The overall effect of the section, however, is to extend the regulations' applicability to employees of all operators of a Federal computer system as defined in the bill. The bill specifies that training begin within 60 days after the issuance of regulations by OPM. Each Federal agency is responsible for making provisions for the training of its own employees as well as those of contractors and other organizations that it supervises. Training should be tailored to the particular operating conditions and needs of each operator. Agencies may provide for the training in a variety of ways. For example, an agency may use its internal training capabilities or the services of training providers such as OPM or private companies. For the employees of contractors and other organizations under the supervision of an agency, the agency may use any available contractual or management instrument to require the operator to conduct periodic training in accordance with the NBS training guidelines and the OPM regulations. In so doing, the Committee expects that the agency will require the operator to bear the costs associated with furnishing the training. An agency head may approve an alternative training program which he determines to be at least as effective in accomplishing the objectives of the NBS guidelines and OPM regulations.

A key determination upon which many provisions of the bill depend is the identification of which Federal computer systems contain sensitive information. By definition, the search for such systems is restricted to systems containing unclassified information. Some, but possibly not all of these systems will be determined to contain unclassified-sensitive information. The philosophy reflected in the bill is that each Federal agency is best equipped to make that determination relative to its own mission and circumstances. Therefore, the bill calls on each agency to make a determination for each computer system under its control, within six months of enactment. The determination should be based on the definition of "sensitive" contained in the bill and use the additional guidance in the section on purpose in this report.

Within one year of enactment, each agency must also establish a plan for the security and privacy of each computer system so identified. Plans are to be based on the standards and guidelines issued by the Secretary of Commerce pursuant to the Brooks Act, or any waivers received. This requirement applies only to those computer systems subject to the provision of that Act. Plans are also to be commensurate with the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of the information being protected. Copies of the plans must be submitted to the National Bureau of Standards and the National Security Agency for advise and comment and to the Office of Management and Budget, which has the authority to disapprove the plan.

Implicit in the authority to disapprove security plans is responsibility for oversight of the identification process and compliance with the security plans as approved. Thus, OMB is the watchdog over the key implementation step in the bill.

RULES OF CONSTRUCTION

The purpose of this section is to make it explicitly clear that the Computer Security Act has no bearing on the public availability or use of information. The designation of information as sensitive [or as subject to protection] under the Computer Security Act is not a determination that the information is not subject to public disclosure.

The Computer Security Act is strictly neutral with respect to public disclosure of information. Any information that was required to be disclosed under the Freedom of Information Act or other laws before enactment of the Computer Security Act will still have to be disclosed after enactment. Requests for information that was previously subject to withholding and that continues to qualify for withholding may be denied.

Also, the Act may not be construed to expand the authority of any Federal agency to limit, restrict, regulate, or otherwise control the collection, maintenance, disclosure, use, transfer, or sale of (1) any privately-owned information; (2) any information disclosable under the Freedom of Information Act or other law requiring or authorizing the public disclosure of information by Federal agencies; or (3) any public domain information. This restriction on government authority applies regardless of the medium in which the information may be maintained. For example, in recent months, interest has been expressed by some Federal officials in restricting or monitoring use of unclassified, private sector computerized databases such as LEXIS and NEXIS. This section makes it explicitly clear that no such authority is granted to agencies by the Computer Security Act.

V. SECTIONAL ANALYSIS-H.R. 145

Section 1. Short Title

Section 2. Purpose

: Sets forth the Congressional declaration that improving the security and privacy of federal computer systems is in the public interest and states Congressional intent to institute a means for establishing minimum acceptable security practices for such systems, without limiting the scope of security measures already planned or in use.

The specific purposes of the Act are to assign the National Bureau of Standards responsibility for developing standards and guidelines for Federal computer systems, including standards and guidelines for the cost-effective security and privacy of sensitive information in Federal computer systems drawing upon the technical advice and assistance of the National Security Agency, where appropriate; to provide for promulgating such standards and guidelines through the Federal Property and Administrative Services Act of 1949; to require all operators of Federal computer systems that contain sensitive information to establish security plans; and to require mandatory periodic training for all persons involved in management, use or operation of Federal computer systems that contain sensitive information.

Section 3. Establishment of Computer Standards Program

Amends the Act of March 3, 1901 to add to the mission of the National Bureau of Standards the study of computer systems, as defined in section 20(d) of the NBS Act, and their use to control machinery and processes.

Additional Responsibilities for Computer Systems Security and Privacy. Directs that within 6 months after the date of enactment each Federal agency shall identify each Federal computer system, and system under development, which is within or under the supervision of that agency and which contains sensitive information.

Provides that within one year after the date of enactment of this Act, each such agency shall, consistent with the standards, guidelines, policies, and regulations prescribed pursuant to section 111(d) of the Federal Property and Administrative Services Act of 1949, establish a plan for the security and privacy of each Federal computer system identified by that agency that is commensurate with the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of the information contained in such system. Copies of each such plan shall be transmitted to the National Bureau of Standards and the National Security Agency for advice and comment. A summary of such plan shall be included in the agency's five-year plan required by section 3505 of title 44, United States Code. Such plan shall be subject to disapproval by the Director of the Office of Management and Budget. Such plan shall be revised annually as necessary.

Section 7. Definitions

Defines the terms "computer system", "Federal computer system", "operator of a Federal computer system", "sensitive information", and "Federal agency" as having the meanings given in section 20(d) of the National Bureau of Standards Act (as added by section 3 of this Act).

In accordance with Rule XI, Clause 2(l)(4), of the Rules of the House of Representatives, this legislation is assessed to have no adverse inflationary effect on prices and costs in the operation of the national economy.

**************************************************************

VII. COMMITTEE OVERSIGHT FINDINGS AND RECOMMENDATIONS

Pursuant to Rule XI, Clause 2(l)(3)(A), and under the authority of Rule X, Clause 2(b)(l) and Clause 3(f), of the Rules of the House of Representatives, the following statement on oversight activities is made:

The Committee's oversight findings are incorporated in the recommendations contained in the present bill and report.

****************************************************************

VIII. OVERSIGHT FINDINGS AND RECOMMENDATIONS

BY THE COMMITTEE ON GOVERNMENT OPERATIONS

Pursuant to Rule XI, Clause 2(l)(3)(D), and under the authority of Rule X, Clause 2©(2), of the Rules of the House of Representatives, the following statement on oversight activities by the Committee on Government Operations is made:

The Committee's oversight findings are reflected in the recommendations contained in the bill as reported by that Committee and the accompanying report.

*****************************************************************

IX. BUDGET ANALYSIS AND PROJECTION

The bill provides for new authorization rather than new budget authority and consequently the provisions of Section 308(a) of the Congressional Budget Act are not applicable.

X. CONGRESSIONAL BUDGET OFFICE COST ESTIMATE

Pursuant to Section 403 of the Congressional Budget Act of 1974 and Rule XI, Clause 2(l)(3) of the Rules of the House of Representatives, the report of the Congressional Budget Office follows:

CONGRESSIONAL BUDGET OFFICE COSTS ESTIMATE

EXECUTIVE OFFICE OF THE PRESIDENT

OFFICE OF MANAGEMENT AND BUDGET

Washington, DC, May 12, 1987

Hon. Robert A. Roe,

Chairman, Committee on Science, Space and Technology, U.S. House of Representatives, Washington, DC.

DEAR MR. CHAIRMAN: I am pleased that through intensive consultations between the Administration and the Congress great progress has been made toward agreement on a Computer Security Act of 1987. I hope that this statement of Administration views will assists in offering construction solutions to areas where further improvements are desirable.

As we have reviewed H.R. 145, a primary concern has been to assure that the roles of the National Security Agency (NSA) are discharged in a manner that will promote a sound public policy and result in efficient/cost effective, and productive solutions. In this regard it is the Administration's position that NBS in so far as they are available and consistent with the requirements of civil departments and agencies to protect data processed in their systems. When developing technical security guidelines, NSA will consult with NBS to determine how its efforts can best support such requirements. We believe this would avoid costly duplication of effort.

Computer security standards, like other computer standards, will be developed in accordance with established NBS procedures. In this regard the technical security guidelines provided by NSA to NBS will be treated as advisory and subject to appropriate NBS review. In cases where civil agency needs will best be served by standards that are not consistent with NSA technical guidelines, the Secretary of Commerce will have authority to issue standards that best satisfy the agencies' needs. At the same time agencies will retain the option to ask for Presidential review of standards issued by the Department of Commerce do not appear to be consistent with U.S. public interest, including that of our national security. I am enclosing proposed changes to the present text of H.R. 145 which are consistent with the NBS-NSA relationship outlined above and make several minor changes that would further improve the bill.

In closing, I want to assure you that a reported bill within the parameters outlined in this letter will have the Administration's support.

Sincerely yours,

JAMES C. MILLER III, Director

****************************************************************

CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED

In compliance with clause 3 of rule XIII of the Rules of the House of Representatives, changes in existing law made by the bill, as reported, are shown as follows (existing law proposed to be omitted is enclosed in black brackets, new matter is printed in italic, existing law in which no change is proposed is shown in roman):

ACT OF MARCH 3, 1901

AN ACT To establish the National Bureau of Standards

* * * * * * *

SEC. 2. The Secretary of Commerce (hereinafter referred to as the "Secretary") is authorized to undertake the following functions:

(a) * * *

* * * * * * *

(f) Invention and development of devices to serve special needs of the Government.

(1) the term "computer system"-