II
112th CONGRESS
1st Session
S. 372
IN THE SENATE OF THE UNITED STATES
February 16, 2011
Mr. Cardin (for himself and Mr. Whitehouse) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation
A BILL
To reduce the ability of terrorists, spies, criminals, and other malicious actors to compromise, disrupt, damage, and destroy computer networks, critical infrastructure, and key resources, and for other purposes.
Short title
This Act may be cited as
the Cybersecurity and Internet Safety
Standards Act
.
Definitions
In this Act:
Computers
Except
as otherwise specifically provided, the term computers
means
computers and other devices that connect to the Internet.
Providers
The
term providers
means Internet service providers, communications
service providers, electronic messaging providers, electronic mail providers,
and other persons who provide a service or capability to enable computers to
connect to the Internet.
Secretary
Except
as otherwise specifically provided, the term Secretary
means the
Secretary of Homeland Security.
Findings
Congress finds the following:
While the Internet has had a profound impact on the daily lives of the people of the United States by enhancing communications, commerce, education, and socialization between and among persons regardless of their location, computers may be used, exploited, and compromised by terrorists, criminals, spies, and other malicious actors, and, therefore, computers pose a risk to computer networks, critical infrastructure, and key resources in the United States. Indeed, users of computers are generally unaware that their computers may be used, exploited, and compromised by others with spam, viruses, and other malicious software and agents.
Since computer networks, critical infrastructure, and key resources of the United States are at risk of being compromised, disrupted, damaged, or destroyed by terrorists, criminals, spies, and other malicious actors who use computers, cybersecurity and Internet safety is an urgent homeland security issue that needs to be addressed by providers, technology companies, and persons who use computers.
The Government and the private sector need to work together to develop and enforce minimum voluntary or mandatory cybersecurity and Internet safety standards for users of computers to prevent terrorists, criminals, spies, and other malicious actors from compromising, disrupting, damaging, or destroying the computer networks, critical infrastructure, and key resources of the United States.
Cost-benefit analysis
Requirement for analysis
The Secretary, in consultation with the Attorney General, the Secretary of Commerce, and the Director of National Intelligence, shall conduct an analysis to determine the costs and benefits of requiring providers to develop and enforce voluntary or mandatory minimum cybersecurity and Internet safety standards for users of computers to prevent terrorists, criminals, spies, and other malicious actors from compromising, disrupting, damaging, or destroying computer networks, critical infrastructure, and key resources.
Factors
In conducting the analysis required by subsection (a), the Secretary shall consider—
all relevant factors, including the effect that the development and enforcement of minimum voluntary or mandatory cybersecurity and Internet safety standards may have on homeland security, the global economy, innovation, individual liberty, and privacy; and
any legal impediments that may exist to the implementation of such standards.
Consultation
In conducting the analysis required by section 4, the Secretary shall consult with the Attorney General, the Secretary of Commerce, the Director of National Intelligence, the Federal Communications Commission, and relevant stakeholders in the Government and the private sector, including the academic community, groups, or other institutions, that have scientific and technical expertise related to standards for computer networks, critical infrastructure, or key resources.
Report
In general
Not later than 1 year after the date of the enactment of this Act, the Secretary shall submit to the appropriate committees of Congress a final report on the results of the analysis required by section 4. Such report shall include the consensus recommendations, if any, for minimum voluntary or mandatory cybersecurity and Internet safety standards that should be developed and enforced for users of computers to prevent terrorists, criminals, spies, and other malicious actors from compromising, disrupting, damaging, or destroying computer networks, critical infrastructure, and key resources.
Appropriate committees of Congress
In this section, the term
appropriate committees of Congress
means—
the Committee on Commerce, Science, and Transportation, the Committee on Homeland Security and Governmental Affairs, and the Committee on the Judiciary of the Senate; and
the Committee on Energy and Commerce, the Committee on Homeland Security, the Committee on the Judiciary, and the Committee on Oversight and Government Reform of the House of Representatives.