synchro.net/synchro.net.tar/synchro.net/main/INTERNET/S2430IS.TXT

INI File | 2000-04-12 | 23.0 KB | 405 lines

[Congressional Record: April 13, 2000 (Senate)]
[Page S2729-S2771]
From the Congressional Record Online via GPO Access [wais.access.gpo.gov]
[DOCID:cr13ap00pt2-155]


          STATEMENTS ON INTRODUCED BILLS AND JOINT RESOLUTIONS

[Excerpt]

      By Mr. LEAHY:
  S. 2430. A bill to combat computer hacking through enhanced law
enforcement and to protect the privacy and constitutional rights of
Americans, and for other purposes; to the Committee on the Judiciary.

                     Internet Security Act of 2000

  Mr. LEAHY. Mr. President, as we head into the twenty-first century,
computer-related crime is one of the greatest challenges facing law
enforcement. Many of our critical infrastructures and our government
depend upon the reliability and security of complex computer systems.
We need to make sure that these essential systems are protected from
all forms of attack. The legislation I am introducing today will help
law enforcement investigate and prosecute those who jeopardize the
integrity of our computer systems and the Internet.
  Whether we work in the private sector or in government, we negotiate
daily through a variety of security checkpoints designed to protect
ourselves from being victimized by crime or targeted by terrorists. For
instance, congressional buildings like this one use cement pillars
placed at entrances, photo identification cards, metal detectors, x-ray
scanners, and security guards to protect the physical space. These
security steps and others have become ubiquitous in the private sector
as well.
  Yet all these physical barriers can be circumvented using the wires
that run into every building to support the computers and computer
networks that are the mainstay of how we communicate and do business.
This plain fact was amply demonstrated by the recent hacker attacks on
E-Trade, ZDNet, Datek, Yahoo, eBay, Amazon.com and other Internet
sites. These attacks raise serious questions about Internet security--
questions that we need to answer to ensure the long-term stability of
electronic commerce. More importantly, a well-focused and more malign
cyber-attack on computer networks that support telecommunications,
transportation, water supply, banking, electrical power and other
critical infrastructure systems could wreak havoc on our national
economy or even jeopardize our national defense. We have learned that
even law enforcement is not immune. Just recently we learned of a
denial of service attack successfully perpetrated against a FBI web
site, shutting down that site for several hours.
  The cybercrime problem is growing. The reports of the CERT
Coordination Center (formerly called the ``Computer Emergency Response
Team''), which was established in 1988 to help the Internet community
detect and resolve computer security incidents, provide chilling
statistics on the vulnerabilities of the Internet and the scope of the
problem. Over the last decade, the number of reported computer security
incidents grew from 6 in 1988 to more than 8,000 in 1999. But that
alone does not reveal the scope of the problem. According to CERT's
most recent annual report, more than four million computer hosts were
affected by the computer security incidents in 1999 alone by damaging
computer viruses, with names like ``Melissa,'' ``Chernobyl,''
``ExploreZip,'' and by the other ways that remote intruders have found
to exploit system vulnerabilities. Even before the recent headline-
grabbing ``denial-of-service'' attacks, CERT documented that such
incidents ``grew at rate around 50% per year'' which was ``greater than
the  rate of growth of Internet hosts.''

  CERT has tracked recent trends in severe hacking incidents on the
Internet and made the following observations, First, hacking techniques
are getting more sophisticated. That means law enforcement is going to
have to get smarter too, and we need to give them the resources to do
this. Second, hackers have ``become increasingly difficult to locate
and identify.'' These criminals are operating in many different
locations and are using techniques that allow them to operate in
``nearly total obscurity.''
  We have been aware of the vulnerabilities to terrorist attacks of our
computer networks for more than a decade. It became clear to me, when I
chaired a series of hearings in 1988 and 1989 by the Subcommittee on
Technology and the Law in the Senate Judiciary Committee on the subject
of high-tech terrorism and the threat of computer viruses, that merely
``hardening'' our physical space from potential attack would only
prompt committed criminals and terrorists to switch tactics and use new
technologies to reach vulnerable softer targets, such as our computer
systems and other critical infrastructures. The government has a
responsibility to work with those in the private sector to assess those
vulnerabilities and defend them. That means making sure our law
enforcement agencies have the tools they need, but also that the
government does not stand in the way of smart technical solutions to
defend our computer systems.
  Targeting cybercrime with up-to-date criminal laws and tougher law
enforcement is only part of the solution. While criminal penalties may
deter some computer criminals, these laws usually come into play too
late, after the crime has been committed and the injury inflicted. We
should keep in mind the adage that the best defense is a good offense.
Americans and American firms must be encouraged to take preventive
measures to protect their computer information and systems. Just
recently, internet providers and companies such as Yahoo! and
Amazon.com Inc., and computer hardware companies such a Cisco Systems
Inc., proved successful at stemming attacks within hours thereby
limiting losses.
  That is why, for years, I have advocated and sponsored legislation to
encourage the widespread use of strong encryption. Encryption is an
important tool in our arsenal to protect the security of our computer
information and networks. The Administration made enormous progress
earlier this year when it issued new regulations relaxing export
controls on strong encryption. Of course, encryption technology cannot
be the sole source of protection for our critical computer networks and
computer-based infrastructure, but we need to make sure the government
is encouraging--and not restraining--the use of strong encryption and
other technical solutions to protecting our computer systems.
  Congress has responded again and again to help our law enforcement
agencies keep up with the challenges of new crimes being executed over
computer networks. In 1984, we passed the Computer Fraud and Abuse Act,
and  its amendments, to criminalize conduct when carried out by means
of unauthorized access to a computer. In 1986, we passed the Electronic
Communications Privacy Act (ECPA), which I was proud to sponsor, to
criminalize tampering with electronic mail systems and remote data
processing systems and to protect the privacy of computer users. In the
104th Congress, Senators Kyl, Grassley, and I worked together to enact
the National Information Infrastructure Protection Act to increase
protection under federal criminal law for both government and private
computers, and to address an emerging problem of computer-age blackmail
in which a criminal threatens to harm or shut down a computer system
unless their extortion demands are met.

[[Page S2739]]

  In this Congress, I have introduced a bill with Senator DeWine, the
Computer Crime Enforcement Act, S. 1314, to set up a $25 million grant
program within the U.S. Department of Justice for states to tap for
improved education, training, enforcement and prosecution of computer
crimes. All 50 states have now enacted tough computer crime control
laws. These state laws establish a firm groundwork for electronic
commerce and Internet security. Unfortunately, too many state and local
law enforcement agencies are struggling to afford the high cost of
training and equipment necessary for effective enforcement of their
state computer crime statutes. Our legislation, the Computer Crime
Enforcement Act, would help state and local law enforcement join the
fight to combat the worsening threats we face from computer crime.
  Computer crime is a problem nationwide and in Vermont. I recently
released a survey on computer crime in Vermont. My office surveyed 54
law enforcement agencies in Vermont--43 police departments and 11
State's attorney offices--on their experience investigating and
prosecuting computer crimes. The survey found that more than half of
these Vermont law enforcement agencies encounter computer crime, with
many police departments and state's attorney offices handling 2 to 5
computer crimes per month.
  Despite this documented need, far too many law enforcement agencies
in Vermont cannot afford the cost of policing against computer crimes.
Indeed, my survey found that 98% of the responding Vermont law
enforcement agencies do not have funds dedicated for use in computer
crime enforcement.
  My survey also found that few law enforcement officers in Vermont are
properly trained in investigating computer crimes and analyzing cyber-
evidence. According to my survey, 83% of responding law enforcement
agencies in Vermont do not employ officers properly trained in computer
crime investigative techniques. Moreover, my survey found that 52% of
the law enforcement agencies that handle one or more computer crimes
per month cited their lack of training as a problem encountered during
investigations. Proper training is critical to ensuring success in the
fight against computer crime.
  This bill will help our computer crime laws up to date as an
important backstop and deterrent. I believe that our current computer
crime laws can be enhanced and that the time to act is now. We should
pass legislation designed to improve our law enforcement efforts while
at the same time protecting the privacy rights of American citizens.
  The bill I offer today will make it more efficient for law
enforcement to use tools that are already available--such as pen
registers and trap and trace devices--to track down computer criminals
expeditiously. It will ensure that law enforcement can investigate and
prosecute hacker attacks even when perpetrators use foreign-based
computers to facilitate their crimes. It will implement criminal
forfeiture provisions to ensure that cybercriminals are forced to
relinquish the tools of their trade upon conviction. It will also close
a current loophole in our wiretap laws that prevents a law enforcement
officer from monitoring an innocent-host computer with the consent of
the computer's owner and without a wiretap order to track down the
source of denial-of-service attacks. Finally, this legislation will
assist state and local police departments in their parallel efforts to
combat cybercrime, in recognition of the fact that this fight is not
just at the federal level.
  The key provisions of the bill are:
  Jurisdictional and Definitional Changes to the Computer Fraud and
Abuse Act: The Computer Fraud and Abuse Act, 18 U.S.C. Sec. 1030, is
the primary federal criminal statute prohibiting computer frauds and
hacking. This bill would amend the statute to clarify the appropriate
scope of federal jurisdiction. First, the bill adds a broad definition
of ``loss'' to the definitional section. Calculation of loss is
important both in determining whether the $5,000 jurisdictional hurdle
in the statute is met, and, at sentencing, in calculating the
appropriate guideline range and restitution amount.
  Second, the bill amends the definition of ``protected computer,'' to
expressly include qualified computers even when they are physically
located outside of the United States. This clarification will preserve
the ability of the United States to assist in international hacking
cases. A ``Sense of Congress'' provision specifies that federal
jurisdiction is justified by the ``interconnected and interdependent
nature of computers used in interstate or foreign commerce.''
  Finally, the bill expands the jurisdiction of the United States
Secret Service to encompass investigations of all violations of 18
U.S.C. Sec. 1030. Prior to the 1996 amendments to the Computer Fraud
and Abuse Act, the Secret Service was authorized to investigate any and
all violations of section 1030, pursuant to an agreement between the
Secretary of Treasury and the Attorney General. The 1996 amendments,
however, concentrated Secret Service jurisdiction on certain specified
subsections of section 1030. The current amendment would return full
jurisdiction to the Secret Service and would allow the Justice and
Treasury Departments to decide on the appropriate work-sharing balance
between the two.
  Elimination of Mandatory Minimum Sentence for Certain Violations of
Computer Fraud and Abuse Act: Currently, a directive to the Sentencing
Commission requires that all violations, including misdemeanor
violations, of  certain provisions of the Computer Fraud and Abuse Act
be punished with a term of imprisonment of at least six months. The
bill would change this directive to the Sentencing Commission so that
no such mandatory minimum would be required.

  Additional Criminal Forfeiture Provisions: The bill adds a criminal
forfeiture provision to the Computer Fraud and Abuse Act, requiring
forfeiture of physical property used in or to facilitate the offense as
well as property derived from proceeds of the offense. It also
supplements the current forfeiture provision in 18 U.S.C. 2318, which
prohibits trafficking in, among other things, counterfeit computer
program documentation and packaging, to require the forfeiture of
replicators and other devices used in the production of such
counterfeit items.
  Pen Registers and Trap and Trace Devices: The bill makes it easier
for law enforcement to use these investigative techniques in the area
of cybercrime, and institutes corresponding privacy protections. On the
law enforcement side, the bill gives nationwide effect to pen register
and trap and trace orders obtained by Government attorneys, thus
obviating the need to obtain identical orders in multiple federal
jurisdictions. It also clarifies that such devices can be used on all
electronic communication lines, not just telephone lines. On the
privacy side, the bill provides for greater judicial review of
applications for pen registers and trap and trace devices and
institutes a minimization requirement for the use of such devices. The
bill also amends the reporting requirements for applications for such
devices by specifying the information to be reported.
  Denial of Service Investigations: Currently, a person whose computer
is accessed by a hacker as a means for the hacker to reach a third
computer cannot simply consent to law enforcement monitoring of his
computer. Instead, because this person is not technically a party to
the communication, law enforcement needs wiretap authorization under
Title III to conduct such monitoring. The bill will close this loophole
by explicitly permitting such monitoring without a wiretap if prior
consent is obtained from the person whose computer is being hacked
through and used to send ``harmful interference to a lawfully operating
computer system.''
  Encryption Reporting: The bill directs the Attorney General to report
the number of wiretap orders in which encryption was encountered and
whether such encryption precluded law enforcement from obtaining the
plaintext of intercepted communications.
  State and Local Computer Crime Enforcement: The bill directs the
Office of Federal Programs to make grants to assist State and local law
enforcement in the investigation and prosecution of computer crime.
  Legislation must be balanced to protect our privacy and other
constitutional rights. I am a strong proponent

[[Page S2740]]

of the Internet and a defender of our constitutional rights to speak
freely and to keep private our confidential affairs from either private
sector snoops or unreasonable government searches. These principles can
be respected at the same time we hold accountable those malicious
mischief makers and digital graffiti sprayers, who use computers to
damage or destroy the property of others. I have seen Congress react
reflexively in the past to address concerns over anti-social behavior
on the Internet with legislative proposals that would do more harm than
good. A good example of this is the Communications Decency Act, which
the Supreme Court declared unconstitutional. We must make sure that our
legislative efforts are precisely targeted on stopping destructive acts
and that we avoid scattershot proposals that would threaten, rather
than foster, electronic commerce and sacrifice, rather than promote,
our constitutional rights.
  Technology has ushered in a new age filled with unlimited potential
for commerce and communications. But the Internet age has also ushered
in new challenges for federal, state and local law enforcement
officials. Congress and the Administration need to work together to
meet these new challenges while preserving the benefits of our new era.
The legislation I offer today is a step in that direction.
  Mr. President, I ask unanimous consent that the text of the bill be
printed in the Record.
  There being no objection, the bill was ordered to be printed in the
Record, as follows:

                                S. 2430

       Be it enacted by the Senate and House of Representatives of
     the United States of America in Congress assembled,

     SECTION 1. SHORT TITLE.

       This Act may be cited as the ``Internet Security Act of
     2000''.

     SEC. 2. AMENDMENTS TO THE COMPUTER FRAUD AND ABUSE ACT.

       Section 1030 of title 18, United States Code, is amended--
       (1) in subsection (a)--
       (A) in paragraph (5)--
       (i) by inserting ``(i)'' after ``(A)'' and redesignating
     subparagraphs (B) and (C) as clauses (ii) and (iii),
     respectively;
       (ii) in subparagraph (A)(iii), as redesignated, by adding
     ``and'' at the end; and
       (iii) by adding at the end the following:
       ``(B) the conduct described in clause (i), (ii), or (iii)
     of subparagraph (A)--
       ``(i) caused loss aggregating at least $5,000 in value
     during a 1-year period to 1 or more individuals;
       ``(ii) modified or impaired, or potentially modified or
     impaired, the medical examination, diagnosis, treatment, or
     care of 1 or more individuals;
       ``(iii) caused physical injury to any person; or
       ``(iv) threatened public health or safety;''; and
       (B) in paragraph (6), by adding ``or'' at the end;
       (2) in subsection (c)--
       (A) in paragraph (2)--
       (i) in subparagraph (A), by striking ``and'' at the end;
     and
       (ii) in subparagraph (B), by inserting ``or an attempted
     offense'' after ``in the case of an offense''; and
       (B) by adding at the end the following:
       ``(4) forfeiture to the United States in accordance with
     subsection (i) of the interest of the offender in--
       ``(A) any personal property used or intended to be used to
     commit or to facilitate the commission of the offense; and
       ``(B) any property, real or personal, that constitutes or
     that is derived from proceeds traceable to any violation of
     this section.'';
       (3) in subsection (d)--
       (A) by striking ``subsections (a)(2)(A), (a)(2)(B), (a)(3),
     (a)(4), (a)(5), and (a)(6) of''; and
       (B) by striking ``which shall be entered into by'' and
     inserting ``between'';
       (4) in subsection (e)--
       (A) in paragraph (2)(B), by inserting ``, including
     computers located outside the United States'' before the
     semicolon;
       (B) in paragraph (4), by striking the period at the end and
     inserting a semicolon;
       (C) in paragraph (7), by striking ``and'' at the end;
       (D) in paragraph (8), by striking ``, that'' and all that
     follows through ``; and'' and inserting a semicolon;
       (E) in paragraph (9), by striking the period at the end and
     inserting ``; and''; and
       (F) by adding at the end the following:
       ``(10) the term `loss' includes--
       ``(A) the reasonable costs to any victim of--
       ``(i) responding to the offense;
       ``(ii) conducting a damage assessment; and
       ``(iii) restoring the system and data to their condition
     prior to the offense; and
       ``(B) any lost revenue or costs incurred by the victim as a
     result of interruption of service.'';
       (5) in subsection (g), by striking ``Damages for violations
     involving damage as defined in subsection (c)(8)(A)'' and
     inserting ``losses specified in subsection (a)(5)(B)(i)'';
     and
       (6) by adding at the end the following:
       ``(i) Provisions Governing Forfeiture.--Property subject to
     forfeiture under this section, any seizure and disposition
     thereof, and any administrative or judicial proceeding in
     relation thereto, shall be governed by subsection (c) and
     subsections (e) through (p) of section 413 of the
     Comprehensive Drug Abuse Prevention and Control Act of 1970
     (21 U.S.C. 853).''.

     SEC. 3. SENSE OF CONGRESS.

       It is the sense of Congress that--
       (1) acts that damage or attempt to damage computers used in
     the delivery of critical infrastructure services such as
     telecommunications, energy, transportation, banking and
     financial services, and emergency and government services
     pose a serious threat to public health and safety and cause
     or have the potential to cause losses to victims that include
     costs of responding to offenses, conducting damage
     assessments, and restoring systems and data to their
     condition prior to the offense, as well as lost revenue and
     costs incurred as a result of interruptions of service; and
       (2) the Federal Government should have jurisdiction to
     investigate acts affecting protected computers, as defined in
     section 1030(e)(2)(B) of title 18, United States Code, as
     amended by this Act, even if the effects of such acts occur
     wholly outside the United States, as in such instances a
     sufficient Federal nexus is conferred through the
     interconnected and interdependent nature of computers used in
     interstate or foreign commerce or communication.

     SEC. 4. MODIFICATION OF SENTENCING COMMISSION DIRECTIVE.

       Pursuant to its authority under section 994(p) of title 28,
     United States Code, the United States Sentencing Commission
     shall amend the Federal sentencing guidelines to ensure that
     any individual convicted of a violation of paragraph (4) or
     (5) of section 1030(a) of title 18, United States Code, can
     be subjected to appropriate penalties, without regard to any
     mandatory minimum term of imprisonment.

     SEC. 5. FORFEITURE OF DEVICES USED IN COMPUTER SOFTWARE
                   COUNTERFEITING.

       Section 2318(d) of title 18, United States Code, is amended
     by--
       (1) inserting