Cyber-Security Strengthening Act of 2004

Section 1. Findings of Fact
(a) Our nation’s information and telecommunications systems are directly connected to many other critical infrastructure sectors, including banking and finance, energy, and transportation. The consequences of an attack on our cyber infrastructure can cascade across many sectors, causing widespread disruption of essential services, damaging our economy, and imperiling public safety. The speed, virulence, and maliciousness of cyber attacks have increased dramatically in recent years. Yet, private sector professionals consistently do not rank security as an important part of their information infrastructure. Hence, Congress finds that security should be mandated by law.

(b) On Friday, January 24, 2003 at 11:30 pm CST, American Intelligence began monitoring a Distributed Denial of Service (DDoS) attack that successfully took down 5 of the 13 (approximately 38.5%) root name servers. The root name servers (a.k.a. root Domain Name Servers, or root DNS) translate domain names, like whitehouse.gov, into an Internet Protocol (IP) address so a computer can connect to the server over the Internet. No root name servers effectively means no Internet. In other words, during the attack the Internet suffered 38.5% diminished capacity with particularly widespread and noteworthy outages in the Republic of Korea and the State of Texas. While the security of the root name servers was never compromised, the root name servers were flooded with so many bogus data requests by innumerable compromised systems that the root name servers could not fulfill their function. Worst of all, the entire attack could have been prevented had people applied a security patch that was six months old. Thus, Congress finds that un-patched systems can affect secure systems, and Congress finds that steps should be taken to force systems to be patched.

(c) Some operating systems being developed today do not conform to fundamental security guidelines or do not have critical security features. Hence, Congress finds that independent security certifications and evaluations should mandate conformance to good security designs and practices.

(d) While some operating systems do conform to fundamental security guidelines and have critical security features, many information infrastructure professionals do not have the proper training, knowledge, and experience to properly configure and use these operating systems in a secure way. Thus, Congress finds that independent security certifications and evaluations should mandate proper training and knowledge of information infrastructure professionals.

(e) Time and again, the vast majority of information security breaches from outsiders are based upon un-patched systems. Yet, managers and supervisors consistently do not give security sufficient importance and resources to properly patch their systems. Hence, Congress finds that managers and supervisors should be fiscally motivated to give security sufficient importance and resources.

(f) Identity theft is the fastest growing crime in the United States. One of the primary sources for information used in identity theft is customer information stolen from computers and networks. Yet, organizations consistently do not inform their customers of information security breaches that threaten customers’ identity or privacy because they value the reputation of the organization over their customers’ security. Thus, Congress finds that reports about information security breaches should be disclosed to customers so that customers can take preventative action to protect their identity and privacy.

Section 2. Purpose
The purpose of this legislation is to provide a more secure nationwide information infrastructure by mandating well-established security practices.

Section 3. Definitions
For the purposes of this subchapter:
(a) A “bridge” is an electronic device that allows two networks, which may be similar or dissimilar in topology, wiring, or communications protocols, to exchange data.
(b) A “computer” is an electronic, general-purpose machine that processes data according to a set of instructions that are stored internally either temporarily or permanently by:
(1) Retrieving the data from the keyboard, disk, or communications channel into memory,
(2) Calculating, comparing, or copying the data, and
(3) Outputting the results to the screen, saving the results to disk, or transmitting the results back over a communications channel.
(c) A “critical infrastructure environment” is any public or private sector organization that engages in the designing, manufacturing, testing, servicing, governing, managing, or deploying of those assets, systems, and functions vital to our national security, governance, public health and safety, economy, and national morale, which include food, water, agriculture, health systems and emergency services, energy (electrical, nuclear, gas and oil, dams), transportation (air, road, rail, ports, waterways), information and telecommunications, banking and finance, chemical, defense industry, postal and shipping, and national monuments and icons.
(d) An “e-mail” is a memo or message transmitted over a network.
(e) An “e-mail client” is a program or program module that provides e-mail services for computer users, including receiving e-mail into a locally stored inbox, sending e-mail to other network users, replying to received messages, and storing received messages.
(f) A “gateway” is an electronic device that connects a local area network to a wide area network, a minicomputer, a mainframe, or the Internet.
(g) A “hypertext” is a format or method of preparing and publishing text, ideally suited for the computer, in which readers can choose their own paths through the material.
(h) An “information infrastructure professional” is a person who has received training and education for, and whose primary duties and responsibilities include but are not necessarily limited to, supporting, monitoring, testing, maintaining, analyzing, troubleshooting, and repairing computers, computer peripherals, and networks; documenting, maintaining, upgrading or replacing hardware and software systems; supporting and maintaining user account information including rights, security and systems groups; reviewing, analyzing, and modifying programming systems including encoding, testing, debugging, and documenting programs; or installing and configuring computers.
(i) The “Internet” is an enormous and rapidly growing system of interconnected computer networks, world-wide in scope, that facilitates data communication services.
(j) A “local area network” is a communications network that serves users within a confined geographic area by linking computers with high-performance cables so users can exchange information, share peripherals, and draw on programs and data stored in other computers on the network; it may include, but is not necessarily limited to, personal computers, minicomputers, and mainframes.
(k) A “mainframe” is a high-scale computer that functions as a multi-user system for several thousand or more users and is designed to meet the computing needs of a large organization.
(l) A “minicomputer” is a medium-scale computer that functions as a multi-user system for up to several hundred users and is designed to meet the computing needs of a small company or a department.
(m) A “network topology” is the geometric arrangement of nodes and cable links in a network.
(n) A “node” is a network junction or connection point that can create, receive, or repeat a packet of data.
(o) An “operating system” is a master control program that manages the computer’s internal functions and provides a means to control the computer’s operations.
(p) A “patch” is a quick fix to a program for the purpose of correcting erratic behavior, invalid output, or abnormal termination.
(q) A “personal computer” is a small-scale, single-user computer equipped with all the system, utility, and application software, and input/output devices and other peripherals that an individual needs to perform one or more tasks.
(r) A “router” is an electronic device that examines each packet of data it receives and then decides which way to send it onward towards its destination.
(s) A “uniform resource locator” is a string of characters that precisely identifies an Internet resource’s type and location.
(t) A “version” is a specific release of a program in which a higher number indicates a more recent release.
(u) A “wide area network” is a network that uses high-speed, long-distance communications networks or satellites to connect computers over distances greater than those traversed by local area networks.
(v) A “Web browser” is a program that runs on an Internet-connected computer and provides access to the World Wide Web.
(w) The “World Wide Web” is a global hypertext system that uses the Internet as its transport mechanism.

Section 4. Version Checking of Critical Software

(a) The National Institute of Standards and Technology shall, within 18 months of the effective date of this legislation, develop a communications connection protocol which meets the following requirements:
(1) The protocol shall be capable of connecting one computer to another computer, one computer to a remote network, and one network to another network.

(2) Any bridge, gateway, or router using the protocol shall be capable of receiving from any operating system, e-mail client, and Web browser data identifying the version of the operating system, e-mail client, and Web browser in use, any installed patches, and one or more uniform resource locators that identify where on the Internet the bridge, gateway, or router can check if any additional patches exist for that version of the operating system, e-mail client, or Web browser. If the data received from the operating system, e-mail client, or Web browser is invalid, the computer will be denied all access to the Internet. If the data received from the operating system, e-mail client, or Web browser is valid, the bridge, gateway, or router will respond to the data returned from the uniform resource locator by taking action in one of three ways:
(a) If the data returned from the uniform resource locator indicates that no additional patches are available, the computer will be granted full access to the Internet.
(b) If the data returned from the uniform resource locator indicates that additional patches are available, the computer will be granted access to only those locations on the Internet necessary to download the patches.
(c) If the data returned from the uniform resource locator is invalid, the computer will be denied all access to the Internet.

(3) Any bridge, gateway, or router using the protocol shall be capable of receiving from any bridge, gateway, and router adjacent in network topology data identifying whether or not the adjacent bridge, gateway, or router is using the protocol. If the data returned from the adjacent bridge, gateway, or router is invalid or if the data returned from the adjacent bridge, gateway, or router indicates that the adjacent bridge, gateway, or router is not using the protocol, the adjacent bridge, gateway, or router will be denied all access to the Internet.

(4) The protocol shall perform the aforementioned checks not less than once every 72 hours.

(5) The protocol shall not transmit any personally identifiable information.

(b) Any bridge, gateway, and router manufactured in, or imported into, the United States after 36 months of the effective date of editedthe communications connections protocol, as mentioned in 4a, shall conform to the protocol.

(c) Any bridge, gateway, and router used in the United States to connect a computer or network to the Internet after 60 months of the effective date of editedthe communications connections protocol, as mentioned in 4a, shall conform to, and use, the protocol.

(d) Notwithstanding any other provision in this section, allowances may be made for any bridge, gateway, and router that exist outside of the jurisdiction of the United States.

Section 5. Certified Operating Systems
All critical infrastructure environments in the United States shall use an operating system which has been certified under either the Department of Defense Trusted Computer Security Evaluation Criteria or the Common Criteria for Information Technology Security Evaluation, or an updated or upgraded version of an operating system which has been certified under the same, after 36 months of the effective date of this legislation.

Section 6. Security Certification for Information Infrastructure Professionals
All information infrastructure professionals working in a critical infrastructure environment shall be certified in either a generic security certification, which shall at minimum cover general security concepts, communication security, infrastructure security, basics of cryptography, and operational and organizational security, or a security certification specific to the operating system they are using.

Section 7. No Punitive Damages for Preventable Information Security Breaches
Any person who illegally gains access to a computer or network by means of a known security vulnerability for which a patch has been available for more than 72 hours shall not be liable for any punitive damages.

Section 8. Disclosure of Information Security Breaches
Any organization that suffers an information security breach in which personally identifiable information was stolen shall, within 180 days of the information security breach, report to the Department of Homeland Security and make a good-faith effort to report to all relevant persons whose personally identifiable information was stolen the nature of the information security breach, including:
(1) A general overview of how information security was breached,
(2) A listing of the information that was stolen insofar as necessary for persons whose information was stolen to take action to protect their identity and privacy, and
(3) Any action the organization is taking to ensure that such an information security breach does not happen again.

Section 9. Criminal Penalties
(a) Any person or organization that knowingly or willfully violates Section 4 shall be guilty of a misdemeanor and fined not more than $10,000 for each bridge, gateway, and router in violation thereof, but such fine shall not exceed $500,000 for a first offense.
(b) Any person or organization that knowingly or willfully violates Section 5 shall be guilty of a misdemeanor and fined not more than $10,000 for every 30 day period in violation thereof.
(c) Any person or organization that knowingly or willfully violates Section 6 shall be guilty of a misdemeanor and fined not more than $25,000 for each information infrastructure professional in violation thereof, but such fine shall not exceed $850,000 for a first offense.
(d) Any person or organization that knowingly or willfully violates Section 8 shall be guilty of a misdemeanor and fined not more than $125,000.