[House Report 110-829]
[From the U.S. Government Publishing Office]
110th Congress Rept. 110-829
HOUSE OF REPRESENTATIVES
2d Session Part 1
======================================================================
CYBERSECURITY EDUCATION ENHANCEMENT ACT OF 2008
_______
September 8, 2008.--Ordered to be printed
_______
Mr. Thompson of Mississippi, from the Committee on Homeland Security,
submitted the following
R E P O R T
[To accompany H.R. 263]
[Including cost estimate of the Congressional Budget Office]
The Committee on Homeland Security, to whom was referred the
bill (H.R. 263) to authorize the Secretary of Homeland Security
to establish a program to award grants to institutions of
higher education for the establishment or expansion of
cybersecurity professional development programs, and for other
purposes, having considered the same, report favorably thereon
with an amendment and recommend that the bill as amended do
pass.
CONTENTS
Page
Purpose and Summary.............................................. 00
Background and Need for Legislation.............................. 00
Hearings......................................................... 00
Committee Consideration.......................................... 00
Committee Votes.................................................. 00
Committee Oversight Findings..................................... 00
New Budget Authority, Entitlement Authority, and Tax Expenditures 00
Congressional Budget Office Estimate............................. 00
Statement of General Performance Goals and Objectives............ 00
Congressional Earmarks, Limited Tax Benefits, and Limited Tariff
Benefits....................................................... 00
Federal Mandates Statement....................................... 00
Advisory Committee Statement..................................... 00
Constitutional Authority Statement............................... 00
Applicability to Legislative Branch.............................. 00
Section-by-Section Analysis of the Legislation................... 00
Changes in Existing Law Made by the Bill, as Reported............ 00
The amendment is as follows:
Strike all after the enacting clause and insert the
following:
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Cybersecurity Education Enhancement
Act of 2008''.
SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBERSECURITY TRAINING PROGRAMS
AND EQUIPMENT.
(a) In General.--The Secretary of Homeland Security, acting through
the Assistant Secretary of Cybersecurity and subject to the
availability of appropriations, shall establish a program to award
grants to institutions of higher education (and consortia thereof)
for--
(1) the establishment or expansion of cybersecurity
professional development programs;
(2) the establishment or expansion (or both) of associate
degree programs in cybersecurity; and
(3) the purchase of equipment to provide training in
cybersecurity for professional development programs and degree
programs.
(b) Goals and Criteria.--The Secretary, acting through the Assistant
Secretary--
(1) shall establish the goals and criteria for the program
established under this section and the criteria for awarding
grants under such program; and
(2) shall operate the program consistent with the goals and
criteria established under paragraph (1), including soliciting
applicants, reviewing applications, and making and
administering awards.
(c) Grant Awards.--
(1) Peer review.--All grant awards under this section shall
be provided on a competitive, merit-reviewed basis.
(2) Focus.--In awarding grants under this section, the
Secretary shall, to the extent practicable, ensure geographic
diversity and the participation of women and underrepresented
minorities.
(3) Preference.--In awarding grants under this section, the
Secretary--
(A) shall give preference to applications submitted
by consortia of institutions, to encourage as many
students and professionals as possible to benefit from
the program established under this section; and
(B) shall give preference to any application
submitted by a consortium of institutions that includes
at least one institution of higher education that is
eligible to receive funds under title III or V of the
Higher Education Act of 1965.
(d) Institution of Higher Education Defined.--In this section the
term ``institution of higher education'' has the meaning given that
term in section 101(a) of the Higher Education Act of 1965 (20 U.S.C.
1001(a)).
(e) Authorization of Appropriations.--There is authorized to be
appropriated to the Secretary for carrying out this section $5,000,000
for each of fiscal years 2009 and 2010.
SEC. 3. DHS CYBERSECURITY FELLOWS PROGRAM.
(a) Establishment of Program.--Subtitle C of title II of the Homeland
Security Act of 2002 (6 U.S.C. 121 et seq.) is amended by adding at the
end the following:
``SEC. 226. DHS CYBERSECURITY FELLOWS PROGRAM.
``(a) Establishment.--
``(1) In general.--The Secretary shall establish a fellowship
program in accordance with this section for the purpose of
bringing State, local, tribal, and private sector officials to
participate in the work of the National Cybersecurity Division
in order to assist with the Department's stated cybersecurity
missions and capabilities, including--
``(A) enhancing Federal, State, local, and tribal
government cybersecurity;
``(B) developing partnerships with other Federal
agencies, State, local, and tribal governments, and the
private sector;
``(C) improving and enhancing public/private
information sharing involving information regarding
cyber attacks, threats, and vulnerabilities;
``(D) providing and coordinating incident response
and recovery planning efforts; and
``(E) fostering training and certification.
``(2) Program name.--The program under this section shall be
known as the DHS Cybersecurity Fellows Program.
``(b) Eligibility.--In order to be eligible for selection as a fellow
under the program, an individual must--
``(1) have cybersecurity-related responsibilities;
``(2) be eligible to possess an appropriate national security
clearance; and
``(3) if the individual has, or is employed by a person that
has, a contract with the Department or business before the
Department, report to the Secretary any conflicts of interest
of the individual with respect to such contract or business.
``(c) Limitations.--The Secretary--
``(1) may conduct up to 2 iterations of the program each
year, each of which shall be 180 days in duration; and
``(2) shall ensure that the number of fellows selected for
each iteration does not impede the activities of the National
Cybersecurity Division.
``(d) Condition.--As a condition of selecting an individual as a
fellow under the program, the Secretary shall verify that the
individual's employer agrees to continue to pay the individual's salary
and benefits during the period of the fellowship.
``(e) Stipend.--During the period of the fellowship of an individual
under the program, the Secretary may, subject to the availability of
appropriations, provide to the individual a stipend to cover the
individual's reasonable living expenses during the period of the
fellowship.''.
(b) Clerical Amendment.--The table of contents in section 1(b) of
such Act is amended by adding at the end of the items relating to such
subtitle the following:
``Sec. 226. DHS cybersecurity fellows program.''.
SEC. 4. SENSE OF CONGRESS--CYBERSECURITY.
It is the sense of the Congress that the House of Representatives
should designate a committee to serve as the single, principal point of
oversight and review for cybersecurity.
Purpose and Summary
The purpose of H.R. 263 is to authorize the Secretary of
Homeland Security to establish a program to award grants to
institutions of higher education for the establishment or
expansion of cybersecurity professional development programs,
and for other purposes.
Background and Need for Legislation
During the course of the 110th Congress, the Subcommittee
on Emerging Threats, Cybersecurity, Science and Technology
conducted dozens of hearings and investigations into
cybersecurity issues affecting Federal and critical
infrastructure networks, with the goal of increasing public
awareness, fixing vulnerabilities, and holding individuals,
agencies, and private sector entities responsible and
accountable for their actions. One of the key vulnerabilities
that the Committee has discovered is the lack of information
security training and awareness across all levels and branches
of American government and the private sector. This bill
establishes a grant program to enable higher education
institutions to develop or expand cybersecurity education
programs. In addition, the bill provides opportunities for
State, local, tribal, and private sector officials with
cybersecurity expertise to work at the National Cybersecurity
Division.
Hearings
No Committee hearings were held on H.R. 263, however the
Committee held an oversight hearing on cybersecurity.
On April 25, 2007, the Subcommittee on Emerging Threats,
Cybersecurity and Science and Technology held a hearing
entitled ``Addressing the Nation's Cybersecurity Challenges:
Reducing Vulnerabilities Requires Strategic Investment and
Immediate Action.'' The Subcommittee received testimony from
Dr. Daniel E. Geer, Jr., Principal, Geer Risk Services, LLC;
Dr. James Andrew Lewis, Director and Senior Fellow, Technology
and Public Policy Program, Center for Strategic and
International Studies; Dr. Douglas Maughan, Program Manager,
Cyber Security R&D, science and Technology Directorate,
Department of Homeland Security; and Mr. O. Sami Saydjari,
President, Professionals for Cyber Defense Chief Executive
Officer, Cyber Defense Agency, LLC.
Committee Consideration
In the 109th Congress H.R. 3109, the ``Cybersecurity
Education Enhancement Act of 2005'' was introduced in the House
by Ms. Jackson-Lee of Texas and four original co-sponsors.
H.R. 263 was introduced in the House on January 5, 2007, by
Ms. Jackson-Lee of Texas and referred to the Committee on
Science and Technology, and in addition to the Committee on
Education and Labor and the Committee on Homeland Security.
Within the Committee on Homeland Security, H.R. 263 was
referred to the Subcommittee on Emerging Threats,
Cybersecurity, and Science and Technology.
On June 26, 2008, the Chairman discharged the Subcommittee
on Emerging Threats, Cybersecurity, and Science and Technology
from further consideration of H.R. 263. The Full Committee then
proceeded to the consideration of H.R. 263 and ordered the
measure reported to the House, amended, with a favorable
recommendation.
The Committee adopted the measure, as amended, by unanimous
consent.
The following amendments were offered:
An Amendment in the Nature of a Substitute offered by
Ms. Jackson-Lee (#1), was AGREED TO by unanimous
consent.
Committee Votes
Clause 3(b) of rule XIII of the Rules of the House of
Representatives requires the Committee to list the recorded
votes on the motion to report legislation and amendments
thereto.
No recorded votes were requested during Committee
consideration.
Committee Oversight Findings
Pursuant to clause 3(c)(1) of rule XIII of the Rules of the
House of Representatives, the Committee has held oversight
hearings and made findings that are reflected in this report.
New Budget Authority, Entitlement Authority, and Tax Expenditures
In compliance with clause 3(c)(2) of rule XIII of the
Rules of the House of Representatives, the Committee finds that
H.R. 263, the Cybersecurity Education Enhancement Act of 2007,
would result in no new or increased budget authority,
entitlement authority, or tax expenditures or revenues.
Congressional Budget Office Estimate
The Committee adopts as its own the cost estimate prepared
by the Director of the Congressional Budget Office pursuant to
section 402 of the Congressional Budget Act of 1974.
U.S. Congress,
Congressional Budget Office,
Washington, DC, August 21, 2008.
Hon. Bennie G. Thompson,
Chairman, Committee on Homeland Security,
House of Representatives, Washington, DC.
Dear Mr. Chairman: The Congressional Budget Office has
prepared the enclosed cost estimate for H.R. 263, the
Cybersecurity Education Enhancement Act of 2008.
If you wish further details on this estimate, we will be
pleased to provide them. The CBO staff contact is Mark
Grabowicz.
Sincerely,
Peter H. Fontaine
(For Peter R. Orszag, Director).
Enclosure.
H.R. 263--Cybersecurity Education Enhancement Act of 2008
Summary: H.R. 263 would authorize the appropriation of $5
million for each of fiscal years 2009 and 2010 for the
Department of Homeland Security (DHS) to make grants to
institutions of higher education to establish or expand
cybersecurity programs. In addition, the bill would direct DHS
to establish a fellowship program for nonfederal employees to
work temporarily in the department's National Cybersecurity
Division. CBO estimates that implementing the bill would cost
about $11 million over the 2009-2013 period, subject to
appropriation of the necessary amounts. Enacting H.R. 263 would
not affect direct spending or revenues.
H.R. 263 contains no intergovernmental or private-sector
mandates as defined in the Unfunded Mandates Reform Act (UMRA)
and would impose no costs on state, local or tribal
governments.
Estimated cost to the Federal Government: The estimated
budgetary impact of H.R. 263 is shown in the following table.
The costs of this legislation fall within budget function 750
(administration of justice).
Basis of estimate: For this estimate, CBO assumes that the
necessary amounts will be appropriated near the start of each
fiscal year and that outlays will follow the historical rate of
spending for similar activities.
----------------------------------------------------------------------------------------------------------------
By fiscal year, in millions of dollars--
-------------------------------------------------------
2009 2010 2011 2012 2013 2009-2013
----------------------------------------------------------------------------------------------------------------
CHANGES IN SPENDING SUBJECT TO APPROPRIATION
Estimated Authorization Level........................... 5 5 * * * 11
Estimated Outlays....................................... 2 3 4 1 * 11
----------------------------------------------------------------------------------------------------------------
Note: * = less than $500,000.
In addition to the specified authorizations of $5 million
for each of 2009 and 2010 for grants to expand cybersecurity
programs, H.R. 263 would permit DHS to provide a stipend to
cover reasonable living expenses for participants in the
fellowship program established by the bill. CBO expects that
about 20 people would participate in the new program in
Washington, D.C., each year with each individual spending no
more than six months in the program. We estimate that annual
costs for stipends (including housing and commuting expenses)
could be a few hundred thousand dollars each year and would
total about $1 million over the 2009-2013 period, subject to
the availability of appropriated funds.
Intergovernmental and private-sector impact: H.R. 263
contains no intergovernmental or private-sector mandates as
defined in UMRA. The bill would benefit state, local and tribal
governments by establishing grants for institutions of higher
education and by creating a fellows program to provide training
on cybersecurity issues and to foster partnerships on
cybersecurity issues.
Estimate prepared by: Federal Costs: Mark Grabowicz; Impact
on State, Local, and Tribal Governments: Burke Doherty; Impact
on the Private Sector: Paige Piper/Bach.
Estimate approved by: Peter H. Fontaine, Assistant Director
for Budget Analysis.
Statement of General Performance Goals and Objectives
Pursuant to clause 3(c)(4) of Rule XIII of the Rules of
the House of Representatives, H.R. 263, contains the following
general performance goals, and objectives, including outcome
related goals and objectives authorized.
Congressional Earmarks, Limited Tax Benefits, and Limited Tariff
Benefits
In compliance with rule XXI of the Rules of the House of
Representatives, this bill, as reported, contains no
congressional earmarks, limited tax benefits, or limited tariff
benefits as defined in clause 9(d), 9(e), or 9(f) of the rule
XXI.
Federal Mandates Statement
The Committee adopts as its own the estimate of Federal
mandates prepared by the Director of the Congressional Budget
Office pursuant to section 423 of the Unfunded Mandates Reform
Act.
Advisory Committee Statement
No advisory committees within the meaning of section 5(b)
of the Federal Advisory Committee Act were created by this
legislation.
Constitutional Authority Statement
Pursuant to clause 3(d)(1) of rule XIII of the Rules of the
House of Representatives, the Committee finds that the
Constitutional authority for this legislation is provided in
Article I, section 8, clause 1, which grants Congress the power
to provide for the common Defense of the United States.
Applicability to Legislative Branch
The Committee finds that the legislation does not relate
to the terms and conditions of employment or access to public
services or accommodations within the meaning of section
102(b)(3) of the Congressional Accountability Act.
Section-by-Section Analysis of the Legislation
Section 1. Short title
This section cites the measure as the ``Cybersecurity
Education Enhancement Act of 2008.''
Section 2. Department of Homeland Security Cybersecurity training
programs and equipment
This section establishes a program to award grants to
institutions of higher education (and consortia thereof) for:
(1) the establishment or expansion of cybersecurity
professional development programs; (2) the establishment or
expansion (or both) of associate degree programs in
cybersecurity; and (3) the purchase of equipment to provide
training in cybersecurity for either professional development
programs or degree programs.
Section 3. DHS Cybersecurity Fellows Program
This section establishes a fellowship program for the
purpose of bringing State, local, tribal, and private sector
officials to participate in the work of the National
Cybersecurity Division in order to assist with the Department's
stated cybersecurity missions and capabilities. In order to be
eligible for selection as a fellow under the program, an
individual must: (1) have cybersecurity-related
responsibilities; and (2) be eligible to possess an appropriate
National security clearance.
Section 4. Sense of Congress
This section states that it is the sense of the Congress
that the House of Representatives and the Senate should
designate a committee in each body to serve as the single,
principal point of oversight and review for cybersecurity.
Because cybersecurity is an issue of great economic and
National importance, the Committee believes that the House of
Representatives must reorganize and realign the committee
structure to create one central body with oversight authority
over the disparate aspects of the issue. Without a principal
point, Congress will not be able to provide effective oversight
and leadership.
H.L.C.
Changes in Existing Law Made by the Bill, as Reported
In compliance with clause 3(e) of rule XIII of the Rules of
the House of Representatives, changes in existing law made by
the bill, as reported, are shown as follows (new matter is
printed in italic and existing law in which no change is
proposed is shown in roman):
HOMELAND SECURITY ACT OF 2002
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) * * *
(b) Table of Contents.--The table of contents for this Act is
as follows:
* * * * * * *
TITLE II--INFORMATION ANALYSIS AND INFRASTRUCTURE PROTECTION
* * * * * * *
Subtitle C--Information Security
* * * * * * *
Sec. 226. DHS cybersecurity fellows program.
* * * * * * *
TITLE II--INFORMATION ANALYSIS AND INFRASTRUCTURE PROTECTION
* * * * * * *
Subtitle C--Information Security
* * * * * * *
SEC. 226. DHS CYBERSECURITY FELLOWS PROGRAM.
(a) Establishment.--
(1) In general.--The Secretary shall establish a
fellowship program in accordance with this section for
the purpose of bringing State, local, tribal, and
private sector officials to participate in the work of
the National Cybersecurity Division in order to assist
with the Department's stated cybersecurity missions and
capabilities, including--
(A) enhancing Federal, State, local, and
tribal government cybersecurity;
(B) developing partnerships with other
Federal agencies, State, local, and tribal
governments, and the private sector;
(C) improving and enhancing public/private
information sharing involving information
regarding cyber attacks, threats, and
vulnerabilities;
(D) providing and coordinating incident
response and recovery planning efforts; and
(E) fostering training and certification.
(2) Program name.--The program under this section
shall be known as the DHS Cybersecurity Fellows
Program.
(b) Eligibility.--In order to be eligible for selection as a
fellow under the program, an individual must--
(1) have cybersecurity-related responsibilities;
(2) be eligible to possess an appropriate national
security clearance; and
(3) if the individual has, or is employed by a person
that has, a contract with the Department or business
before the Department, report to the Secretary any
conflicts of interest of the individual with respect to
such contract or business.
(c) Limitations.--The Secretary--
(1) may conduct up to 2 iterations of the program
each year, each of which shall be 180 days in duration;
and
(2) shall ensure that the number of fellows selected
for each iteration does not impede the activities of
the National Cybersecurity Division.
(d) Condition.--As a condition of selecting an individual as
a fellow under the program, the Secretary shall verify that the
individual's employer agrees to continue to pay the
individual's salary and benefits during the period of the
fellowship.
(e) Stipend.--During the period of the fellowship of an
individual under the program, the Secretary may, subject to the
availability of appropriations, provide to the individual a
stipend to cover the individual's reasonable living expenses
during the period of the fellowship.
* * * * * * *