15 U.S.C. § 278h — Research program on security of com-

Page 679 TITLE 15—COMMERCE AND TRADE § 278h 1 So in original. Probably should be ‘‘Information Security’’. 2 See References in Text note below. acquire the expertise, equipment, and training necessary to participate fully in supply chains using enterprise integration. (Pub. L. 107–277, § 3, Nov. 5, 2002, 116 Stat. 1936; Pub. L. 113–188, title II, § 201(b), Nov. 26, 2014, 128 Stat. 2018; Pub. L. 114–329, title V, § 501(e)(2), Jan. 6, 2017, 130 Stat. 3033.) Editorial Notes REFERENCES IN TEXT This Act, referred to in subsec. (c), is Pub. L. 107–277, Nov. 5, 2002, 116 Stat. 1936, known as the Enterprise In- tegration Act of 2002, which enacted this section and provisions set out as a note under this section. For complete classification of this Act to the Code, see Ta- bles. CODIFICATION Section was enacted as part of the Enterprise Inte- gration Act of 2002, and not as part of the National In- stitute of Standards and Technology Act which com- prises this chapter. AMENDMENTS 2017—Subsec. (a). Pub. L. 114–329 inserted ‘‘Hollings’’ before ‘‘Manufacturing Extension Partnership’’. 2014—Subsecs. (c) to (e). Pub. L. 113–188 redesignated subsecs. (d) and (e) as (c) and (d), respectively, and struck out former subsec. (c) which required annual re- ports on the National Institute of Standards and Tech- nology’s activities under subsec. (b). Statutory Notes and Related Subsidiaries ENTERPRISE INTEGRATION Pub. L. 107–277, Nov. 5, 2002, 116 Stat. 1936, provided that: ‘‘SECTION. 1. SHORT TITLE. ‘‘This Act [enacting this section and this note] may be cited as the ‘Enterprise Integration Act of 2002’. ‘‘SEC. 2. FINDINGS. ‘‘The Congress makes the following findings: ‘‘(1) Over 90 percent of United States companies en- gaged in manufacturing are small- and medium-sized businesses. ‘‘(2) Most of these manufacturers produce goods for assemblage into products of large companies. ‘‘(3) The emergence of the World Wide Web and the promulgation of international standards for product data exchange greatly accelerated the movement to- ward electronically integrated supply chains during the last half of the 1990’s. ‘‘(4) European and Asian countries are investing heavily in electronic enterprise standards develop- ment, and in preparing their smaller manufacturers to do business in the new environment. European ef- forts are well advanced in the aerospace, automotive, and shipbuilding industries and are beginning in other industries including home building, furniture manufacturing, textiles, and apparel. This invest- ment could give overseas companies a major competi- tive advantage. ‘‘(5) The National Institute of Standards and Tech- nology, because of the electronic commerce expertise in its laboratories and quality program, its long his- tory of working cooperatively with manufacturers, and the nationwide reach of its manufacturing exten- sion program, is in a unique position to help United States large and smaller manufacturers alike in their responses to this challenge. ‘‘(6) It is, therefore, in the national interest for the National Institute of Standards and Technology to accelerate its efforts in helping industry develop standards and enterprise integration processes that are necessary to increase efficiency and lower costs. ‘‘SEC. 3. ENTERPRISE INTEGRATION INITIATIVE. [Enacted this section.] ‘‘SEC. 4. DEFINITIONS. ‘‘For purposes of this Act— ‘‘(1) the term ‘automotive’ means land-based en- gine-powered vehicles including automobiles, trucks, busses, trains, defense vehicles, farm equipment, and motorcycles; ‘‘(2) the term ‘Director’ means the Director of the National Institute of Standards and Technology; ‘‘(3) the term ‘enterprise integration’ means the electronic linkage of manufacturers, assemblers, sup- pliers, and customers to enable the electronic ex- change of product, manufacturing, and other business data among all partners in a product supply chain, and such term includes related application protocols and other related standards; ‘‘(4) the term ‘major manufacturing industry’ in- cludes the aerospace, automotive, electronics, ship- building, construction, home building, furniture, tex- tile, and apparel industries and such other industries as the Director designates; and ‘‘(5) the term ‘roadmap’ means an assessment of manufacturing interoperability requirements devel- oped by an industry describing that industry’s goals related to enterprise integration, the knowledge and standards including application protocols necessary to achieve those goals, and the necessary steps, time- table, and assignment of responsibilities for acquir- ing the knowledge and developing the standards and protocols. ‘‘SEC. 5. AUTHORIZATION OF APPROPRIATIONS. ‘‘There are authorized to be appropriated to the Di- rector to carry out functions under this Act— ‘‘(1) $2,000,000 for fiscal year 2002; ‘‘(2) $10,000,000 for fiscal year 2003; ‘‘(3) $15,000,000 for fiscal year 2004; and ‘‘(4) $20,000,000 for fiscal year 2005.’’ § 278h. Research program on security of com- puter systems (a) Establishment The Director shall establish a program of as- sistance to institutions of higher education that enter into partnerships with for-profit entities to support research to improve the security of computer systems. The partnerships may also include government laboratories and nonprofit research institutions. The program shall— (1) include multidisciplinary, long-term re- search; (2) include research directed toward address- ing needs identified through the activities of the Computer System Security 1 and Privacy Advisory Board under section 278g–3(f) 2 of this title; and (3) promote the development of a robust re- search community working at the leading edge of knowledge in subject areas relevant to the security of computer systems by providing support for graduate students, post-doctoral researchers, and senior researchers. (b) Fellowships (1) Post-doctoral research fellowships The Director is authorized to establish a program to award post-doctoral research fel- lowships to individuals who are citizens, na- tionals, or lawfully admitted permanent resi- dent aliens of the United States and are seek- Page 680 TITLE 15—COMMERCE AND TRADE § 278h ing research positions at institutions, includ- ing the Institute, engaged in research activi- ties related to the security of computer sys- tems, including the research areas described in section 7403(a)(1) of this title. (2) Senior research fellowships The Director is authorized to establish a program to award senior research fellowships to individuals seeking research positions at in- stitutions, including the Institute, engaged in research activities related to the security of computer systems, including the research areas described in section 7403(a)(1) of this title. Senior research fellowships shall be made available for established researchers at institutions of higher education who seek to change research fields and pursue studies re- lated to the security of computer systems. (3) Eligibility (A) In general To be eligible for an award under this sub- section, an individual shall submit an appli- cation to the Director at such time, in such manner, and containing such information as the Director may require. (B) Stipends Under this subsection, the Director is au- thorized to provide stipends for post-doc- toral research fellowships at the level of the Institute’s Post Doctoral Research Fellow- ship Program and senior research fellow- ships at levels consistent with support for a faculty member in a sabbatical position. (c) Awards; applications (1) In general The Director is authorized to award grants or cooperative agreements to institutions of higher education to carry out the program es- tablished under subsection (a). No funds made available under this section shall be made available directly to any for-profit partners. (2) Eligibility To be eligible for an award under this sec- tion, an institution of higher education shall submit an application to the Director at such time, in such manner, and containing such in- formation as the Director may require. The application shall include, at a minimum, a de- scription of— (A) the number of graduate students an- ticipated to participate in the research project and the level of support to be pro- vided to each; (B) the number of post-doctoral research positions included under the research project and the level of support to be pro- vided to each; (C) the number of individuals, if any, in- tending to change research fields and pursue studies related to the security of computer systems to be included under the research project and the level of support to be pro- vided to each; and (D) how the for-profit entities, nonprofit research institutions, and any other part- ners will participate in developing and car- rying out the research and education agenda of the partnership. (d) Program operation (1) Management The program established under subsection (a) shall be managed by individuals who shall have both expertise in research related to the security of computer systems and knowledge of the vulnerabilities of existing computer sys- tems. The Director shall designate such indi- viduals as program managers. (2) Managers may be employees Program managers designated under para- graph (1) may be new or existing employees of the Institute or individuals on assignment at the Institute under the Intergovernmental Personnel Act of 1970 [42 U.S.C. 4701 et seq.], except that individuals on assignment at the Institute under the Intergovernmental Per- sonnel Act of 1970 shall not directly manage such employees. (3) Manager responsibility Program managers designated under para- graph (1) shall be responsible for— (A) establishing and publicizing the broad research goals for the program; (B) soliciting applications for specific re- search projects to address the goals devel- oped under subparagraph (A); (C) selecting research projects for support under the program from among applications submitted to the Institute, following consid- eration of— (i) the novelty and scientific and tech- nical merit of the proposed projects; (ii) the demonstrated capabilities of the individual or individuals submitting the applications to successfully carry out the proposed research; (iii) the impact the proposed projects will have on increasing the number of computer security researchers; (iv) the nature of the participation by for-profit entities and the extent to which the proposed projects address the concerns of industry; and (v) other criteria determined by the Di- rector, based on information specified for inclusion in applications under subsection (c); and (D) monitoring the progress of research projects supported under the program. (4) Reports The Director shall report to the Senate Committee on Commerce, Science, and Trans- portation and the House of Representatives Committee on Science annually on the use and responsibility of individuals on assignment at the Institute under the Intergovernmental Personnel Act of 1970 [42 U.S.C. 4701 et seq.] who are performing duties under subsection (d). (e) Review of program (1) Periodic review The Director shall periodically review the portfolio of research awards monitored by each program manager designated in accord- ance with subsection (d). In conducting those reviews, the Director shall seek the advice of Page 681 TITLE 15—COMMERCE AND TRADE § 278h–1 the Computer System Security 1 and Privacy Advisory Board, established under section 278g–4 of this title, on the appropriateness of the research goals and on the quality and util- ity of research projects managed by program managers in accordance with subsection (d). (2) Comprehensive 5-year review The Director shall also contract with the National Research Council for a comprehen- sive review of the program established under subsection (a) during the 5th year of the pro- gram. Such review shall include an assessment of the scientific quality of the research con- ducted, the relevance of the research results obtained to the goals of the program estab- lished under subsection (d)(3)(A), and the progress of the program in promoting the de- velopment of a substantial academic research community working at the leading edge of knowledge in the field. The Director shall sub- mit to Congress a report on the results of the review under this paragraph no later than 6 years after the initiation of the program. (f) Definitions In this section: (1) Computer system The term ‘‘computer system’’ has the mean- ing given that term in section 278g–3(d)(1) 2 of this title. (2) Institution of higher education The term ‘‘institution of higher education’’ has the meaning given that term in section 1001(a) of title 20. (Mar. 3, 1901, ch. 872, § 22, as added Pub. L. 107–305, § 8(a)(2), Nov. 27, 2002, 116 Stat. 2375.) Editorial Notes REFERENCES IN TEXT Section 278g–3 of this title, referred to in subsecs. (a)(2) and (f)(1), was amended generally by Pub. L. 107–296, title X, § 1003, Nov. 25, 2002, 116 Stat. 2269, and, as so amended, did not contain a subsec. (d) defining ‘‘computer system’’ or a subsec. (f). A later amendment by Pub. L. 113–274, title II, § 204(1), Dec. 18, 2014, 128 Stat. 2980, redesignated subsec. (e) of section 278g–3 of this title, relating to definitions, as subsec. (f). The Intergovernmental Personnel Act of 1970, re- ferred to in subsec. (d)(2), (4), is Pub. L. 91–648, Jan. 5, 1971, 84 Stat. 1909, which enacted sections 3371 to 3376 of Title 5, Government Organization and Employees, and chapter 62 (§ 4701 et seq.) of Title 42, The Public Health and Welfare, amended section 1304 of Title 5 and section 246 of Title 42, repealed sections 1881 to 1888 of Title 7, Agriculture, and section 869b of Title 20, Education, and enacted provisions set out as notes under section 3371 of Title 5. For complete classification of this Act to the Code, see Short Title note set out under section 4701 of Title 42 and Tables. PRIOR PROVISIONS A prior section 22 of act Mar. 3, 1901, ch. 872, was re- numbered section 32 and is classified to section 278q of this title. Statutory Notes and Related Subsidiaries CHANGE OF NAME Committee on Science of House of Representatives changed to Committee on Science and Technology of House of Representatives by House Resolution No. 6, One Hundred Tenth Congress, Jan. 5, 2007. Committee on Science and Technology of House of Representatives changed to Committee on Science, Space, and Tech- nology of House of Representatives by House Resolu- tion No. 5, One Hundred Twelfth Congress, Jan. 5, 2011. § 278h–1. Standards for artificial intelligence (a) Mission The Institute shall— (1) advance collaborative frameworks, stand- ards, guidelines, and associated methods and techniques for artificial intelligence; (2) support the development of a risk-mitiga- tion framework for deploying artificial intel- ligence systems; (3) support the development of technical standards and guidelines that promote trust- worthy artificial intelligence systems; and (4) support the development of technical standards and guidelines by which to test for bias in artificial intelligence training data and applications. (b) Supporting activities The Director of the National Institute of Standards and Technology may— (1) support measurement research and devel- opment of best practices and voluntary stand- ards for trustworthy artificial intelligence systems, which may include— (A) privacy and security, including for datasets used to train or test artificial intel- ligence systems and software and hardware used in artificial intelligence systems; (B) advanced computer chips and hardware designed for artificial intelligence systems; (C) data management and techniques to in- crease the usability of data, including strat- egies to systematically clean, label, and standardize data into forms useful for train- ing artificial intelligence systems and the use of common, open licenses; (D) safety and robustness of artificial in- telligence systems, including assurance, verification, validation, security, control, and the ability for artificial intelligence sys- tems to withstand unexpected inputs and ad- versarial attacks; (E) auditing mechanisms and benchmarks for accuracy, transparency, verifiability, and safety assurance for artificial intel- ligence systems; (F) applications of machine learning and artificial intelligence systems to improve other scientific fields and engineering; (G) model documentation, including per- formance metrics and constraints, measures of fairness, training and testing processes, and results; (H) system documentation, including con- nections and dependences within and be- tween systems, and complications that may arise from such connections; and (I) all other areas deemed by the Director to be critical to the development and deploy- ment of trustworthy artificial intelligence; (2) produce curated, standardized, represent- ative, high-value, secure, aggregate, and pri- vacy protected data sets for artificial intel- ligence research, development, and use; (3) support one or more institutes as de- scribed in section 9431(b) of this title for the