6 U.S.C. § 657 — Cyber Security Enhancement Act of 2002

Page 337 TITLE 6—DOMESTIC SECURITY § 657 gency recovery plans to respond to major fail- ures of critical information systems; and (3) fulfill the responsibilities of the Sec- retary to protect Federal information systems under subchapter II of chapter 35 of title 44. (Pub. L. 107–296, title XXII, § 2205, formerly title II, § 223, Nov. 25, 2002, 116 Stat. 2156; Pub. L. 110–53, title V, § 531(b)(1)(A), Aug. 3, 2007, 121 Stat. 334; Pub. L. 113–283, § 2(e)(3)(A), Dec. 18, 2014, 128 Stat. 3086; renumbered title XXII, § 2205, and amended Pub. L. 115–278, § 2(g)(2)(I), (9)(A)(i), Nov. 16, 2018, 132 Stat. 4178, 4180; Pub. L. 117–263, div. G, title LXXI, § 7143(c)(6), Dec. 23, 2022, 136 Stat. 3663.) Editorial Notes CODIFICATION Section was formerly classified to section 143 of this title prior to renumbering by Pub. L. 115–278. AMENDMENTS 2022—Pub. L. 117–263 substituted ‘‘Director of the Cybersecurity and Infrastructure Security Agency’’ for ‘‘Director of Cybersecurity and Infrastructure Secu- rity’’ in introductory provisions. 2018—Pub. L. 115–278, § 2(g)(9)(A)(i)(I), substituted ‘‘section 652 of this title’’ for ‘‘section 121 of this title’’ and ‘‘Director of Cybersecurity and Infrastructure Se- curity’’ for ‘‘Under Secretary appointed under section 113(a)(1)(H) of this title’’ in introductory provisions. Par. (1)(B). Pub. L. 115–278, § 2(g)(9)(A)(i)(II), struck out ‘‘and’’ at end. 2014—Pub. L. 113–283, § 2(e)(3)(A)(i), (ii), inserted ‘‘Fed- eral and’’ before ‘‘non-Federal’’ in section catchline and substituted ‘‘the Under Secretary appointed under section 113(a)(1)(H) of this title’’ for ‘‘the Under Sec- retary for Intelligence and Analysis, in cooperation with the Assistant Secretary for Infrastructure Protec- tion’’ in introductory provisions. Par. (3). Pub. L. 113–283, § 2(e)(3)(A)(iii), (iv), added par. (3). 2007—Pub. L. 110–53 substituted ‘‘Under Secretary for Intelligence and Analysis, in cooperation with the As- sistant Secretary for Infrastructure Protection’’ for ‘‘Under Secretary for Information Analysis and Infra- structure Protection’’ in introductory provisions. Statutory Notes and Related Subsidiaries RULE OF CONSTRUCTION Nothing in amendment made by Pub. L. 117–263 to be construed to alter the authorities, responsibilities, functions, or activities of any agency (as such term is defined in 44 U.S.C. 3502) or officer or employee of the United States on or before Dec. 23, 2022, see section 7143(f)(1) of Pub. L. 117–263, set out as a note under sec- tion 650 of this title. § 656. NET Guard The Director of the Cybersecurity and Infra- structure Security Agency may establish a na- tional technology guard, to be known as ‘‘NET Guard’’, comprised of local teams of volunteers with expertise in relevant areas of science and technology, to assist local communities to re- spond and recover from attacks on information systems and communications networks. (Pub. L. 107–296, title XXII, § 2206, formerly title II, § 224, Nov. 25, 2002, 116 Stat. 2156; Pub. L. 110–53, title V, § 531(b)(1)(B), Aug. 3, 2007, 121 Stat. 334; renumbered title XXII, § 2206, and amended Pub. L. 115–278, § 2(g)(2)(I), (9)(A)(ii), Nov. 16, 2018, 132 Stat. 4178, 4180; Pub. L. 117–263, div. G, title LXXI, § 7143(c)(7), Dec. 23, 2022, 136 Stat. 3663.) Editorial Notes CODIFICATION Section was formerly classified to section 144 of this title prior to renumbering by Pub. L. 115–278. AMENDMENTS 2022—Pub. L. 117–263 substituted ‘‘Director of the Cybersecurity and Infrastructure Security Agency’’ for ‘‘Director of Cybersecurity and Infrastructure Secu- rity’’. 2018—Pub. L. 115–278, § 2(g)(9)(A)(ii), substituted ‘‘Di- rector of Cybersecurity and Infrastructure Security’’ for ‘‘Assistant Secretary for Infrastructure Protec- tion’’. 2007—Pub. L. 110–53 substituted ‘‘Assistant Secretary for Infrastructure Protection’’ for ‘‘Under Secretary for Information Analysis and Infrastructure Protection’’. Statutory Notes and Related Subsidiaries RULE OF CONSTRUCTION Nothing in amendment made by Pub. L. 117–263 to be construed to alter the authorities, responsibilities, functions, or activities of any agency (as such term is defined in 44 U.S.C. 3502) or officer or employee of the United States on or before Dec. 23, 2022, see section 7143(f)(1) of Pub. L. 117–263, set out as a note under sec- tion 650 of this title. § 657. Cyber Security Enhancement Act of 2002 (a) Short title This section may be cited as the ‘‘Cyber Secu- rity Enhancement Act of 2002’’. (b) Amendment of sentencing guidelines relating to certain computer crimes (1) Directive to the United States Sentencing Commission Pursuant to its authority under section 994(p) of title 28 and in accordance with this subsection, the United States Sentencing Commission shall review and, if appropriate, amend its guidelines and its policy statements applicable to persons convicted of an offense under section 1030 of title 18. (2) Requirements In carrying out this subsection, the Sen- tencing Commission shall— (A) ensure that the sentencing guidelines and policy statements reflect the serious na- ture of the offenses described in paragraph (1), the growing incidence of such offenses, and the need for an effective deterrent and appropriate punishment to prevent such of- fenses; (B) consider the following factors and the extent to which the guidelines may or may not account for them— (i) the potential and actual loss resulting from the offense; (ii) the level of sophistication and plan- ning involved in the offense; (iii) whether the offense was committed for purposes of commercial advantage or private financial benefit; (iv) whether the defendant acted with malicious intent to cause harm in commit- ting the offense; Page 338 TITLE 6—DOMESTIC SECURITY § 658 (v) the extent to which the offense vio- lated the privacy rights of individuals harmed; (vi) whether the offense involved a com- puter used by the government in further- ance of national defense, national secu- rity, or the administration of justice; (vii) whether the violation was intended to or had the effect of significantly inter- fering with or disrupting a critical infra- structure; and (viii) whether the violation was intended to or had the effect of creating a threat to public health or safety, or injury to any person; (C) assure reasonable consistency with other relevant directives and with other sen- tencing guidelines; (D) account for any additional aggravating or mitigating circumstances that might jus- tify exceptions to the generally applicable sentencing ranges; (E) make any necessary conforming changes to the sentencing guidelines; and (F) assure that the guidelines adequately meet the purposes of sentencing as set forth in section 3553(a)(2) of title 18. (c) Study and report on computer crimes Not later than May 1, 2003, the United States Sentencing Commission shall submit a brief re- port to Congress that explains any actions taken by the Sentencing Commission in response to this section and includes any recommendations the Commission may have regarding statutory penalties for offenses under section 1030 of title 18. (d) Emergency disclosure exception (1) Omitted (2) Reporting of disclosures A government entity that receives a disclo- sure under section 2702(b) of title 18 shall file, not later than 90 days after such disclosure, a report to the Attorney General stating the paragraph of that section under which the dis- closure was made, the date of the disclosure, the entity to which the disclosure was made, the number of customers or subscribers to whom the information disclosed pertained, and the number of communications, if any, that were disclosed. The Attorney General shall publish all such reports into a single re- port to be submitted to Congress 1 year after November 25, 2002. (Pub. L. 107–296, title XXII, § 2207, formerly title II, § 225, Nov. 25, 2002, 116 Stat. 2156; renumbered title XXII, § 2207, Pub. L. 115–278, § 2(g)(2)(I), Nov. 16, 2018, 132 Stat. 4178.) Editorial Notes CODIFICATION Section was formerly classified to section 145 of this title prior to renumbering by Pub. L. 115–278. Section is comprised of section 2207 of Pub. L. 107–296. Subsecs. (d)(1) and (e) to (j) of section 2207 of Pub. L. 107–296 amended sections 1030, 2511, 2512, 2520, 2701 to 2703, and 3125 of Title 18, Crimes and Criminal Proce- dure. § 658. Cybersecurity recruitment and retention (a) Definitions In this section: (1) Appropriate committees of Congress The term ‘‘appropriate committees of Con- gress’’ means the Committee on Homeland Se- curity and Governmental Affairs and the Com- mittee on Appropriations of the Senate and the Committee on Homeland Security and the Committee on Appropriations of the House of Representatives. (2) Collective bargaining agreement The term ‘‘collective bargaining agreement’’ has the meaning given that term in section 7103(a)(8) of title 5. (3) Excepted service The term ‘‘excepted service’’ has the mean- ing given that term in section 2103 of title 5. (4) Preference eligible The term ‘‘preference eligible’’ has the meaning given that term in section 2108 of title 5. (5) Qualified position The term ‘‘qualified position’’ means a posi- tion, designated by the Secretary for the pur- pose of this section, in which the incumbent performs, manages, or supervises functions that execute the responsibilities of the De- partment relating to cybersecurity. (6) Senior Executive Service The term ‘‘Senior Executive Service’’ has the meaning given that term in section 2101a of title 5. (b) General authority (1) Establish positions, appoint personnel, and fix rates of pay (A) General authority The Secretary may— (i) establish, as positions in the excepted service, such qualified positions in the De- partment as the Secretary determines nec- essary to carry out the responsibilities of the Department relating to cybersecurity, including positions formerly identified as— (I) senior level positions designated under section 5376 of title 5; and (II) positions in the Senior Executive Service; (ii) appoint an individual to a qualified position (after taking into consideration the availability of preference eligibles for appointment to the position); and (iii) subject to the requirements of para- graphs (2) and (3), fix the compensation of an individual for service in a qualified po- sition. (B) Construction with other laws The authority of the Secretary under this subsection applies without regard to the pro- visions of any other law relating to the ap- pointment, number, classification, or com- pensation of employees.