6 U.S.C. § 665 — Duties and authorities relating to .gov

Page 355 TITLE 6—DOMESTIC SECURITY § 665 (A) The name, location, and sector classi- fication of each of the systems and assets on the list established under subsection (a)(2). (B) The name, location, and sector classi- fication of each of the systems and assets on such list that are determined by the Sec- retary to be most at risk to terrorism. (C) Any significant challenges in com- piling the list of the systems and assets in- cluded on such list or in the database estab- lished under subsection (a)(1). (D) Any significant changes from the pre- ceding report in the systems and assets in- cluded on such list or in such database. (E) If appropriate, the extent to which such database and such list have been used, individually or jointly, for allocating funds by the Federal Government to prevent, re- duce, mitigate, or respond to acts of ter- rorism. (F) The amount of coordination between the Department and the private sector, through any entity of the Department that meets with representatives of private sector industries for purposes of such coordination, for the purpose of ensuring the accuracy of such database and such list. (G) Any other information the Secretary deems relevant. (3) Classified information The report shall be submitted in unclassified form but may contain a classified annex. (e) National Infrastructure Protection Consor- tium The Secretary may establish a consortium to be known as the ‘‘National Infrastructure Pro- tection Consortium’’. The Consortium may ad- vise the Secretary on the best way to identify, generate, organize, and maintain any database or list of systems and assets established by the Secretary, including the database established under subsection (a)(1) and the list established under subsection (a)(2). If the Secretary estab- lishes the National Infrastructure Protection Consortium, the Consortium may— (1) be composed of national laboratories, Federal agencies, State and local homeland se- curity organizations, academic institutions, or national Centers of Excellence that have dem- onstrated experience working with and identi- fying critical infrastructure and key re- sources; and (2) provide input to the Secretary on any re- quest pertaining to the contents of such data- base or such list. (Pub. L. 107–296, title XXII, § 2214, formerly title II, § 210E, as added Pub. L. 110–53, title X, § 1001(a), Aug. 3, 2007, 121 Stat. 372; renumbered title XXII, § 2214, and amended Pub. L. 115–278, § 2(g)(2)(G), (9)(A)(viii), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 116–283, div. H, title XC, § 9002(c)(2)(E), Jan. 1, 2021, 134 Stat. 4773.) Editorial Notes CODIFICATION Section was formerly classified to section 124l of this title prior to renumbering by Pub. L. 115–278. AMENDMENTS 2021—Subsec. (c)(4). Pub. L. 116–283 substituted ‘‘Sec- tor Risk Management Agency’’ for ‘‘sector-specific agency’’. 2018—Subsecs. (e), (f). Pub. L. 115–278, § 2(g)(9)(A)(viii), redesignated subsec. (f) as (e) and struck out former subsec. (e). Prior to amendment, text of subsec. (e) read as follows: ‘‘By not later than two years after August 3, 2007, the Inspector General of the Department shall conduct a study of the implementation of this section.’’ § 665. Duties and authorities relating to .gov internet domain (a) Definition In this section, the term ‘‘agency’’ has the meaning given the term in section 3502 of title 44. (b) Availability of .gov internet domain The Director shall make .gov internet domain name registration services, as well as any sup- porting services described in subsection (e), gen- erally available— (1) to any Federal, State, local, or territorial government entity, or other publicly con- trolled entity, including any Tribal govern- ment recognized by the Federal Government or a State government, that complies with the requirements for registration developed by the Director as described in subsection (c); (2) without conditioning registration on the sharing of any information with the Director or any other Federal entity, other than the in- formation required to meet the requirements described in subsection (c); and (3) without conditioning registration on par- ticipation in any separate service offered by the Director or any other Federal entity. (c) Requirements The Director, with the approval of the Direc- tor of the Office of Management and Budget for agency .gov internet domain requirements and in consultation with the Director of the Office of Management and Budget for .gov internet do- main requirements for entities that are not agencies, shall establish and publish on a pub- licly available website requirements for the reg- istration and operation of .gov internet domains sufficient to— (1) minimize the risk of .gov internet do- mains whose names could mislead or confuse users; (2) establish that .gov internet domains may not be used for commercial or political cam- paign purposes; (3) ensure that domains are registered and maintained only by authorized individuals; and (4) limit the sharing or use of any informa- tion obtained through the administration of the .gov internet domain with any other De- partment component or any other agency for any purpose other than the administration of the .gov internet domain, the services de- scribed in subsection (e), and the requirements for establishing a .gov inventory described in subsection (h). (d) Executive branch (1) In general The Director of the Office of Management and Budget shall establish applicable proc- Page 356 TITLE 6—DOMESTIC SECURITY § 665 esses and guidelines for the registration and acceptable use of .gov internet domains by agencies. (2) Approval required The Director shall obtain the approval of the Director of the Office of Management and Budget before registering a .gov internet do- main name for an agency. (3) Compliance Each agency shall ensure that any website or digital service of the agency that uses a .gov internet domain is in compliance with the 21st Century IDEA Act (44 U.S.C. 3501 note) and implementation guidance issued pursuant to that Act. (e) Supporting services (1) In general The Director may provide services to the en- tities described in subsection (b)(1) specifically intended to support the security, privacy, reli- ability, accessibility, and speed of registered .gov internet domains. (2) Rule of construction Nothing in paragraph (1) shall be construed to— (A) limit other authorities of the Director to provide services or technical assistance to an entity described in subsection (b)(1); or (B) establish new authority for services other than those the purpose of which ex- pressly supports the operation of .gov inter- net domains and the needs of .gov internet domain registrants. (f) Fees (1) In general The Director may provide any service relat- ing to the availability of the .gov internet do- main program, including .gov internet domain name registration services described in sub- section (b) and supporting services described in subsection (e), to entities described in sub- section (b)(1) with or without reimbursement, including variable pricing. (2) Limitation The total fees collected for new .gov internet domain registrants or annual renewals of .gov internet domains shall not exceed the direct operational expenses of improving, maintain- ing, and operating the .gov internet domain, .gov internet domain services, and .gov inter- net domain supporting services. (g) Consultation The Director shall consult with the Director of the Office of Management and Budget, the Ad- ministrator of General Services, other civilian Federal agencies as appropriate, and entities representing State, local, Tribal, or territorial governments in developing the strategic direc- tion of the .gov internet domain and in estab- lishing requirements under subsection (c), in particular on matters of privacy, accessibility, transparency, and technology modernization. (h) .gov inventory (1) In general The Director shall, on a continuous basis— (A) inventory all hostnames and services in active use within the .gov internet do- main; and (B) provide the data described in subpara- graph (A) to domain registrants at no cost. (2) Requirements In carrying out paragraph (1)— (A) data may be collected through analysis of public and non-public sources, including commercial data sets; (B) the Director shall share with Federal and non-Federal domain registrants all unique hostnames and services discovered within the zone of their registered domain; (C) the Director shall share any data or in- formation collected or used in the manage- ment of the .gov internet domain name reg- istration services relating to Federal execu- tive branch registrants with the Director of the Office of Management and Budget for the purpose of fulfilling the duties of the Direc- tor of the Office of Management and Budget under section 3553 of title 44; (D) the Director shall publish on a publicly available website discovered hostnames that describe publicly accessible agency websites, to the extent consistent with the security of Federal information systems but with the presumption of disclosure; (E) the Director may publish on a publicly available website any analysis conducted and data collected relating to compliance with Federal mandates and industry best practices, to the extent consistent with the security of Federal information systems but with the presumption of disclosure; and (F) the Director shall— (i) collect information on the use of non- .gov internet domain suffixes by agencies for their official online services; (ii) collect information on the use of non-.gov internet domain suffixes by State, local, Tribal, and territorial govern- ments; and (iii) publish the information collected under clause (i) on a publicly available website to the extent consistent with the security of the Federal information sys- tems, but with the presumption of disclo- sure. (3) National security coordination (A) In general In carrying out this subsection, the Direc- tor shall inventory, collect, and publish hostnames and services in a manner con- sistent with the protection of national secu- rity information. (B) Limitation The Director may not inventory, collect, or publish hostnames or services under this subsection if the Director, in coordination with other heads of agencies, as appropriate, determines that the collection or publica- tion would— (i) disrupt a law enforcement investiga- tion; (ii) endanger national security or intel- ligence activities; (iii) impede national defense activities or military operations; or Page 357 TITLE 6—DOMESTIC SECURITY § 665 (iv) hamper security remediation ac- tions. (4) Strategy Not later than 180 days after December 27, 2020, the Director shall develop and submit to the Committee on Homeland Security and Governmental Affairs and the Committee on Rules and Administration of the Senate and the Committee on Homeland Security, the Committee on Oversight and Reform, and the Committee on House Administration of the House of Representatives a strategy to utilize the information collected under this sub- section for countering malicious cyber activ- ity. (Pub. L. 107–296, title XXII, § 2215, as added Pub. L. 116–260, div. U, title IX, § 904(b)(1)(B), Dec. 27, 2020, 134 Stat. 2298; Pub. L. 117–81, div. A, title XV, § 1547(b)(1)(A)(ii), (B), Dec. 27, 2021, 135 Stat. 2060, 2061; Pub. L. 117–263, div. G, title LXXI, § 7143(a)(1), Dec. 23, 2022, 136 Stat. 3654.) Editorial Notes REFERENCES IN TEXT The 21st Century IDEA Act, referred to in subsec. (d)(3), is Pub. L. 115–336, Dec. 20, 2018, 132 Stat. 5025, also known as the 21st Century Integrated Digital Experi- ence Act, which is set out as a note under section 3501 of Title 44, Public Printing and Documents. CODIFICATION Other sections 2215 of Pub. L. 107–296 were renum- bered sections 2216, 2217, and 2218 and are classified, re- spectively, to sections 665b, 665c, and 665d of this title. AMENDMENTS 2022—Pub. L. 117–263 made amendment identical to that made by Pub. L. 117–81, § 1547(b)(1)(B). See 2021 Amendment note below. 2021—Pub. L. 117–81, § 1547(b)(1)(B), made technical amendment to the directory language of section 904(b)(1) of Pub. L. 116–260. Pub. L. 117–81, § 1547(b)(1)(A)(ii), reenacted section catchline. Statutory Notes and Related Subsidiaries CHANGE OF NAME Committee on Oversight and Reform of House of Rep- resentatives changed to Committee on Oversight and Accountability of House of Representatives by House Resolution No. 5, One Hundred Eighteenth Congress, Jan. 9, 2023. EFFECTIVE DATE OF 2022 AMENDMENT Amendment by Pub. L. 117–263 effective as if enacted as part of title IX of div. U of Pub. L. 116–260, see sec- tion 7143(a)(2) of Pub. L. 117–263, set out as a note under section 652 of this title. FINDINGS Pub. L. 116–260, div. U, title IX, § 902, Dec. 27, 2020, 134 Stat. 2297, provided that: ‘‘Congress finds that— ‘‘(1) the .gov internet domain reflects the work of United States innovators in inventing the internet and the role that the Federal Government played in guiding the development and success of the early internet; ‘‘(2) the .gov internet domain is a unique resource of the United States that reflects the history of inno- vation and global leadership of the United States; ‘‘(3) when online public services and official com- munications from any level and branch of govern- ment use the .gov internet domain, they are easily recognized as official and difficult to impersonate; ‘‘(4) the citizens of the United States deserve online public services that are safe, recognizable, and trust- worthy; ‘‘(5) the .gov internet domain should be available at no cost or a negligible cost to any Federal, State, local, or territorial government-operated or publicly controlled entity, including any Tribal government recognized by the Federal Government or a State government, for use in their official services, oper- ations, and communications; ‘‘(6) the .gov internet domain provides a critical service to those Federal, State, local, Tribal, and ter- ritorial governments; and ‘‘(7) the .gov internet domain should be operated transparently and in the spirit of public accessibility, privacy, and security.’’ [For definition of ‘‘State’’ as used in section 902 of Pub. L. 116–260, set out above, see section 903 of Pub. L. 116–260, set out as a note below.] PURPOSE OF .gov INTERNET DOMAIN PROGRAM Pub. L. 116–260, div. U, title IX, § 904(a), Dec. 27, 2020, 134 Stat. 2298, provided that: ‘‘The purpose of the .gov internet domain program is to— ‘‘(1) legitimize and enhance public trust in govern- ment entities and their online services; ‘‘(2) facilitate trusted electronic communication and connections to and from government entities; ‘‘(3) provide simple and secure registration of .gov internet domains; ‘‘(4) improve the security of the services hosted within these .gov internet domains, and of the .gov namespace in general; and ‘‘(5) enable the discoverability of government serv- ices to the public and to domain registrants.’’ [For definition of ‘‘online service’’ as used in section 904(a) of Pub. L. 116–260, set out above, see section 903 of Pub. L. 116–260, set out as a note below.] REFERENCE GUIDE Pub. L. 116–260, div. U, title IX, § 904(b)(2)(B), Dec. 27, 2020, 134 Stat. 2301, provided that: ‘‘Not later than 1 year after the date of enactment of this Act [Dec. 27, 2020], the Director, in consultation with the Adminis- trator and entities representing State, local, Tribal, or territorial governments, shall develop and publish on a publicly available website a reference guide for migrat- ing online services to the .gov internet domain, which shall include— ‘‘(i) process and technical information on how to carry out a migration of common categories of online services, such as web and email services; ‘‘(ii) best practices for cybersecurity pertaining to registration and operation of a .gov internet domain; and ‘‘(iii) references to contract vehicles and other pri- vate sector resources vetted by the Director that may assist in performing the migration.’’ [For definitions of terms used in section 904(b)(2)(B) of Pub. L. 116–260, set out above, see section 903 of Pub. L. 116–260, set out as a note below.] TRANSITION Pub. L. 116–260, div. U, title IX, § 907, Dec. 27, 2020, 134 Stat. 2303, provided that: ‘‘(a) There shall be transferred to the Director the .gov internet domain program, as operated by the Gen- eral Services Administration under title 41, Code of Federal Regulations, on the date on which the Director begins operational administration of the .gov internet domain program, in accordance with subsection (c). ‘‘(b) Not later than 30 days after the date of enact- ment of this Act [probably means ‘‘this title’’, approved Dec. 27, 2020], the Director shall submit a plan for the operational and contractual transition of the .gov internet domain program to the Committee on Home- land Security and Governmental Affairs and the Com- Page 358 TITLE 6—DOMESTIC SECURITY § 665a 1 So in original. Probably should be ‘‘is’’. mittee on Rules and Administration of the Senate and the Committee on Homeland Security, the Committee on Oversight and Reform [now Committee on Oversight and Accountability], and the Committee on House Ad- ministration of the House of Representatives. ‘‘(c) Not later than 120 days after the date of enact- ment of this Act, the Director shall begin operationally administering the .gov internet domain program, and shall publish on a publicly available website the re- quirements for domain registrants as described in sec- tion 2215(b) of the Homeland Security Act of 2002 [6 U.S.C. 665(b)], as added by section 904(b) of this Act. ‘‘(d) On the date on which the Director begins oper- ational administration of the .gov internet domain pro- gram, in accordance with subsection (c), the Adminis- trator shall rescind the requirements in part 102–173 of title 41, Code of Federal Regulations. ‘‘(e) During the 5-year period beginning on the date of enactment of this Act [Dec. 27, 2020], any fee charged to entities that are not agencies for new .gov internet do- main registrants or annual renewals of .gov internet domains shall be not more than the amount of the fee charged for such registration or renewal as of October 1, 2019.’’ [For definition of ‘‘Director’’ as used in section 907 of Pub. L. 116–260, set out above, see section 903 of Pub. L. 116–260, set out as a note below.] DEFINITIONS Pub. L. 116–260, div. U, title IX, § 903, Dec. 27, 2020, 134 Stat. 2298, provided that: ‘‘In this Act [probably means ‘‘this title’’, see Short Title of 2020 Amendment note set out under section 101 of this title]— ‘‘(1) the term ‘Administrator’ means the Adminis- trator of General Services; ‘‘(2) the term ‘agency’ has the meaning given the term in section 3502 of title 44, United States Code; ‘‘(3) the term ‘Director’ means the Director of the Cybersecurity and Infrastructure Security Agency; ‘‘(4) the term ‘online service’ means any internet- facing service, including a website, email, a virtual private network, or a custom application; and ‘‘(5) the term ‘State’ means any State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, Guam, American Samoa, the Commonwealth of the Northern Mariana Islands, and any possession of the United States.’’ § 665a. Intelligence and cybersecurity diversity fellowship program (a) Definitions In this section: (1) Appropriate committees of Congress The term ‘‘appropriate committees of Con- gress’’ means— (A) the Committee on Homeland Security and Governmental Affairs and the Select Committee on Intelligence of the Senate; and (B) the Committee on Homeland Security and the Permanent Select Committee on In- telligence of the House of Representatives. (2) Excepted service The term ‘‘excepted service’’ has the mean- ing given that term in section 2103 of title 5. (3) Historically Black college or university The term ‘‘historically Black college or uni- versity’’ has the meaning given the term ‘‘part B institution’’ in section 1061 of title 20. (4) Institution of higher education The term ‘‘institution of higher education’’ has the meaning given that term in section 1001 of title 20. (5) Minority-serving institution The term ‘‘minority-serving institution’’ means an institution of higher education de- scribed in section 1067q(a) of title 20. (b) Program The Secretary shall carry out an intelligence and cybersecurity diversity fellowship program (in this section referred to as the ‘‘Program’’) under which an eligible individual may— (1) participate in a paid internship at the De- partment that relates to intelligence, cybersecurity, or some combination thereof; (2) receive tuition assistance from the Sec- retary; and (3) upon graduation from an institution of higher education and successful completion of the Program (as defined by the Secretary), re- ceive an offer of employment to work in an in- telligence or cybersecurity position of the De- partment that is in the excepted service. (c) Eligibility To be eligible to participate in the Program, an individual shall— (1) be a citizen of the United States; and (2) as of the date of submitting the applica- tion to participate in the Program— (A) have a cumulative grade point average of at least 3.2 on a 4.0 scale; (B) be a socially disadvantaged individual (as that term in 1 defined in section 124.103 of title 13, Code of Federal Regulations, or suc- cessor regulation); and (C) be a sophomore, junior, or senior at an institution of higher education. (d) Direct hire authority If an individual who receives an offer of em- ployment under subsection (b)(3) accepts such offer, the Secretary shall appoint, without re- gard to provisions of subchapter I of chapter 33 of title 5 (except for section 3328 of such title) such individual to the position specified in such offer. (e) Reports (1) Reports Not later than 1 year after December 27, 2020, and on an annual basis thereafter, the Secretary shall submit to the appropriate committees of Congress a report on the Pro- gram. (2) Matters Each report under paragraph (1) shall in- clude, with respect to the most recent year, the following: (A) A description of outreach efforts by the Secretary to raise awareness of the Pro- gram among institutions of higher education in which eligible individuals are enrolled. (B) Information on specific recruiting ef- forts conducted by the Secretary to increase participation in the Program. (C) The number of individuals partici- pating in the Program, listed by the institu- tion of higher education in which the indi- vidual is enrolled at the time of participa- tion, and information on the nature of such