[House Report 111-431]
[From the U.S. Government Publishing Office]
111th Congress Report
HOUSE OF REPRESENTATIVES
2d Session 111-431
======================================================================
SECURE FEDERAL FILE SHARING ACT
_______
March 11, 2010.--Committed to the Committee of the Whole House on the
State of the Union and ordered to be printed
_______
Mr. Towns, from the Committee on Oversight and Government Reform,
submitted the following
R E P O R T
[To accompany H.R. 4098]
[Including cost estimate of the Congressional Budget Office]
The Committee on Oversight and Government Reform, to whom was
referred the bill (H.R. 4098) to require the Director of the
Office of Management and Budget to issue guidance on the use of
peer-to-peer file sharing software to prohibit the personal use
of such software by Government employees, and for other
purposes, having considered the same, report favorably thereon
without amendment and recommend that the bill do pass.
CONTENTS
Page
Purpose and Summary.............................................. 2
Background and Need for Legislation.............................. 2
Legislative History.............................................. 2
Section-by-Section............................................... 4
Explanation of Amendments........................................ 6
Committee Consideration.......................................... 6
Roll Call Votes.................................................. 6
Application of Law to the Legislative Branch..................... 6
Statement of General Performance Goals and Objectives............ 6
Constitutional Authority Statement............................... 6
Federal Advisory Committee Act................................... 6
Unfunded Mandate Statement....................................... 6
Earmark Identification........................................... 6
Committee Estimate............................................... 7
Budget Authority and Congressional Budget Office Cost Estimate... 7
Changes in Existing Law Made by the Bill, as Reported............ 8
PURPOSE AND SUMMARY
H.R. 4098, the Secure Federal File Sharing Act, was
introduced by Chairman Towns on November 17, 2009. The purpose
of the bill is to reduce improper disclosures of federal
information by prohibiting the use of open network peer-to-peer
file sharing software on all federal computers, computer
systems, and networks, including those of contractors working
on the government's behalf.
H.R. 4098 directs the Office of Management and Budget (OMB)
to issue new guidance to implement that purpose. In addition,
the bill also directs OMB to set up a procedure by which
agencies may seek approval to use specific file sharing
software for legitimate government purposes. OMB must report
annually to Congress on those peer-to-peer software programs
that have been approved, the agencies that are using them, and
for what purposes.
BACKGROUND AND NEED FOR LEGISLATION
Peer-to-peer file sharing software allows users to
instantly connect with each other to search and copy electronic
files. The popularity of such software has grown exponentially
since being made widely available in the late 1990's and early
2000's by programs like Napster, Kazaa and LimeWire. Currently,
it is estimated that there are up to 20 million peer-to-peer
file sharing users online at any point in time, most commonly
sharing music and movies.
Despite the ongoing growth in users, not many people are
aware of the privacy and security risks associated with open
network peer-to-peer file sharing software. Since 2001, the
Committee has looked into the dangers of peer-to-peer file
sharing with particular emphasis on the prevalence of child
pornography, the privacy and security risks, and the problem of
inadvertently sharing electronic files. It is clear that
efforts by the peer-to-peer file sharing industry to self-
regulate since then have failed. At the Committee's hearing on
inadvertent file sharing on July 29, 2009, it was revealed that
the location of a Secret Service safe house for the First
Family, financial information belonging to Supreme Court
Justice Stephen Breyer, and thousands of medical records and
tax filings were all available online on open peer-to-peer
networks.
H.R. 4098, the Secure Federal File Sharing Act, is intended
to reduce the risk that those kinds of documents are exposed on
file sharing networks by prohibiting the use of open network
peer-to-peer file sharing software on all federal computers,
computer systems, and networks, including those of contractors
working on the government's behalf.
LEGISLATIVE HISTORY
During the 107th Congress, the Committee first sounded the
alarm on some of the dangers of peer-to-peer file sharing
software in a Minority Staff, Special Investigations Division
report entitled Children's Access to Pornography Through
Internet File-Sharing Programs (July 27, 2001).
During the 108th Congress, the Committee followed up with a
hearing on the issue entitled Stumbling onto Smut: The Alarming
Ease of Access to Pornography on Peer-to-Peer Networks (March
13, 2003) where they released another staff report entitled
Children's Exposure to Pornography on Peer-to-Peer Networks
(March 13, 2003).
During the same year, the Committee held another hearing on
this issue focused on privacy and security threats entitled
Overexposed: The Threats to Privacy and Security on File
Sharing Networks (May 15, 2003). At that hearing, the Committee
staff released the report File-Sharing Programs and Peer-To-
Peer Networks: Privacy and Security Risks (May 15, 2003).
Shortly thereafter, the Senate Committee on the Judiciary
held the hearing, The Dark Side of a Bright Idea: Could
Personal and National Security Risks Compromise the Potential
of Peer-to-Peer File Sharing Networks? (June 17, 2003). At that
hearing, Senator Feinstein emphasized the heightened risks of
peer-to-peer file sharing use by government employees. She
said:
Of most concern is the use of peer-to-peer file
sharing by government employees . . . A Federal
employee intending to simply download and share music
files . . . could easily make available every file on
his or her computer, without intending to do so or even
realizing it after the fact. This could include
personal correspondence, private financial information,
and even proprietary and sensitive government
documents.\1\
---------------------------------------------------------------------------
\1\Opening Remarks by Senator Feinstein at the Senate Committee on
the Judiciary hearing entitled The Dark Side of a Bright Idea: Could
Personal and National Security Risks Compromise the Potential of Peer-
to-Peer File Sharing Networks? (June 17, 2003).
Chairman Davis and Ranking Member Waxman attempted to
address that concern when they introduced H.R. 3159, the
Government Network Security Act of 2003 on September 24, 2003.
The bill required federal agencies to address the risks posed
by peer-to-peer file sharing programs when developing their
network security policy and procedures and was reported
favorably with an amendment by the Committee on September 25,
2003, by a voice vote. The bill was agreed to in the House, as
amended, under suspension of the rules on October 8, 2003, by a
voice vote. It was later reported favorably by the Senate
Committee on Governmental Affairs on November 10, 2003, without
amendment and placed on the Senate Legislative Calendar, but
the 108th Congress ended before the Senate took up the bill.
During the 109th Congress, the Committee held the hearing,
Inadvertent Filesharing over Peer-to-Peer Networks (July 24,
2007).
In addition, the Subcommittees on Government Management,
Organization, and Procurement and Information Policy, Census,
and National Archives held a joint legislative hearing on H.R.
4791, the Federal Agency Data Protection Act (February 14,
2008). The legislation was introduced by Representatives Clay,
Towns, and Waxman on December 18, 2007, and included language
requiring federal agencies to develop plans to reduce the risks
to federal networks posed by peer-to-peer file sharing
software. H.R. 4791 was ordered reported, as amended, by the
Committee on Oversight and Government Reform by a voice vote on
April 16, 2008. The bill was agreed to in the House of
Representatives, as amended, under suspension of the rules by a
voice vote on June 3, 2008. On June 4, 2008, H.R. 4791 was
referred to the Senate Committee on Homeland Security and
Governmental Affairs.
During the 111th Congress, the Committee held the hearing,
Inadvertent File Sharing Over Peer-to-Peer Networks: How it
Endangers Citizens and Jeopardizes National Security (July 29,
2009).
The witnesses were Mark Gorton, Chairman, The Lime Group;
Robert Boback, Chief Executive Officer, Tiversa, Inc.; and Tom
Sydnor, Senior Fellow and Director, Center for the Study of
Digital Property at the Progress and Freedom Foundation.
H.R. 4098, the Secure Federal File Sharing Act, was
introduced by Chairman Towns on November 17, 2009. The
Committee held a business meeting on March 4, 2010, and ordered
H.R. 4098 to be reported favorably by voice vote.
SECTION-BY-SECTION
Section 1. Short title
This section provides that the short title of the bill is
the ``Secure Federal File Sharing Act.''
Section 2. Requirements
Subsection (a) requires the Director of the Office of
Management and Budget, in consultation with the Federal Chief
Information Officers Council, to issue guidance within 90 days
on the use of peer-to-peer file sharing software to (1)
prohibit the download, installation, or use by Government
employees and contractors of open network peer-to-peer file
sharing software on all Federal computers, computer systems,
and networks, including those of contractors working on the
government's behalf and (2) address the use of such software by
Government employees and contractors as it relates to telework
and remotely accessing Federal computers, computer systems, and
networks.
Subsection (b) requires the Director of the Office of
Management and Budget to develop a procedure within 90 days by
which the Director, in consultation with the Chief Information
Officer, may receive requests from agency heads or chief
information officers for approval for use by Government
employees and contractors of specific open-network peer-to-peer
file sharing software programs that are (1) necessary for the
day-to-day business operations of the agency; (2) instrumental
in completing a particular task or project that directly
supports the agency's overall mission; (3) necessary for use
between, among, or within Federal, State, or local government
agencies in order to perform official agency business; or (4)
necessary for use during the course of a law enforcement
investigation.
Subsection (c) outlines agency responsibilities. More
specifically, it requires the Director of the Office of
Management and Budget, within 180 days, to direct agencies to
(1) establish or update their personal use policies to be
consistent with the guidance issued pursuant to subsection (a);
(2) require any contract awarded by the agency to include a
requirement that the contractor comply with the guidance issued
pursuant to subsection (a) in the performance of the contract;
(3) update their information technology security or ethics
training policies to ensure that all employees, including those
of contractors working on the Government's behalf, are aware of
the requirements of the guidance required by subsection (a) and
the consequences of engaging in prohibited conduct; and (4)
ensure that proper security controls are in place to prevent,
detect, and remove file sharing software that is prohibited by
the guidance issued pursuant to subsection (a) from all Federal
computers, computer systems, and networks, including those
operated by contractors on the Government's behalf.
Section 3. Annual report
This section describes the reporting requirement of the
Director of the Office of Management and Budget to submit to
the Committee on Oversight and Government Reform in the House
of Representatives and the Committee on Homeland Security and
Governmental Affairs in the Senate, within one year and
annually thereafter, a report on the implementation of this Act
including (1) a justification for each open-network peer-to-
peer file sharing software program that is approved pursuant to
subsection (b) and (2) an inventory of the agencies where such
programs are being used.
Section 4. Definitions
This section defines ``agency'' as having the meaning given
the term ``Executive agency'' by section 105 of title 5, United
States Code.
The term ``open-network,'' with respect to software, is
defined as a network in which (A) access is granted freely,
without limitation or restriction or (B) there are little or no
security measures in place.
As defined by this section, the term ``peer-to-peer file
sharing software'' (A) means a program, application, or
software that is commercially marketed or distributed to the
public and that enables (i) a file or files on the computer on
which such program is installed to be designated as available
for searching and copying to one or more other computers; (ii)
the searching of files on the computer on which such program is
installed and the copying of any such file to another computer
(I) at the initiative of such other computer and without
requiring any action by an owner or authorized user of the
computer on which such program is installed and (II) without
requiring an owner or authorized user of the computer on which
such program is installed to have selected or designated
another computer as the recipient of any such file; and (iii)
an owner or authorized user of the computer on which such
program is installed to search files on one or more other
computers using the same or a compatible program, application,
or software, and copy such files to such owner or user's
computer.
In addition, the term ``peer-to-peer file sharing
software'' (B) does not include a program, application, or
software designed primarily to (i) operate as a server that is
accessible over the Internet using the Internet Domain Name
system; (ii) transmit or receive email messages, instant
messages, real-time audio or video communications, or real-time
voice communications; or (iii) provide network or computer
security (including the detection or prevention of fraudulent
activities), network management, maintenance, diagnostics, or
technical support or repair.
This section defines ``contractor'' as having the meaning
given the terms ``prime contractor'' or ``subcontractor'' in
the Federal Acquisition Regulation.
EXPLANATION OF AMENDMENTS
No amendments were offered to this legislation.
COMMITTEE CONSIDERATION
On Thursday, March 4, 2010, the Committee met in open
session and ordered H.R. 4098 to be reported favorably to the
House by a voice vote.
ROLL CALL VOTES
No roll call votes were held.
APPLICATION OF LAW TO THE LEGISLATIVE BRANCH
Section 102(b)(3) of Public Law 104-1 requires a
description of the application of this bill to the legislative
branch where the bill relates to terms and conditions of
employment or access to public services and accommodations.
H.R. 4098 relates to the use of open network peer-to-peer
file sharing software at federal agencies and among federal
contractors doing business with the government. Therefore, it
does not apply to the legislative branch.
STATEMENT OF GENERAL PERFORMANCE GOALS AND OBJECTIVES
In accordance with clause 3(c)(4) of rule XIII of the Rules
of the House of Representatives, the Committee's performance
goals and objectives are reflected in the descriptive portions
of this report, including protecting federal computer systems,
networks, and government information from improper exposure.
CONSTITUTIONAL AUTHORITY STATEMENT
Under clause 3(d)(1) of rule XIII of the Rules of the House
of Representatives, the Committee must include a statement
citing the specific powers granted to Congress to enact the law
proposed by H.R. 4098. Article I, Section 8, Clause 18 of the
Constitution of the United States grants the Congress the power
to enact this law.
FEDERAL ADVISORY COMMITTEE ACT
The Committee finds that the legislation does not establish
or authorize the establishment of an advisory committee within
the meaning of 5 U.S.C. App., Section 5(b).
UNFUNDED MANDATE STATEMENT
Section 423 of the Congressional Budget and Impoundment
Control Act (as amended by Section 101(a)(2) of the Unfunded
Mandates Reform Act, P.L. 104-4) requires a statement on
whether the provisions of the report include unfunded mandates.
In compliance with this requirement the Committee has received
a letter from the Congressional Budget Office included herein.
EARMARK IDENTIFICATION
H.R. 4098 does not include any congressional earmarks,
limited tax benefits, or limited tariff benefits as defined in
clause 9(e), 9(f), or 9(g) of rule XXI.
COMMITTEE ESTIMATE
Clause 3(d)(2) of rule XIII of the Rules of the House of
Representatives requires an estimate and a comparison by the
Committee of the costs that would be incurred in carrying out
H.R. 4098. However, clause 3(d)(3)(B) of that rule provides
that this requirement does not apply when the Committee has
included in its report a timely submitted cost estimate of the
bill prepared by the Director of the Congressional Budget
Office under section 402 of the Congressional Budget Act.
BUDGET AUTHORITY AND CONGRESSIONAL BUDGET OFFICE COST ESTIMATE
With respect to the requirements of clause 3(c)(2) of rule
XIII of the Rules of the House of Representatives and section
308(a) of the Congressional Budget Act of 1974 and with respect
to requirements of clause 3(c)(3) of rule XIII of the Rules of
the Houseof Representatives and section 402 of the
Congressional Budget Act of 1974, the Committee has received the
following cost estimate for H.R. 4098 from the Director of the
Congressional Budget Office:
March 10, 2010.
Hon. Edolphus Towns,
Chairman, Committee on Oversight and Government Reform,
House of Representatives, Washington, DC.
Dear Mr. Chairman: The Congressional Budget Office has
prepared the enclosed cost estimate for H.R. 4098, the Secure
Federal File Sharing Act.
If you wish further details on this estimate, we will be
pleased to provide them. The CBO staff contact is Matthew
Pickford.
Sincerely,
Douglas W. Elmendorf.
Enclosure.
H.R. 4098--Secure Federal File Sharing Act
H.R. 4098 would require federal agencies to develop and
implement a plan within six months to ensure that computer
systems, including those used by contractors, are secure from
the use of certain file-sharing software. Affected software,
known as peer-to-peer (P2P) file-sharing programs, are
applications that allow users to download and directly share
electronic files from other users. The legislation would not
prohibit the use of all file-sharing programs but would require
the Office of Management and Budget (OMB) to develop a
procedure for agencies to receive approval to use file-sharing
programs. Finally, H.R. 4098 would require agencies to create
plans to address security concerns for government computer
networks.
Most provisions of H.R. 4098 would codify and expand
current practices of the federal government. Under the E-
Government Act of 2002, federal agencies are already charged
with protecting information from unauthorized access, use,
disclosure, disruption, modification, or destruction. In
addition, OMB has already provided guidance on the use of file-
sharing technology.
Under H.R. 4098, OMB would be required to provide
additional guidance and procedures for approving certain file-
sharing programs, and agencies would have additional reporting
and training requirements. Based on information from OMB and
industry sources, and subject to the availability of
appropriated funds, CBO estimates that implementing H.R. 4098
would cost about $10 million over the 2011-2014 period.
Enacting H.R. 4098 could affect direct spending by agencies
not funded through annual appropriations, such as the Tennessee
Valley Authority and the Bonneville Power Administration;
therefore, pay-as-you-go procedures would apply. However, CBO
estimates that those budgetary effects would be insignificant
for each year.
H.R. 4098 contains no intergovernmental mandates as defined
in the Unfunded Mandates Reform Act (UMRA) and would not affect
the budgets of state, local, or tribal governments.
H.R. 4098 would impose a private-sector mandate, as defined
in UMRA, to the extent that it would require federal government
contractors that use file-sharing software to comply with new
restrictions on downloading, installing, or using that software
on computers used for federal work. Because any new contracts
that contain such restrictions would be entered into
voluntarily, the requirements of the bill would only constitute
a mandate to the extent that they would affect existing
contracts. The cost of the mandate would be the expenditures
required to modify computer systems or software to comply with
new requirements. According to several experts in information
technology, most file-sharing programs that are related to work
would not fit the bill's definition of P2P software and,
therefore, would not be subject to the restrictions in the
bill. Consequently, CBO expects that any compliance cost would
fall below the annual threshold for private-sector mandates
established in UMRA ($141 million in 2010, adjusted annually
for inflation).
The CBO staff contacts for this estimate are Matthew
Pickford (for federal costs) and Sam Wice (for the private-
sector impact). This estimate was approved by Theresa Gullo,
Deputy Assistant Director for Budget Analysis.
CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED
No changes to existing law are made by H.R. 4098, as
reported.