Secure American Research Act of 2019

II 116TH CONGRESS 1ST SESSION S. 2133 To establish an interagency working group for coordination and development of Federal research protection, and for other purposes. IN THE SENATE OF THE UNITED STATES JULY 16, 2019 Mr. CORNYN (for himself, Ms. ROSEN, Mr. RUBIO, Mr. MURPHY, Mr. HOEVEN, Mrs. GILLIBRAND, Mrs. FISCHER, and Mr. LANKFORD) intro- duced the following bill; which was read twice and referred to the Com- mittee on Homeland Security and Governmental Affairs A BILL To establish an interagency working group for coordination and development of Federal research protection, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Secure American Re- 4 search Act of 2019’’. 5 SEC. 2. SECURING AMERICAN SCIENCE AND TECHNOLOGY. 6 (a) DEFINITIONS.—In this section— 7 (1) the term ‘‘Academies’’ means the National 8 Academies of Science, Engineering and Medicine; 9 VerDate Sep 11 2014 23:46 Jul 19, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2133.IS S2133 kjohnson on DSK79L0C42 with BILLS 2 •S 2133 IS (2) the term ‘‘Federal science agency’’ means 1 any Federal agency with not less than $100,000,000 2 in basic and applied research obligations in fiscal 3 year 2018; 4 (3) the term ‘‘grantee’’ means an entity that 5 is— 6 (A) a recipient or subrecipient of a Federal 7 grant or cooperative agreement; and 8 (B) an institution of higher education or a 9 nonprofit organization; 10 (4) the term ‘‘institution of higher education’’ 11 has the meaning given the term in section 101 of the 12 Higher Education Act of 1965 (20 U.S.C. 1001); 13 (5) the term ‘‘relevant Committees’’ means— 14 (A) the Committee on Commerce, Science, 15 and Transportation of the Senate; 16 (B) the Committee on Science, Space, and 17 Technology of the House of Representatives; 18 (C) the Committee on Armed Services of 19 the Senate; 20 (D) the Committee on Armed Services of 21 the House of Representatives; 22 (E) the Committee on Homeland Security 23 and Governmental Affairs of the Senate; 24 VerDate Sep 11 2014 23:46 Jul 19, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2133.IS S2133 kjohnson on DSK79L0C42 with BILLS 3 •S 2133 IS (F) the Committee on Oversight and Re- 1 form of the House of Representatives; 2 (G) the Committee on Foreign Relations of 3 the Senate; and 4 (H) the Committee on Foreign Affairs of 5 the House of Representatives; 6 (6) the term ‘‘roundtable’’ means the National 7 Science, Technology, and Security Roundtable estab- 8 lished under subsection (d); and 9 (7) the term ‘‘working group’’ means the inter- 10 agency working group established under subsection 11 (b). 12 (b) INTERAGENCY WORKING GROUP FOR COORDINA- 13 TION AND DEVELOPMENT OF FEDERAL RESEARCH PRO- 14 TECTION.— 15 (1) IN GENERAL.—The Director of the Office of 16 Science and Technology Policy, acting through the 17 National Science and Technology Council and in 18 consultation with the National Security Advisor, 19 shall establish an interagency working group to co- 20 ordinate activities to protect federally funded re- 21 search and development from foreign interference, 22 cyberattacks, theft, or espionage and to develop com- 23 mon definitions and best practices for Federal 24 science agencies and grantees, while accounting for 25 VerDate Sep 11 2014 23:46 Jul 19, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2133.IS S2133 kjohnson on DSK79L0C42 with BILLS 4 •S 2133 IS the importance of the open exchange of ideas and 1 international talent required for scientific progress 2 and American leadership in science and technology. 3 (2) MEMBERSHIP.— 4 (A) IN GENERAL.—The working group 5 shall include a representative of— 6 (i) the National Science Foundation; 7 (ii) the Department of Energy; 8 (iii) the National Aeronautics and 9 Space Administration; 10 (iv) the National Institute of Stand- 11 ards and Technology; 12 (v) the Department of Commerce; 13 (vi) the National Institutes of Health; 14 (vii) the Department of Defense; 15 (viii) the Department of Agriculture; 16 (ix) the Department of Education; 17 (x) the Department of State; 18 (xi) the Department of the Treasury; 19 (xii) the Department of Justice; 20 (xiii) the Department of Homeland 21 Security; 22 (xiv) the Central Intelligence Agency; 23 (xv) the Federal Bureau of Investiga- 24 tion; 25 VerDate Sep 11 2014 23:46 Jul 19, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2133.IS S2133 kjohnson on DSK79L0C42 with BILLS 5 •S 2133 IS (xvi) the Office of the Director of Na- 1 tional Intelligence; 2 (xvii) the Office of Management and 3 Budget; 4 (xviii) the National Economic Council; 5 and 6 (xix) such other Federal department 7 or agency as the President considers ap- 8 propriate. 9 (B) CHAIR.—The working group shall be 10 chaired by the Director of the Office of Science 11 and Technology Policy, or a designee of the Di- 12 rector. 13 (3) RESPONSIBILITIES OF THE WORKING 14 GROUP.—The working group shall— 15 (A) identify known and potential cyber, 16 physical, and human intelligence threats and 17 vulnerabilities within the United States sci- 18 entific and technological enterprise; 19 (B) coordinate efforts among Federal 20 agencies to update and share important infor- 21 mation with grantees, including specific exam- 22 ples of interference, cyberattacks, theft, or espi- 23 onage directed at federally funded research and 24 VerDate Sep 11 2014 23:46 Jul 19, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2133.IS S2133 kjohnson on DSK79L0C42 with BILLS 6 •S 2133 IS development or the integrity of the United 1 States scientific enterprise; 2 (C) identify effective existing mechanisms 3 for protection of federally funded research and 4 development, including mechanisms grantees 5 are employing to protect federally funded re- 6 search; 7 (D) develop an inventory of— 8 (i) terms and definitions used across 9 Federal science agencies to delineate areas 10 that may require additional protection; and 11 (ii) policies and procedures at Federal 12 science agencies regarding protection of 13 federally funded research; 14 (E) develop and periodically update unclas- 15 sified policy guidance to assist Federal science 16 agencies and grantees in having consistent poli- 17 cies to defend against threats to federally fund- 18 ed research and development and the integrity 19 of the United States scientific enterprise that— 20 (i) includes— 21 (I) descriptions of known and po- 22 tential threats, including organiza- 23 tions of concern, to federally funded 24 research and development and the in- 25 VerDate Sep 11 2014 23:46 Jul 19, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2133.IS S2133 kjohnson on DSK79L0C42 with BILLS 7 •S 2133 IS tegrity of the United States scientific 1 enterprise; 2 (II) common definitions and ter- 3 minology for categorization of re- 4 search and technologies that are pro- 5 tected; 6 (III) identified areas of research 7 or technology that might require addi- 8 tional protection; 9 (IV) recommendations for how 10 existing frameworks and control 11 mechanisms can be better utilized to 12 protect federally funded research and 13 development from foreign interference, 14 cyberattacks, theft or espionage, in- 15 cluding any recommendations for up- 16 dates to existing frameworks and con- 17 trol mechanisms and any rec- 18 ommendations, as appropriate, for 19 new mechanisms for the protection of 20 federally funded research; 21 (V) recommendations for best 22 practices for Federal science agencies 23 and grantees to defend against threats 24 to federally funded research and de- 25 VerDate Sep 11 2014 23:46 Jul 19, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2133.IS S2133 kjohnson on DSK79L0C42 with BILLS 8 •S 2133 IS velopment, including coordination and 1 harmonization of any relevant report- 2 ing requirements that Federal science 3 agencies implement for grantees; 4 (VI) assessments of potential 5 consequences that any proposed prac- 6 tices would have on international col- 7 laboration and United States leader- 8 ship in science and technology; and 9 (VII) a classified addendum as 10 necessary to further inform Federal 11 science agency decisionmaking; and 12 (ii) accounts for the range of needs 13 across different sectors of the United 14 States science and technology enterprise; 15 (F) develop and ensure the implementation 16 of a means for Federal agencies listed in para- 17 graph (2)(A) to aggregate and share Federal 18 agency information regarding completed inves- 19 tigations of researchers that were determined to 20 be knowingly fraudulent in disclosure of foreign 21 interests, investments, or involvement relating 22 to Federal research, which shall— 23 (i) be shared among agencies listed in 24 paragraph (2)(A); 25 VerDate Sep 11 2014 23:46 Jul 19, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2133.IS S2133 kjohnson on DSK79L0C42 with BILLS 9 •S 2133 IS (ii) not be made available to the pub- 1 lic; and 2 (iii) not be subject to the require- 3 ments of section 552 of title 5, United 4 States Code (commonly known as the 5 ‘‘Freedom of Information Act’’); and 6 (G) develop guidelines to create a con- 7 sistent cybersecurity policy across Federal agen- 8 cies to protect federally funded research and de- 9 velopment from foreign interference theft or es- 10 pionage through cybersecurity breaches, which 11 shall— 12 (i) be based on the framework the Na- 13 tional Institute of Standards and Tech- 14 nology entitled ‘‘Framework for Improving 15 Critical Infrastructure Cybersecurity,’’ and 16 in the case of controlled unclassified infor- 17 mation, on Special Publication 800–181 of 18 the National Institutes of Standards and 19 Technology entitled ‘‘Protecting Controlled 20 Unclassified Information in Nonfederal 21 Systems and Organizations’’, or any suc- 22 cessor thereto; 23 (ii) include guidance on specific means 24 Federal agencies can use to ensure grant- 25 VerDate Sep 11 2014 23:46 Jul 19, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2133.IS S2133 kjohnson on DSK79L0C42 with BILLS 10 •S 2133 IS ees are complying with cybersecurity 1 standards that Federal agencies develop 2 consistent with this subparagraph; and 3 (iii) incorporate input from grantees, 4 including from— 5 (I) facility security officers; 6 (II) chief information officers; 7 (III) vice presidents for research; 8 (IV) chief technology officers; 9 and 10 (V) other relevant officers as de- 11 termined by the working group. 12 (4) COORDINATION WITH NATIONAL ACADEMIES 13 ROUNDTABLE.—The Director of the Office of 14 Science and Technology Policy shall coordinate with 15 the Academies to ensure that not less than 1 mem- 16 ber of the working group is also a member of the 17 roundtable. 18 (5) INTERIM REPORT.—Not later than 6 19 months after the date of enactment of this Act, the 20 Director of the Office of Science and Technology 21 Policy shall provide a report to the relevant Commit- 22 tees that includes— 23 (A) the inventory required under para- 24 graph (3)(D); 25 VerDate Sep 11 2014 23:46 Jul 19, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2133.IS S2133 kjohnson on DSK79L0C42 with BILLS 11 •S 2133 IS (B) an update on progress toward devel- 1 oping the policy guidance required under para- 2 graph (3)(E); and 3 (C) any additional activities undertaken by 4 the working group in that time. 5 (6) BIENNIAL REPORTING.—Not later than 2 6 years after the date of enactment of this Act, and 7 not less frequently than every 2 years thereafter, the 8 Director of the Office of Science and Technology 9 Policy shall provide to the relevant Committees a 10 summary report on the activities of the working 11 group and the most current version of the policy 12 guidance required under subparagraphs (E) and (G) 13 of paragraph (3). 14 (c) CYBER STANDARDS.— 15 (1) IN GENERAL.—Each Federal research agen- 16 cy shall— 17 (A) issue standards consistent with those 18 developed under subsection (b)(3)(G); and 19 (B) ensure that grantees are employing cy- 20 bersecurity practices that meet those agency 21 standards using means consistent with those 22 developed under subsection (b)(3)(G)(ii). 23 (2) COOPERATIVE AGREEMENTS.—Each Fed- 24 eral research agency shall make compliance with the 25 VerDate Sep 11 2014 23:46 Jul 19, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2133.IS S2133 kjohnson on DSK79L0C42 with BILLS 12 •S 2133 IS standards described in paragraph (1), as determined 1 by the means described in that paragraph, a require- 2 ment in each grant to or cooperative agreement with 3 a grantee. 4 (d) NATIONAL SCIENCE, TECHNOLOGY, AND SECU- 5 RITY ROUNDTABLE.— 6 (1) IN GENERAL.—The National Science Foun- 7 dation, the Department of Energy, and the Depart- 8 ment of Defense, and any other Federal agency as 9 determined by the Director of the Office of Science 10 and Technology Policy, shall enter into a joint agree- 11 ment with the Academies to create a National 12 Science, Technology, and Security Roundtable. 13 (2) PARTICIPANTS.—The roundtable shall in- 14 clude senior representatives and practitioners from 15 Federal science, intelligence, national security agen- 16 cies, and law enforcement agencies, as well as key 17 stakeholders in the United States scientific enter- 18 prise, including institutions of higher education, 19 Federal research laboratories, industry, and non- 20 profit research organizations. 21 (3) PURPOSE.—The purpose of the roundtable 22 is to facilitate among participants— 23 (A) exploration of critical issues related to 24 protecting United States national and economic 25 VerDate Sep 11 2014 23:46 Jul 19, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S2133.IS S2133 kjohnson on DSK79L0C42 with BILLS 13 •S 2133 IS security while ensuring the open exchange of 1 ideas and international talent required for sci- 2 entific progress and the leadership of the 3 United States in science and technology; 4 (B) identification and consideration of se- 5 curity threats and risks involving federally 6 funded research and development, including for- 7 eign interference, cyber attacks, theft, or espio- 8 nage; 9 (C) identification of effective approaches 10 for communicating the threats and risks identi- 11 fied in subparagraph (B) to the academic and 12 scientific community, including through the 13 sharing of unclassified data and relevant case 14 studies; 15 (D) sharing of best practices for address- 16 ing and mitigating the threats and ris [Text truncated for display. Full text available on Congress.gov.]