DOTGOV Act of 2019

II Calendar No. 401 116TH CONGRESS 2D SESSION S. 2749 [Report No. 116–192] To provide requirements for the .gov domain, and for other purposes. IN THE SENATE OF THE UNITED STATES OCTOBER 30, 2019 Mr. PETERS (for himself, Mr. JOHNSON, Ms. KLOBUCHAR, Mr. LANKFORD, Ms. HASSAN, and Mr. BLUNT) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs JANUARY 6, 2020 Reported by Mr. JOHNSON, with amendments [Omit the part struck through and insert the part printed in italic] A BILL To provide requirements for the .gov domain, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 22:19 Jan 06, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2749.RS S2749 2 •S 2749 RS SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘DOTGOV Online 2 Trust in Government Act of 2019’’ or the ‘‘DOTGOV Act 3 of 2019’’. 4 SEC. 2. FINDINGS. 5 Congress finds that— 6 (1) the .gov internet domain reflects the work 7 of United States innovators in inventing the internet 8 and the role that the Federal Government played in 9 guiding the development and success of the early 10 internet; 11 (2) the .gov internet domain is a unique re- 12 source of the United States that reflects the history 13 of innovation and global leadership of the United 14 States; 15 (3) when online public services and official com- 16 munications from any level and branch of govern- 17 ment use the .gov domain, they are easily recognized 18 as official and difficult to impersonate; 19 (4) the citizens of the United States deserve on- 20 line public services that are safe, recognizable, and 21 trustworthy; 22 (5) the .gov internet domain should be available 23 at no cost or a negligible cost to any Federal, State, 24 local, or territorial government-operated or publicly 25 controlled entity, including any Tribal government 26 VerDate Sep 11 2014 22:19 Jan 06, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2749.RS S2749 3 •S 2749 RS recognized by the Federal Government or a State 1 government, for use in their official services, oper- 2 ations, and communications; 3 (6) the .gov internet domain provides a critical 4 service to those Federal, State, local, Tribal, and 5 territorial governments; and 6 (7) the .gov internet domain should be operated 7 transparently and in the spirit of public accessibility, 8 privacy, and security. 9 SEC. 3. DEFINITIONS. 10 In this Act— 11 (1) the term ‘‘Administrator’’ means the Ad- 12 ministrator of General Services; 13 (2) the term ‘‘Director’’ means the Director of 14 the Cybersecurity and Infrastructure Security Agen- 15 cy; 16 (3) the term ‘‘online service’’ means any inter- 17 net-facing service, including a website, email, a vir- 18 tual private network, or a custom application; and 19 (4) the term ‘‘State’’ means any State of the 20 United States, the District of Columbia, the Com- 21 monwealth of Puerto Rico, the Virgin Islands, 22 Guam, American Samoa, the Commonwealth of the 23 Northern Mariana Islands, and any possession of the 24 United States. 25 VerDate Sep 11 2014 22:19 Jan 06, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2749.RS S2749 4 •S 2749 RS SEC. 4. DUTIES OF DEPARTMENT OF HOMELAND SECURITY. 1 (a) PURPOSE.—The purpose of the .gov internet do- 2 main program is to— 3 (1) legitimize and enhance public trust in gov- 4 ernment entities and their online services; 5 (2) facilitate trusted electronic communication 6 and connections to and from government entities; 7 (3) provide simple and secure registration of 8 .gov internet domains; 9 (4) improve the security of the services hosted 10 within these domains, and of the .gov namespace in 11 general; and 12 (5) enable the discoverability of government 13 services to the public and to domain registrants. 14 (b) DUTIES AND AUTHORITIES RELATING TO THE 15 .GOV DOMAIN.— 16 (1) IN GENERAL.—Subtitle A of title XXII of 17 the Homeland Security Act (6 U.S.C. 651 et seq.) 18 is amended— 19 (A) in section 2202(c) (6 U.S.C. 652(c))— 20 (i) in paragraph (10), by striking 21 ‘‘and’’ at the end; 22 (ii) by redesignating paragraph (11) 23 as paragraph (12); and 24 (iii) by inserting after paragraph (10) 25 the following: 26 VerDate Sep 11 2014 22:19 Jan 06, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2749.RS S2749 5 •S 2749 RS ‘‘(11) carry out the duties and authorities relat- 1 ing to the .gov domain, as described in section 2215; 2 and’’; and 3 (B) by adding at the end the following: 4 ‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 5 DOMAIN. 6 ‘‘(a) AVAILABILITY OF .GOV DOMAIN.—The Director 7 shall make .gov domain name registration services, as well 8 as any supporting services described in subsection (c), 9 generally available— 10 ‘‘(1) to any Federal, State, local, or territorial 11 government entity, or other publicly controlled enti- 12 ty, including any Tribal government recognized by 13 the Federal Government or a State government, that 14 complies with the policies requirements for registra- 15 tion developed by the Director as described in sub- 16 section (b); 17 ‘‘(2) without conditioning registration on the 18 sharing of any information with the Director or any 19 other Federal entity, other than the information re- 20 quired to meet the policies requirements described in 21 subsection (b); and 22 ‘‘(3) without conditioning registration on par- 23 ticipation in any separate service offered by the Di- 24 rector or any other Federal entity. 25 VerDate Sep 11 2014 22:19 Jan 06, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2749.RS S2749 6 •S 2749 RS ‘‘(b) REQUIREMENTS.—The Director, in consultation 1 with the Director of the Office of Management and Budg- 2 et, shall establish and publish on a publicly available 3 website requirements for the registration and operation of 4 .gov domains sufficient to— 5 ‘‘(1) minimize the risk of .gov domains whose 6 names could mislead or confuse users; 7 ‘‘(2) establish that .gov domains may not be 8 used for commercial or campaign purposes; 9 ‘‘(3) ensure that domains are registered and 10 maintained only by authorized individuals; and 11 ‘‘(4) limit the sharing or use of any information 12 obtained through the administration of the .gov do- 13 main with any other Department of Homeland Secu- 14 rity component or any other agency of the Federal 15 Government for any purpose other than the adminis- 16 tration of the .gov domain, the services described in 17 subsection (c), and the requirements for establishing 18 a .gov inventory described in subsection (f). 19 ‘‘(c) SUPPORTING SERVICES.— 20 ‘‘(1) IN GENERAL.—The Director may provide 21 services to the entities described in subsection (a)(1) 22 specifically intended to support the security, privacy, 23 reliability, accessibility, and speed of registered .gov 24 domains. 25 VerDate Sep 11 2014 22:19 Jan 06, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2749.RS S2749 7 •S 2749 RS ‘‘(2) RULE OF CONSTRUCTION.—Nothing in 1 this paragraph (1) shall be construed to— 2 ‘‘(A) limit other authorities of the Director 3 to provide services or technical assistance to an 4 entity described in subsection (a)(1); or 5 ‘‘(B) establish new authority for services 6 other than those the purpose of which expressly 7 supports the operation of .gov domains and the 8 needs of .gov domain registrants. 9 ‘‘(d) FEES.—The Director may provide any service 10 relating to the availability of the .gov internet domain pro- 11 gram, including .gov domain name registration services 12 and supporting services described in subsection (c), to en- 13 tities described in subsection (a)(1) with or without reim- 14 bursement. 15 ‘‘(d) FEES.— 16 ‘‘(1) IN GENERAL.—The Director may provide 17 any service relating to the availability of the .gov 18 internet domain program, including .gov domain 19 name registration services described in subsection (a) 20 and supporting services described in subsection (c), to 21 entities described in subsection (a)(1) with or without 22 reimbursement. 23 ‘‘(2) LIMITATION.—The total fees collected for 24 new .gov domain registrants or annual renewals of 25 VerDate Sep 11 2014 22:19 Jan 06, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6203 E:\BILLS\S2749.RS S2749 8 •S 2749 RS .gov domains shall not exceed the direct operational 1 expenses of maintaining the .gov internet domain. 2 ‘‘(e) CONSULTATION.—The Director shall consult 3 with the Director of the Office of Management and Budg- 4 et, the Administrator of General Services, other civilian 5 Federal agencies as appropriate, and entities representing 6 State, local, Tribal, or territorial governments in devel- 7 oping the strategic direction of the .gov domain and in 8 developing the policies required establishing requirements 9 under subsection (b), in particular on matters of privacy, 10 accessibility, transparency, and technology modernization. 11 ‘‘(f) .GOV INVENTORY.— 12 ‘‘(1) IN GENERAL.—The Director shall, on a 13 continuous basis— 14 ‘‘(A) inventory all hostnames and services 15 in active use within the .gov domain; and 16 ‘‘(B) provide the data described in sub- 17 paragraph (A) to domain registrants at no cost. 18 ‘‘(2) REQUIREMENTS.—In carrying out para- 19 graph (1)— 20 ‘‘(A) data may be collected through anal- 21 ysis of public and non-public sources, including 22 commercial data sets; 23 ‘‘(B) the Director shall share with Federal 24 and non-Federal domain registrants all unique 25 VerDate Sep 11 2014 22:19 Jan 06, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2749.RS S2749 9 •S 2749 RS hostnames and services discovered within the 1 zone of their registered domain; 2 ‘‘(C) the Director shall share any data or 3 information collected or used in the manage- 4 ment of the .gov domain name registration serv- 5 ices relating to Federal executive branch reg- 6 istrants with the Director of the Office of Man- 7 agement and Budget for the purpose of ful- 8 filling the duties of the Director of the Office 9 of Management and Budget under section 3553 10 of title 44, United States Code; 11 ‘‘(D) the Director shall publish on a pub- 12 licly available website discovered hostnames that 13 describe publicly accessible Federal agency 14 websites, to the extent consistent with the secu- 15 rity of Federal information systems but with 16 the presumption of disclosure; 17 ‘‘(E) the Director may publish on a pub- 18 licly available website any analysis conducted 19 and data collected relating to compliance with 20 Federal mandates and industry best practices, 21 to the extent consistent with the security of 22 Federal information systems but with the pre- 23 sumption of disclosure; and 24 ‘‘(F) the Director shall— 25 VerDate Sep 11 2014 22:19 Jan 06, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2749.RS S2749 10 •S 2749 RS ‘‘(i) collect information on the use of 1 non-.gov domain suffixes by Federal agen- 2 cies for their official online services; 3 ‘‘(ii) collect information on the use of 4 non-.gov domain suffixes by State, local, 5 Tribal, and territorial governments; and 6 ‘‘(iii) publish the information collected 7 under clause (i) on a publicly available 8 website. 9 ‘‘(3) STRATEGY.—Not later than 180 days after 10 the date of enactment of this Act section, the Direc- 11 tor shall develop and submit to the Committee on 12 Homeland Security and Governmental Affairs and 13 the Committee on Rules and Administration of the 14 Senate and the Committee on Homeland Security 15 and the Committee on House Administration of the 16 House of Representatives a strategy to utilize the in- 17 formation collected under this subsection for coun- 18 tering malicious cyber activity.’’. 19 (2) ADDITIONAL DUTIES.— 20 (A) OUTREACH STRATEGY.—Not later 21 than 1 year after the date of enactment of this 22 Act, the Director, in consultation with the Ad- 23 ministrator and entities representing State, 24 local, Tribal, or territorial governments, shall 25 VerDate Sep 11 2014 22:19 Jan 06, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2749.RS S2749 11 •S 2749 RS develop and submit to the Committee on Home- 1 land Security and Governmental Affairs and the 2 Committee on Rules and Administration of the 3 Senate and the Committee on Homeland Secu- 4 rity and the Committee on House Administra- 5 tion of the House of Representatives an out- 6 reach strategy to local, Tribal, and territorial 7 governments and other publicly controlled enti- 8 ties as determined by the Director to inform 9 and support migration to the .gov domain, 10 which shall include— 11 (i) stakeholder engagement plans; and 12 (ii) information on how migrating in- 13 formation technology systems to the .gov 14 domain is beneficial to that entity, includ- 15 ing benefits relating to cybersecurity and 16 the supporting services offered by the Fed- 17 eral Government. 18 (B) REFERENCE GUIDE.—Not later than 1 19 year after the date of enactment of this Act, the 20 Director, in consultation with the Administrator 21 and entities representing State, local, Tribal, or 22 territorial governments, shall develop and pub- 23 lish on a publicly available website a reference 24 VerDate Sep 11 2014 22:19 Jan 06, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2749.RS S2749 12 •S 2749 RS guide for migrating online services to the .gov 1 domain, which shall include— 2 (i) process and technical information 3 on how to carry out a migration of com- 4 mon categories of online services, such as 5 web and email services; 6 (ii) best practices for cybersecurity 7 pertaining to registration and operation of 8 a .gov domain; and 9 (iii) references to contract vehicles 10 and other private sector resources vetted 11 by the Director that may assist in per- 12 forming the migration. 13 (C) SECURITY ENHANCEMENT PLAN.—Not 14 later than 1 year after the date of enactment of 15 this Act, the Director shall develop and submit 16 to the Committee on Homeland Security and 17 Governmental Affairs and the Committee on 18 Rules and Administration of the Senate and the 19 Committee on Homeland Security and the Com- 20 mittee on House Administration of the House 21 of Representatives a .gov domain security en- 22 hancement strategy and implementation plan on 23 how to improve the cybersecurity benefits of the 24 .gov domain during the 5-year period following 25 VerDate Sep 11 2014 22:19 Jan 06, 2020 Jkt 099200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S2749.RS S2749 13 •S 2749 RS the date of enactment of this Act, which shall 1 inclu [Text truncated for display. Full text available on Congress.gov.]