[Congressional Record: April 13, 2000 (Senate)] [Page S2729-S2771] From the Congressional Record Online via GPO Access [wais.access.gpo.gov] [DOCID:cr13ap00pt2-155] STATEMENTS ON INTRODUCED BILLS AND JOINT RESOLUTIONS [Excerpt] By Mr. LEAHY: S. 2430. A bill to combat computer hacking through enhanced law enforcement and to protect the privacy and constitutional rights of Americans, and for other purposes; to the Committee on the Judiciary. Internet Security Act of 2000 Mr. LEAHY. Mr. President, as we head into the twenty-first century, computer-related crime is one of the greatest challenges facing law enforcement. Many of our critical infrastructures and our government depend upon the reliability and security of complex computer systems. We need to make sure that these essential systems are protected from all forms of attack. The legislation I am introducing today will help law enforcement investigate and prosecute those who jeopardize the integrity of our computer systems and the Internet. Whether we work in the private sector or in government, we negotiate daily through a variety of security checkpoints designed to protect ourselves from being victimized by crime or targeted by terrorists. For instance, congressional buildings like this one use cement pillars placed at entrances, photo identification cards, metal detectors, x-ray scanners, and security guards to protect the physical space. These security steps and others have become ubiquitous in the private sector as well. Yet all these physical barriers can be circumvented using the wires that run into every building to support the computers and computer networks that are the mainstay of how we communicate and do business. This plain fact was amply demonstrated by the recent hacker attacks on E-Trade, ZDNet, Datek, Yahoo, eBay, Amazon.com and other Internet sites. These attacks raise serious questions about Internet security-- questions that we need to answer to ensure the long-term stability of electronic commerce. More importantly, a well-focused and more malign cyber-attack on computer networks that support telecommunications, transportation, water supply, banking, electrical power and other critical infrastructure systems could wreak havoc on our national economy or even jeopardize our national defense. We have learned that even law enforcement is not immune. Just recently we learned of a denial of service attack successfully perpetrated against a FBI web site, shutting down that site for several hours. The cybercrime problem is growing. The reports of the CERT Coordination Center (formerly called the ``Computer Emergency Response Team''), which was established in 1988 to help the Internet community detect and resolve computer security incidents, provide chilling statistics on the vulnerabilities of the Internet and the scope of the problem. Over the last decade, the number of reported computer security incidents grew from 6 in 1988 to more than 8,000 in 1999. But that alone does not reveal the scope of the problem. According to CERT's most recent annual report, more than four million computer hosts were affected by the computer security incidents in 1999 alone by damaging computer viruses, with names like ``Melissa,'' ``Chernobyl,'' ``ExploreZip,'' and by the other ways that remote intruders have found to exploit system vulnerabilities. Even before the recent headline- grabbing ``denial-of-service'' attacks, CERT documented that such incidents ``grew at rate around 50% per year'' which was ``greater than the rate of growth of Internet hosts.'' CERT has tracked recent trends in severe hacking incidents on the Internet and made the following observations, First, hacking techniques are getting more sophisticated. That means law enforcement is going to have to get smarter too, and we need to give them the resources to do this. Second, hackers have ``become increasingly difficult to locate and identify.'' These criminals are operating in many different locations and are using techniques that allow them to operate in ``nearly total obscurity.'' We have been aware of the vulnerabilities to terrorist attacks of our computer networks for more than a decade. It became clear to me, when I chaired a series of hearings in 1988 and 1989 by the Subcommittee on Technology and the Law in the Senate Judiciary Committee on the subject of high-tech terrorism and the threat of computer viruses, that merely ``hardening'' our physical space from potential attack would only prompt committed criminals and terrorists to switch tactics and use new technologies to reach vulnerable softer targets, such as our computer systems and other critical infrastructures. The government has a responsibility to work with those in the private sector to assess those vulnerabilities and defend them. That means making sure our law enforcement agencies have the tools they need, but also that the government does not stand in the way of smart technical solutions to defend our computer systems. Targeting cybercrime with up-to-date criminal laws and tougher law enforcement is only part of the solution. While criminal penalties may deter some computer criminals, these laws usually come into play too late, after the crime has been committed and the injury inflicted. We should keep in mind the adage that the best defense is a good offense. Americans and American firms must be encouraged to take preventive measures to protect their computer information and systems. Just recently, internet providers and companies such as Yahoo! and Amazon.com Inc., and computer hardware companies such a Cisco Systems Inc., proved successful at stemming attacks within hours thereby limiting losses. That is why, for years, I have advocated and sponsored legislation to encourage the widespread use of strong encryption. Encryption is an important tool in our arsenal to protect the security of our computer information and networks. The Administration made enormous progress earlier this year when it issued new regulations relaxing export controls on strong encryption. Of course, encryption technology cannot be the sole source of protection for our critical computer networks and computer-based infrastructure, but we need to make sure the government is encouraging--and not restraining--the use of strong encryption and other technical solutions to protecting our computer systems. Congress has responded again and again to help our law enforcement agencies keep up with the challenges of new crimes being executed over computer networks. In 1984, we passed the Computer Fraud and Abuse Act, and its amendments, to criminalize conduct when carried out by means of unauthorized access to a computer. In 1986, we passed the Electronic Communications Privacy Act (ECPA), which I was proud to sponsor, to criminalize tampering with electronic mail systems and remote data processing systems and to protect the privacy of computer users. In the 104th Congress, Senators Kyl, Grassley, and I worked together to enact the National Information Infrastructure Protection Act to increase protection under federal criminal law for both government and private computers, and to address an emerging problem of computer-age blackmail in which a criminal threatens to harm or shut down a computer system unless their extortion demands are met. [[Page S2739]] In this Congress, I have introduced a bill with Senator DeWine, the Computer Crime Enforcement Act, S. 1314, to set up a $25 million grant program within the U.S. Department of Justice for states to tap for improved education, training, enforcement and prosecution of computer crimes. All 50 states have now enacted tough computer crime control laws. These state laws establish a firm groundwork for electronic commerce and Internet security. Unfortunately, too many state and local law enforcement agencies are struggling to afford the high cost of training and equipment necessary for effective enforcement of their state computer crime statutes. Our legislation, the Computer Crime Enforcement Act, would help state and local law enforcement join the fight to combat the worsening threats we face from computer crime. Computer crime is a problem nationwide and in Vermont. I recently released a survey on computer crime in Vermont. My office surveyed 54 law enforcement agencies in Vermont--43 police departments and 11 State's attorney offices--on their experience investigating and prosecuting computer crimes. The survey found that more than half of these Vermont law enforcement agencies encounter computer crime, with many police departments and state's attorney offices handling 2 to 5 computer crimes per month. Despite this documented need, far too many law enforcement agencies in Vermont cannot afford the cost of policing against computer crimes. Indeed, my survey found that 98% of the responding Vermont law enforcement agencies do not have funds dedicated for use in computer crime enforcement. My survey also found that few law enforcement officers in Vermont are properly trained in investigating computer crimes and analyzing cyber- evidence. According to my survey, 83% of responding law enforcement agencies in Vermont do not employ officers properly trained in computer crime investigative techniques. Moreover, my survey found that 52% of the law enforcement agencies that handle one or more computer crimes per month cited their lack of training as a problem encountered during investigations. Proper training is critical to ensuring success in the fight against computer crime. This bill will help our computer crime laws up to date as an important backstop and deterrent. I believe that our current computer crime laws can be enhanced and that the time to act is now. We should pass legislation designed to improve our law enforcement efforts while at the same time protecting the privacy rights of American citizens. The bill I offer today will make it more efficient for law enforcement to use tools that are already available--such as pen registers and trap and trace devices--to track down computer criminals expeditiously. It will ensure that law enforcement can investigate and prosecute hacker attacks even when perpetrators use foreign-based computers to facilitate their crimes. It will implement criminal forfeiture provisions to ensure that cybercriminals are forced to relinquish the tools of their trade upon conviction. It will also close a current loophole in our wiretap laws that prevents a law enforcement officer from monitoring an innocent-host computer with the consent of the computer's owner and without a wiretap order to track down the source of denial-of-service attacks. Finally, this legislation will assist state and local police departments in their parallel efforts to combat cybercrime, in recognition of the fact that this fight is not just at the federal level. The key provisions of the bill are: Jurisdictional and Definitional Changes to the Computer Fraud and Abuse Act: The Computer Fraud and Abuse Act, 18 U.S.C. Sec. 1030, is the primary federal criminal statute prohibiting computer frauds and hacking. This bill would amend the statute to clarify the appropriate scope of federal jurisdiction. First, the bill adds a broad definition of ``loss'' to the definitional section. Calculation of loss is important both in determining whether the $5,000 jurisdictional hurdle in the statute is met, and, at sentencing, in calculating the appropriate guideline range and restitution amount. Second, the bill amends the definition of ``protected computer,'' to expressly include qualified computers even when they are physically located outside of the United States. This clarification will preserve the ability of the United States to assist in international hacking cases. A ``Sense of Congress'' provision specifies that federal jurisdiction is justified by the ``interconnected and interdependent nature of computers used in interstate or foreign commerce.'' Finally, the bill expands the jurisdiction of the United States Secret Service to encompass investigations of all violations of 18 U.S.C. Sec. 1030. Prior to the 1996 amendments to the Computer Fraud and Abuse Act, the Secret Service was authorized to investigate any and all violations of section 1030, pursuant to an agreement between the Secretary of Treasury and the Attorney General. The 1996 amendments, however, concentrated Secret Service jurisdiction on certain specified subsections of section 1030. The current amendment would return full jurisdiction to the Secret Service and would allow the Justice and Treasury Departments to decide on the appropriate work-sharing balance between the two. Elimination of Mandatory Minimum Sentence for Certain Violations of Computer Fraud and Abuse Act: Currently, a directive to the Sentencing Commission requires that all violations, including misdemeanor violations, of certain provisions of the Computer Fraud and Abuse Act be punished with a term of imprisonment of at least six months. The bill would change this directive to the Sentencing Commission so that no such mandatory minimum would be required. Additional Criminal Forfeiture Provisions: The bill adds a criminal forfeiture provision to the Computer Fraud and Abuse Act, requiring forfeiture of physical property used in or to facilitate the offense as well as property derived from proceeds of the offense. It also supplements the current forfeiture provision in 18 U.S.C. 2318, which prohibits trafficking in, among other things, counterfeit computer program documentation and packaging, to require the forfeiture of replicators and other devices used in the production of such counterfeit items. Pen Registers and Trap and Trace Devices: The bill makes it easier for law enforcement to use these investigative techniques in the area of cybercrime, and institutes corresponding privacy protections. On the law enforcement side, the bill gives nationwide effect to pen register and trap and trace orders obtained by Government attorneys, thus obviating the need to obtain identical orders in multiple federal jurisdictions. It also clarifies that such devices can be used on all electronic communication lines, not just telephone lines. On the privacy side, the bill provides for greater judicial review of applications for pen registers and trap and trace devices and institutes a minimization requirement for the use of such devices. The bill also amends the reporting requirements for applications for such devices by specifying the information to be reported. Denial of Service Investigations: Currently, a person whose computer is accessed by a hacker as a means for the hacker to reach a third computer cannot simply consent to law enforcement monitoring of his computer. Instead, because this person is not technically a party to the communication, law enforcement needs wiretap authorization under Title III to conduct such monitoring. The bill will close this loophole by explicitly permitting such monitoring without a wiretap if prior consent is obtained from the person whose computer is being hacked through and used to send ``harmful interference to a lawfully operating computer system.'' Encryption Reporting: The bill directs the Attorney General to report the number of wiretap orders in which encryption was encountered and whether such encryption precluded law enforcement from obtaining the plaintext of intercepted communications. State and Local Computer Crime Enforcement: The bill directs the Office of Federal Programs to make grants to assist State and local law enforcement in the investigation and prosecution of computer crime. Legislation must be balanced to protect our privacy and other constitutional rights. I am a strong proponent [[Page S2740]] of the Internet and a defender of our constitutional rights to speak freely and to keep private our confidential affairs from either private sector snoops or unreasonable government searches. These principles can be respected at the same time we hold accountable those malicious mischief makers and digital graffiti sprayers, who use computers to damage or destroy the property of others. I have seen Congress react reflexively in the past to address concerns over anti-social behavior on the Internet with legislative proposals that would do more harm than good. A good example of this is the Communications Decency Act, which the Supreme Court declared unconstitutional. We must make sure that our legislative efforts are precisely targeted on stopping destructive acts and that we avoid scattershot proposals that would threaten, rather than foster, electronic commerce and sacrifice, rather than promote, our constitutional rights. Technology has ushered in a new age filled with unlimited potential for commerce and communications. But the Internet age has also ushered in new challenges for federal, state and local law enforcement officials. Congress and the Administration need to work together to meet these new challenges while preserving the benefits of our new era. The legislation I offer today is a step in that direction. Mr. President, I ask unanimous consent that the text of the bill be printed in the Record. There being no objection, the bill was ordered to be printed in the Record, as follows: S. 2430 Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, SECTION 1. SHORT TITLE. This Act may be cited as the ``Internet Security Act of 2000''. SEC. 2. AMENDMENTS TO THE COMPUTER FRAUD AND ABUSE ACT. Section 1030 of title 18, United States Code, is amended-- (1) in subsection (a)-- (A) in paragraph (5)-- (i) by inserting ``(i)'' after ``(A)'' and redesignating subparagraphs (B) and (C) as clauses (ii) and (iii), respectively; (ii) in subparagraph (A)(iii), as redesignated, by adding ``and'' at the end; and (iii) by adding at the end the following: ``(B) the conduct described in clause (i), (ii), or (iii) of subparagraph (A)-- ``(i) caused loss aggregating at least $5,000 in value during a 1-year period to 1 or more individuals; ``(ii) modified or impaired, or potentially modified or impaired, the medical examination, diagnosis, treatment, or care of 1 or more individuals; ``(iii) caused physical injury to any person; or ``(iv) threatened public health or safety;''; and (B) in paragraph (6), by adding ``or'' at the end; (2) in subsection (c)-- (A) in paragraph (2)-- (i) in subparagraph (A), by striking ``and'' at the end; and (ii) in subparagraph (B), by inserting ``or an attempted offense'' after ``in the case of an offense''; and (B) by adding at the end the following: ``(4) forfeiture to the United States in accordance with subsection (i) of the interest of the offender in-- ``(A) any personal property used or intended to be used to commit or to facilitate the commission of the offense; and ``(B) any property, real or personal, that constitutes or that is derived from proceeds traceable to any violation of this section.''; (3) in subsection (d)-- (A) by striking ``subsections (a)(2)(A), (a)(2)(B), (a)(3), (a)(4), (a)(5), and (a)(6) of''; and (B) by striking ``which shall be entered into by'' and inserting ``between''; (4) in subsection (e)-- (A) in paragraph (2)(B), by inserting ``, including computers located outside the United States'' before the semicolon; (B) in paragraph (4), by striking the period at the end and inserting a semicolon; (C) in paragraph (7), by striking ``and'' at the end; (D) in paragraph (8), by striking ``, that'' and all that follows through ``; and'' and inserting a semicolon; (E) in paragraph (9), by striking the period at the end and inserting ``; and''; and (F) by adding at the end the following: ``(10) the term `loss' includes-- ``(A) the reasonable costs to any victim of-- ``(i) responding to the offense; ``(ii) conducting a damage assessment; and ``(iii) restoring the system and data to their condition prior to the offense; and ``(B) any lost revenue or costs incurred by the victim as a result of interruption of service.''; (5) in subsection (g), by striking ``Damages for violations involving damage as defined in subsection (c)(8)(A)'' and inserting ``losses specified in subsection (a)(5)(B)(i)''; and (6) by adding at the end the following: ``(i) Provisions Governing Forfeiture.--Property subject to forfeiture under this section, any seizure and disposition thereof, and any administrative or judicial proceeding in relation thereto, shall be governed by subsection (c) and subsections (e) through (p) of section 413 of the Comprehensive Drug Abuse Prevention and Control Act of 1970 (21 U.S.C. 853).''. SEC. 3. SENSE OF CONGRESS. It is the sense of Congress that-- (1) acts that damage or attempt to damage computers used in the delivery of critical infrastructure services such as telecommunications, energy, transportation, banking and financial services, and emergency and government services pose a serious threat to public health and safety and cause or have the potential to cause losses to victims that include costs of responding to offenses, conducting damage assessments, and restoring systems and data to their condition prior to the offense, as well as lost revenue and costs incurred as a result of interruptions of service; and (2) the Federal Government should have jurisdiction to investigate acts affecting protected computers, as defined in section 1030(e)(2)(B) of title 18, United States Code, as amended by this Act, even if the effects of such acts occur wholly outside the United States, as in such instances a sufficient Federal nexus is conferred through the interconnected and interdependent nature of computers used in interstate or foreign commerce or communication. SEC. 4. MODIFICATION OF SENTENCING COMMISSION DIRECTIVE. Pursuant to its authority under section 994(p) of title 28, United States Code, the United States Sentencing Commission shall amend the Federal sentencing guidelines to ensure that any individual convicted of a violation of paragraph (4) or (5) of section 1030(a) of title 18, United States Code, can be subjected to appropriate penalties, without regard to any mandatory minimum term of imprisonment. SEC. 5. FORFEITURE OF DEVICES USED IN COMPUTER SOFTWARE COUNTERFEITING. Section 2318(d) of title 18, United States Code, is amended by-- (1) inserting ``(1)'' before ``When''; (2) inserting ``, and any replicator or other device or thing used to copy or produce the computer program or other item to which the counterfeit label was affixed, or was intended to be affixed'' before the period; and (3) by adding at the end the following: ``(2) The forfeiture of property under this section, including any seizure and disposition of the property, and any related judicial or administrative proceeding, shall be governed by the provisions of section 413 (other than subsection (d) of that section) of the Comprehensive Drug Abuse Prevention and Control Act of 1970 (21 U.S.C. 853).''. SEC. 6. CONFORMING AMENDMENT. Section 492 of title 18, United States Code, is amended by striking ``or 1720,'' and inserting ``, 1720, or 2318''. SEC. 7. PEN REGISTERS AND TRAP AND TRACE DEVICES. Section 3123 of title 18, United States Code is amended-- (1) by striking subsection (a) and inserting the following: ``(a) Issuance of Order.-- ``(1) Requests from attorneys for the government.--Upon an application made under section 3122(a)(1), the court may enter an ex parte order authorizing the installation and use of a pen register or a trap and trace device if the court finds, based on the certification by the attorney for the Government, that the information likely to be obtained by such installation and use is relevant to an ongoing criminal investigation. Such order shall apply to any entity providing wire or electronic communication service in the United States whose assistance is necessary to effectuate the order. ``(2) Requests from state investigative or law enforcement officers.--Upon an application made under section 3122(a)(2), the court may enter an ex parte order authorizing the installation and use of a pen register or a trap and trace device within the jurisdiction of the court, if the court finds, based on the certification by the State law enforcement or investigative officer, that the information likely to be obtained by such installation and use is relevant to an ongoing criminal investigation.''; and (2) in subsection (b)-- (A) in paragraph (1)-- (i) in subparagraph (C), by inserting ``authorized under subsection (a)(2)'' after ``in the case of a trap and trace device''; and (ii) in subparagraph (D), by striking ``and'' at the end; (B) in paragraph (2), by striking the period at the end and inserting ``; and''; and (C) by adding at the end the following: ``(3) shall direct that the use of the pen register or trap and trace device be conducted in such a way as to minimize the recording or decoding of any electronic or other impulses that are not related to the dialing and signaling information utilized in processing by the service provider upon whom the order is served.''. SEC. 8. TECHNICAL AMENDMENTS TO PEN REGISTER AND TRAP AND TRACE PROVISIONS. (a) Issuance of an Order.--Section 3123 of title 18, United States Code, is amended-- (1) by inserting ``or other facility'' after ``line'' each place that term appears; [[Page S2741]] (2) by inserting ``or applied'' after ``attached'' each place that term appears; (3) in subsection (b)(1)(C), by inserting ``or other identifier'' after ``the number''; and (4) in subsection (d)(2), by striking ``who has been ordered by the court'' and inserting ``who is obligated by the order''. (b) Definitions.--Section 3127 of title 18, United States Code is amended-- (1) by striking paragraph (3) and inserting the following: ``(3) the term `pen register'-- ``(A) means a device or process that records or decodes electronic or other impulses that identify the telephone numbers or electronic address dialed or otherwise transmitted by an instrument or facility from which a wire or electronic communication is transmitted and used for purposes of identifying the destination or termination of such communication by the service provider upon which the order is served; and ``(B) does not include any device or process used by a provider or customer of a wire or electronic communication service for billing, or recording as an incident to billing, for communications services provided by such provider or any device or process by a provider or customer of a wire communication service for cost accounting or other like purposes in the ordinary course of its business;''; and (2) in paragraph (4)-- (A) by inserting ``or process'' after ``means a device''; (B) by inserting ``or other identifier'' after ``number''; and (C) by striking ``or device'' and inserting ``or other facility''. SEC. 9. PEN REGISTER AND TRAP AND TRACE REPORTS. Section 3126 of title 18, United States Code, is amended by inserting before the period at the end the following: ``, which report shall include information concerning-- ``(1) the period of interceptions authorized by the order, and the number and duration of any extensions of the order; ``(2) the offense specified in the order or application, or extension of an order; ``(3) the number of investigations involved; ``(4) the number and nature of the facilities affected; and ``(5) the identity, including district, of the applying investigative or law enforcement agency making the application and the person authorizing the order''. SEC. 10. ENHANCED DENIAL OF SERVICE INVESTIGATIONS. Section 2511(2)(c) of title 18, United States Code, is amended to read as follows: ``(c)(i) It shall not be unlawful under this chapter for a person acting under color of law to intercept a wire, oral, or electronic communication, if such person is a party to the communication or 1 of the parties to the communication has given prior consent to such interception. ``(ii) It shall not be unlawful under this chapter for a person acting under color of law to intercept a wire or electronic communication, if-- ``(I) the transmission of the wire or electronic communication is causing harmful interference to a lawfully operating computer system; ``(II) any person who is not a provider of service to the public and who is authorized to use the facility from which the wire or electronic communication is to be intercepted has given prior consent to the interception; and ``(III) the interception is conducted only to the extent necessary to identify the source of the harmful interference described in subclause (I).''. SEC. 11. ENCRYPTION REPORTING REQUIREMENTS. Section 2519(2)(b) of title 18, United States Code, is amended by striking ``and (iv)'' and inserting ``(iv) the number of orders in which encryption was encountered and whether such encryption prevented law enforcement from obtaining the plain text of communications intercepted pursuant to such order, and (v)''. SEC. 12. STATE AND LOCAL COMPUTER CRIME ENFORCEMENT. (a) In General.--Subject to the availability of amounts provided in advance in appropriations Acts, the Assistant Attorney General for the Office of Justice Programs of the Department of Justice shall make a grant to each State, which shall be used by the State, in conjunction with units of local government, State and local courts, other States, or combinations thereof, to-- (1) assist State and local law enforcement in enforcing State and local criminal laws relating to computer crime; (2) assist State and local law enforcement in educating the public to prevent and identify computer crime; (3) assist in educating and training State and local law enforcement officers and prosecutors to conduct investigations and forensic analyses of evidence and prosecutions of computer crime; (4) assist State and local law enforcement officers and prosecutors in acquiring computer and other equipment to conduct investigations and forensic analysis of evidence of computer crimes; and (5) facilitate and promote the sharing of Federal law enforcement expertise and information about the investigation, analysis, and prosecution of computer crimes with State and local law enforcement officers and prosecutors, including the use of multijurisdictional task forces. (b) Use of Grant Amounts.--Grants under this section may be used to establish and develop programs to-- (1) assist State and local law enforcement agencies in enforcing State and local criminal laws relating to computer crime; (2) assist State and local law enforcement agencies in educating the public to prevent and identify computer crime; (3) educate and train State and local law enforcement officers and prosecutors to conduct investigations and forensic analyses of evidence and prosecutions of computer crime; (4) assist State and local law enforcement officers and prosecutors in acquiring computer and other equipment to conduct investigations and forensic analysis of evidence of computer crimes; and (5) facilitate and promote the sharing of Federal law enforcement expertise and information about the investigation, analysis, and prosecution of computer crimes with State and local law enforcement officers and prosecutors, including the use of multijurisdictional task forces. (c) Assurances.--To be eligible to receive a grant under this section, a State shall provide assurances to the Attorney General that the State-- (1) has in effect laws that penalize computer crime, such as penal laws prohibiting-- (A) fraudulent schemes executed by means of a computer system or network; (B) the unlawful damaging, destroying, altering, deleting, removing of computer software, or data contained in a computer, computer system, computer program, or computer network; or (C) the unlawful interference with the operation of or denial of access to a computer, computer program, computer system, or computer network; (2) an assessment of the State and local resource needs, including criminal justice resources being devoted to the investigation and enforcement of computer crime laws; and (3) a plan for coordinating the programs funded under this section with other federally funded technical assistant and training programs, including directly funded local programs such as the Local Law Enforcement Block Grant program (described under the heading ``Violent Crime Reduction Programs, State and Local Law Enforcement Assistance'' of the Departments of Commerce, Justice, and State, the Judiciary, and Related Agencies Appropriations Act, 1998 (Public Law 105-119)). (d) Matching Funds.--The Federal share of a grant received under this section may not exceed 90 percent of the total cost of a program or proposal funded under this section unless the Attorney General waives, wholly or in part, the requirements of this subsection. (e) Authorization of Appropriations.-- (1) In general.--There is authorized to be appropriated to carry out this section $25,000,000 for each of fiscal years 2000 through 2003. (2) Limitations.--Of the amount made available to carry out this section in any fiscal year not more than 3 percent may be used by the Attorney General for salaries and administrative expenses. (3) Minimum amount.--Unless all eligible applications submitted by any State or units of local government within a State for a grant under this section have been funded, the State, together with grantees within the State (other than Indian tribes), shall be allocated in each fiscal year under this section not less than 0.75 percent of the total amount appropriated in the fiscal year for grants pursuant to this section, except that the United States Virgin Islands, American Samoa, Guam, and the Northern Mariana Islands each shall be allocated 0.25 percent. (f) Grants to Indian Tribes.--Notwithstanding any other provision of this section, the Attorney General may use amounts made available under this section to make grants to Indian tribes for use in accordance with this section. ______