,,ii #aafth ,,congress #ast ,session ,s4 #bgdi ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,october #cj1 #bjai,mr4 ,peters 7for himself1 ,mr4 ,johnson1 ,ms4 ,klobuchar1 and ,mr4 ,lankford7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to provide requirements for the 4gov domain1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,,dotgov ,online ,trust in ,government ,act of #bjai or the ,,dotgov ,act of #bjai4 #b4 ,findings ,congress finds that-- 7#a7 the 4gov internet domain reflects the work of ,united ,states innovators in inventing the internet and the role that the ,federal ,government played in guiding the development and success of the early internet2 7#b7 the 4gov internet domain is a unique resource of the ,united ,states that reflects the history of innovation and global leadership of the ,united ,states2 7#c7 when online public services and official communications from any level and branch of government use the 4gov domain1 they are easily recognized as official and difficult to impersonate2 7#d7 the citizens of the ,united ,states deserve online public services that are safe1 recognizable1 and trustworthy2 7#e7 the 4gov internet domain should be available to any ,federal1 ,state1 local1 or territorial government-operated or publicly controlled entity1 including any ,tribal government recognized by the ,federal ,government or a ,state government1 for use in their official services1 operations1 and communications2 7#f7 the 4gov internet domain provides a critical service to those ,federal1 ,state1 local1 ,tribal1 and territorial governments2 and 7#g7 the 4gov internet domain should be operated transparently and in the spirit of public accessibility1 privacy1 and security4 #c4 ,definitions ,in this ,act-- 7#a7 the term ,administrator means the ,administrator of ,general ,services2 7#b7 the term ,director means the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7#c7 the term online service means any internet-facing service1 including a website1 email1 a virtual private network1 or a custom application2 and 7#d7 the term ,state means any ,state of the ,united ,states1 the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 the ,virgin ,islands1 ,guam1 ,american ,samoa1 the ,commonwealth of the ,northern ,mariana ,islands1 and any possession of the ,united ,states4 #d4 ,duties of ,department of ,homeland ,security 7a7 ,purpose ,the purpose of the 4gov internet domain program is to-- 7#a7 legitimize and enhance public trust in government entities and their online services2 7#b7 facilitate trusted electronic communication and connections to and from government entities2 7#c7 provide simple and secure registration of 4gov internet domains2 7#d7 improve the security of the services hosted within these domains1 and of the 4gov namespace in general2 and 7#e7 enable the discoverability of government services to the public and to domain registrants4 7b7 ,duties and authorities relating to the 4gov domain 7#a7 ,in general ,subtitle ,a of title ,,xxii of the ,homeland ,security ,act 7#f ,u4,s4,c4 #fea et seq47 is amended-- 7,a7 in section #bbjb7;c7 7#f ,u4,s4,c4 #feb7;c77-- 7i7 in paragraph 7#aj71 by striking and at the end2 7ii7 by redesignating paragraph 7#aa7 as paragraph 7#ab72 and 7iii7 by inserting after paragraph 7#aj7 the following3 7#aa7 carry out the duties and authorities relating to the 4gov domain1 as described in section #bbae2 and 2 and 7,b7 by adding at the end the following3 #bbae4 ,duties and authorities relating to 4gov domain 7a7 ,availability of 4gov domain ,the ,director shall make 4gov domain name registration services1 as well as any supporting services described in subsection 7c71 generally available-- 7#a7 to any ,federal1 ,state1 local1 or territorial government entity1 or other publicly controlled entity1 including any ,tribal government recognized by the ,federal ,government or a ,state government1 that complies with the policies for registration developed by the ,director as described in subsection 7b72 7#b7 without conditioning registration on the sharing of any information with the ,director or any other ,federal entity1 other than the information required to meet the policies described in subsection 7b72 and 7#c7 without conditioning registration on participation in any separate service offered by the ,director or any other ,federal entity4 7b7 ,requirements ,the ,director1 in consultation with the ,director of the ,office of ,management and ,budget1 shall establish and publish on a publicly available website requirements for the registration and operation of 4gov domains sufficient to-- 7#a7 minimize the risk of 4gov domains whose names could mislead or confuse users2 7#b7 establish that 4gov domains may not be used for commercial or campaign purposes2 7#c7 ensure that domains are registered and maintained only by authorized individuals2 and 7#d7 limit the sharing or use of any information obtained through the administration of the 4gov domain with any other ,department of ,homeland ,security component or any other agency of the ,federal ,government for any purpose other than the administration of the 4gov domain1 the services described in subsection 7c71 and the requirements for establishing a 4gov inventory described in subsection 7f74 7c7 ,supporting services 7#a7 ,in general ,the ,director may provide services to the entities described in subsection 7a77#a7 specifically intended to support the security1 privacy1 reliability1 accessibility1 and speed of registered 4gov domains4 7#b7 ,rule of construction ,nothing in this paragraph 7#a7 shall be construed to-- 7,a7 limit other authorities of the ,director to provide services or technical assistance to an entity described in subsection 7a77#a72 or 7,b7 establish new authority for services other than those the purpose of which expressly supports the operation of 4gov domains and the needs of 4gov domain registrants4 7d7 ,fees ,the ,director may provide any service relating to the availability of the 4gov internet domain program1 including 4gov domain name registration services and supporting services described in subsection 7c71 to entities described in subsection 7a77#a7 with or without reimbursement4 7e7 ,consultation ,the ,director shall consult with the ,director of the ,office of ,management and ,budget1 the ,administrator of ,general ,services1 other civilian ,federal agencies as appropriate1 and entities representing ,state1 local1 ,tribal1 or territorial governments in developing the strategic direction of the 4gov domain and in developing the policies required under subsection 7b71 in particular on matters of privacy1 accessibility1 transparency1 and technology modernization4 7f7 4gov inventory 7#a7 ,in general ,the ,director shall1 on a continuous basis-- 7,a7 inventory all hostnames and services in active use within the 4gov domain2 and 7,b7 provide the data described in subparagraph 7,a7 to domain registrants at no cost4 7#b7 ,requirements ,in carrying out paragraph 7#a7-- 7,a7 data may be collected through analysis of public and non-public sources1 including commercial data sets2 7,b7 the ,director shall share with ,federal and non-,federal domain registrants all unique hostnames and services discovered within the zone of their registered domain2 7,c7 the ,director shall share any data or information collected or used in the management of the 4gov domain name registration services relating to ,federal executive branch registrants with the ,director of the ,office of ,management and ,budget for the purpose of fulfilling the duties of the ,director of the ,office of ,management and ,budget under section #ceec of title #dd1 ,united ,states ,code2 7,d7 the ,director shall publish on a publicly available website discovered hostnames that describe publicly accessible ,federal agency websites1 to the extent consistent with the security of ,federal information systems but with the presumption of disclosure2 7,e7 the ,director may publish on a publicly available website any analysis conducted and data collected relating to compliance with ,federal mandates and industry best practices1 to the extent consistent with the security of ,federal information systems but with the presumption of disclosure2 and 7,f7 the ,director shall-- 7i7 collect information on the use of non-4gov domain suffixes by ,federal agencies for their official online services2 7ii7 collect information on the use of non-4gov domain suffixes by ,state1 local1 ,tribal1 and territorial governments2 and 7iii7 publish the information collected under clause 7i7 on a publicly available website4 7#c7 ,strategy ,not later than #ahj days after the date of enactment of this ,act1 the ,director shall develop and submit to the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,rules and ,administration of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,house ,administration of the ,house of ,representatives a strategy to utilize the information collected under this subsection for countering malicious cyber activity4 4 7#b7 ,additional duties 7,a7 ,outreach strategy ,not later than #a year after the date of enactment of this ,act1 the ,director1 in consultation with the ,administrator and entities representing ,state1 local1 ,tribal1 or territorial governments1 shall develop and submit to the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,rules and ,administration of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,house ,administration of the ,house of ,representatives an outreach strategy to local1 ,tribal1 and territorial governments and other publicly controlled entities as determined by the ,director to inform and support migration to the 4gov domain1 which shall include-- 7i7 stakeholder engagement plans2 and 7ii7 information on how migrating information technology systems to the 4gov domain is beneficial to that entity1 including benefits relating to cybersecurity and the supporting services offered by the ,federal ,government4 7,b7 ,reference guide ,not later than #a year after the date of enactment of this ,act1 the ,director1 in consultation with the ,administrator and entities representing ,state1 local1 ,tribal1 or territorial governments1 shall develop and publish on a publicly available website a reference guide for migrating online services to the 4gov domain1 which shall include-- 7i7 process and technical information on how to carry out a migration of common categories of online services1 such as web and email services2 7ii7 best practices for cybersecurity pertaining to registration and operation of a 4gov domain2 and 7iii7 references to contract vehicles and other private sector resources vetted by the ,director that may assist in performing the migration4 7,c7 ,security enhancement plan ,not later than #a year after the date of enactment of this ,act1 the ,director shall develop and submit to the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,rules and ,administration of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,house ,administration of the ,house of ,representatives a 4gov domain security enhancement strategy and implementation plan on how to improve the cybersecurity benefits of the 4gov domain during the #e-year period following the date of enactment of this ,act1 which shall include-- 7i7 a modernization plan for the information systems that support operation of the 4gov top-level domain1 such as the registrar portal1 and how these information systems will remain current with evolving security trends2 7ii7 a modernization plan for the structure of the 4gov program and any supporting contracts1 and how the program and contracts can remain flexible over time so as to take advantage of emerging technology and cybersecurity developments2 and 7iii7 an outline of specific security enhancements the 4gov program intends to provide to users during that #e-year period4 7#c7 ,technical and conforming amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7,public ,law #ajg-aif2 #aaf ,stat4 #bace7 is amended by inserting after the item relating to section #bbad the following3 ,sec4 #bbae4 ,duties and authorities relating to 4gov domain4 4 7c7 ,homeland security grants ,section #bjjh7;a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fji7;a77 is amended-- 7#a7 in paragraph 7#ac71 by striking and at the end2 7#b7 by redesignating paragraph 7#ad7 as paragraph 7#ae72 and 7#c7 by inserting after paragraph 7#ac7 the following3 7#ad7 migrating any online service 7as defined in section #c of the ,,dotgov ,online ,trust in ,government ,act of #bjai7 to the 4gov domain2 and 4 #e4 ,report ,not later than #a year after the date of enactment of this ,act1 and every #b years thereafter for #d years1 the ,director shall submit a report to or conduct a detailed briefing for the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,rules and ,administration of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,house ,administration of the ,house of ,representatives on the status of-- 7#a7 the outreach strategy described in section #d7;b77#b77;,a72 7#b7 the security enhancement strategy and implementation plan described in section #d7;b77#b77;,c72 7#c7 the inventory described in #bbae7;f7 of the ,homeland ,security ,act of #bjjb1 as added by section #d7;b7 of this ,act2 and 7#d7 the supporting services described in section #bbae7;c77#a7 of the ,homeland ,security ,act of #bjjb1 as added by section #d7;b7 of this ,act4 #f4 ,transition 7a7 ,there shall be transferred to the ,director the 4gov internet domain program1 as operated by the ,general ,services ,administration under title #da1 ,code of ,federal ,regulations1 on the date of enactment of this ,act4 7b7 ,not later than #cj days after the date of enactment of this ,act1 the ,director shall submit a plan for the operational and contractual transition of the 4gov internet domain program to the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,rules and ,administration of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,house ,administration of the ,house of ,representatives4 7c7 ,not later than #abj days after the date of enactment of this ,act1 the ,director shall begin operationally administering the 4gov internet domain program1 and shall publish on a publicly available website the requirements for domain registrants as described in section #bbae7;b7 of the ,homeland ,security ,act of #bjjb1 as added by section #d7;b7 of this ,act4 7d7 ,on the date of publication for the requirements in subsection 7c71 the ,administrator shall rescind the requirements in part #ajb-agc of title #da1 ,code of ,federal ,regulations4