Title 6 — Domestic Security
Part C · Chapter 1 — Homeland Security Organization
§ 383. National Computer Forensics Institute
Statutory text
In general; mission
There is authorized for fiscal years 2023 through 2028 within the United States Secret Service a National Computer Forensics Institute (in this section referred to as the “Institute”). The Institute’s mission shall be to educate, train, and equip State, local, territorial, and Tribal law enforcement officers, prosecutors, and judges, as well as participants in the United States Secret Service’s network of cyber fraud task forces who are Federal employees, members of the uniformed services, or State, local, Tribal, or territorial employees, regarding the investigation and prevention of cybersecurity incidents, electronic crimes, and related cybersecurity threats, including through the dissemination of homeland security information, in accordance with relevant Federal law regarding privacy, civil rights, and civil liberties protections.
Curriculum
In furtherance of subsection (a), all education and training of the Institute shall be conducted in accordance with relevant Federal law regarding privacy, civil rights, and civil liberties protections. Education and training provided pursuant to subsection (a) shall relate to the following:
Investigating and preventing cybersecurity incidents, electronic crimes, and related cybersecurity threats, including relating to instances involving illicit use of digital assets and emerging trends in cybersecurity and electronic crime.
Conducting forensic examinations of computers, mobile devices, and other information systems.
Prosecutorial and judicial considerations related to cybersecurity incidents, electronic crimes, related cybersecurity threats, and forensic examinations of computers, mobile devices, and other information systems.
Methods to obtain, process, store, and admit digital evidence in court.
Principles
In carrying out the functions specified in subsection (b), the Institute shall ensure, to the extent practicable, that timely, actionable, and relevant expertise and information related to cybersecurity incidents, electronic crimes, and related cybersecurity threats is shared with recipients of education and training provided pursuant to subsection (a). When selecting participants for such training, the Institute shall prioritize, to the extent reasonable and practicable, providing education and training to individuals from geographically-diverse jurisdictions throughout the United States, and the Institute shall prioritize, to the extent reasonable and practicable, State, local, tribal, and territorial law enforcement officers, prosecutors, judges, and other employees.
Equipment
The Institute may provide recipients of education and training provided pursuant to subsection (a) with computer equipment, hardware, software, manuals, and tools for investigating and preventing cybersecurity incidents, electronic crimes, and related cybersecurity threats, and for forensic examinations of computers, mobile devices, and other information systems.
Cyber Fraud Task Forces
The Institute shall facilitate the expansion of the network of Cyber Fraud Task Forces of the United States Secret Service through the addition of recipients of education and training provided pursuant to subsection (a) educated and trained by the Institute.
Savings provision
All authorized activities and functions carried out by the Institute at any location as of the day before , are authorized to continue to be carried out at any such location on and after such date.
Expenses
The Director of the United States Secret Service may pay for all or a part of the education, training, or equipment provided by the Institute, including relating to the travel, transportation, and subsistence expenses of recipients of education and training provided pursuant to subsection (a).
Annual reports to Congress
In general
The Secretary shall include in the annual report required under section 1116 of title 31 information regarding the activities of the Institute, including, where possible, the following:
An identification of jurisdictions with recipients of the education and training provided pursuant to subsection (a) during such year.
Information relating to the costs associated with that education and training.
Any information regarding projected future demand for the education and training provided pursuant to subsection (a).
Impacts of the activities of the Institute on the capability of jurisdictions to investigate and prevent cybersecurity incidents, electronic crimes, and related cybersecurity threats.
A description of the nomination process for potential recipients of the information and training provided pursuant to subsection (a).
Any other issues determined relevant by the Secretary.
Exception
Any information required under paragraph (1) that is submitted as part of the annual budget submitted by the President to Congress under section 1105 of title 31 is not required to be included in the report required under paragraph (1).
Definitions
In this section:
Cybersecurity threat
The term “cybersecurity threat” has the meaning given such term in section 1501 of this title.
Incident
The term “incident” has the meaning given such term in section 659(a) 1 of this title.
Information system
The term “information system” has the meaning given such term in section 1501(9) of this title.
Footnotes
- 1 See References in Text note below.
Legislative history
Reconstructed from this section’s Code source credit and amendment notes, resolved against the local Statutes at Large. Editorial notes are evidence, not the law that made the change.
Homeland Security Act of 2002
Pub. L. 107–296 title VIII § 822 · 116 Stat. 2135
Enacted · 6 U.S.C. § 383
Pub. L. 107–296, title VIII, § 822, as added Pub. L. 115–76, § 2(a), Nov. 2, 2017, 131 Stat. 1246
Source evidence
Code source credit
Pub. L. 107–296, title VIII, § 822, as added Pub. L. 115–76, § 2(a), Nov. 2, 2017, 131 Stat. 1246James M. Inhofe National Defense Authorization Act for Fiscal Year 2023
Pub. L. 117–263 § 7123(1) · 136 Stat. 2395
Substituted · 6 U.S.C. § 383(a)
Pub. L. 117–263, § 7123(1), substituted, in heading, “In general; mission” for “In general”
Substituted · 6 U.S.C. § 383(a)
Pub. L. 117–263, § 7123(1), substituted, in heading, “2023 through 2028” for “2017 through 2022”
Substituted · 6 U.S.C. § 383(a)
Pub. L. 117–263, § 7123(1), substituted, in heading, “The Institute’s mission shall be to educate, train, and equip State, local, territorial, and Tribal law enforcement officers, prosecutors, and judges, as well as participants in the United States Secret Service’s network of cyber fraud task forces who are Federal employees, members of the uniformed services, or State, local, Tribal, or territorial employees, regarding the investigation and prevention of cybersecurity incidents, electronic crimes, and related cybersecurity threats, including through the dissemination of homeland security information, in accordance with relevant Federal law regarding privacy, civil rights, and civil liberties protections.” for “The Institute shall disseminate information related to the investigation and prevention of cyber and electronic crime and related threats, and educate, train, and equip State, local, tribal, and territorial law enforcement officers, prosecutors, and judges.”
Source evidence
Code amendment note
Subsec. (a). Pub. L. 117–263, § 7123(1), substituted, in heading, “In general; mission” for “In general”, in first sentence, “2023 through 2028” for “2017 through 2022”, and, in second sentence, “The Institute’s mission shall be to educate, train, and equip State, local, territorial, and Tribal law enforcement officers, prosecutors, and judges, as well as participants in the United States Secret Service’s network of cyber fraud task forces who are Federal employees, members of the uniformed services, or State, local, Tribal, or territorial employees, regarding the investigation and prevention of cybersecurity incidents, electronic crimes, and related cybersecurity threats, including through the dissemination of homeland security information, in accordance with relevant Federal law regarding privacy, civil rights, and civil liberties protections.” for “The Institute shall disseminate information related to the investigation and prevention of cyber and electronic crime and related threats, and educate, train, and equip State, local, tribal, and territorial law enforcement officers, prosecutors, and judges.”Enacted provision · exact public law section
(1) in subsection (a)— (A) in the subsection heading, by striking “In General” and inserting “In General; Mission”; (B) by striking “2017 through 2022” and inserting “2023 through 2028”; and (C) by striking the second sentence and inserting “The Institute’s mission shall be to educate, train, and equip State, local, territorial, and Tribal law enforcement officers, prosecutors, and judges, as well as participants in the United States Secret Service’s network of cyber fraud task forces who are Federal employees, members of the uniformed services, or State, local, Tribal, or territorial employees, regarding the investigation and prevention of cybersecurity incidents, electronic crimes, and related cybersecurity threats, including through the dissemination of homeland security information, in accordance with relevant Federal law regarding privacy, civil rights, and civil liberties protections.”;James M. Inhofe National Defense Authorization Act for Fiscal Year 2023
Pub. L. 117–263 § 7123(2) · 136 Stat. 2395
Amended · 6 U.S.C. § 383(b)
Pub. L. 117–263, § 7123(2), amended subsec. (b) generally. Prior to amendment, subsec. (b) related to the functions of the Institute
Source evidence
Code amendment note
Subsec. (b). Pub. L. 117–263, § 7123(2), amended subsec. (b) generally. Prior to amendment, subsec. (b) related to the functions of the Institute.Enacted provision · exact public law section
(2) by amending subsection (b) to read as follows: “(b) Curriculum.— In furtherance of subsection (a), all education and training of the Institute shall be conducted in accordance with relevant Federal law regarding privacy, civil rights, and civil liberties protections. Education and training provided pursuant to subsection (a) shall relate to the following: “(1) Investigating and preventing cybersecurity incidents, electronic crimes, and related cybersecurity threats, including relating to instances involving illicit use of digital assets and emerging trends in cybersecurity and electronic crime. “(2) Conducting forensic examinations of computers, mobile devices, and other information systems. “(3) Prosecutorial and judicial considerations related to cybersecurity incidents, electronic crimes, related cybersecurity threats, and forensic examinations of computers, mobile devices, and other information systems. “(4) Methods to obtain, process, store, and admit digital evidence in court.” .James M. Inhofe National Defense Authorization Act for Fiscal Year 2023
Pub. L. 117–263 § 7123(3) · 136 Stat. 2395
Substituted · 6 U.S.C. § 383(c)
Pub. L. 117–263, § 7123(3), substituted “cybersecurity incidents, electronic crimes, and related cybersecurity threats is shared with recipients of education and training provided pursuant to subsection (a)” for “cyber and electronic crime and related threats is shared with State, local, tribal, and territorial law enforcement officers and prosecutors”
Inserted · 6 U.S.C. § 383(c)
Pub. L. 117–263, § 7123(3), inserted at end “When selecting participants for such training, the Institute shall prioritize, to the extent reasonable and practicable, providing education and training to individuals from geographically-diverse jurisdictions throughout the United States, and the Institute shall prioritize, to the extent reasonable and practicable, State, local, tribal, and territorial law enforcement officers, prosecutors, judges, and other employees.”
Source evidence
Code amendment note
Subsec. (c). Pub. L. 117–263, § 7123(3), substituted “cybersecurity incidents, electronic crimes, and related cybersecurity threats is shared with recipients of education and training provided pursuant to subsection (a)” for “cyber and electronic crime and related threats is shared with State, local, tribal, and territorial law enforcement officers and prosecutors” and inserted at end “When selecting participants for such training, the Institute shall prioritize, to the extent reasonable and practicable, providing education and training to individuals from geographically-diverse jurisdictions throughout the United States, and the Institute shall prioritize, to the extent reasonable and practicable, State, local, tribal, and territorial law enforcement officers, prosecutors, judges, and other employees.”Enacted provision · exact public law section
(3) in subsection (c)— (A) by striking “cyber and electronic crime and related threats is shared with State, local, tribal, and territorial law enforcement officers and prosecutors” and inserting “cybersecurity incidents, electronic crimes, and related cybersecurity threats is shared with recipients of education and training provided pursuant to subsection (a)”; and (B) by adding at the end the following new sentence: “When selecting participants for such training, the Institute shall prioritize, to the extent reasonable and practicable, providing education and training to individuals from geographically-diverse jurisdictions throughout the United States, and the Institute shall prioritize, to the extent reasonable and practicable, State, local, tribal, and territorial law enforcement officers, prosecutors, judges, and other employees.”;James M. Inhofe National Defense Authorization Act for Fiscal Year 2023
Pub. L. 117–263 § 7123(4) · 136 Stat. 2395
Substituted · 6 U.S.C. § 383(d)
Pub. L. 117–263, § 7123(4), substituted “recipients of education and training provided pursuant to subsection (a)” for “State, local, tribal, and territorial law enforcement officers”
Substituted · 6 U.S.C. § 383(d)
Pub. L. 117–263, § 7123(4), substituted “for investigating and preventing cybersecurity incidents, electronic crimes, and related cybersecurity threats, and for forensic examinations of computers, mobile devices, and other information systems” for “necessary to conduct cyber and electronic crime and related threat investigations and computer and mobile device forensic examinations”
Source evidence
Code amendment note
Subsec. (d). Pub. L. 117–263, § 7123(4), substituted “recipients of education and training provided pursuant to subsection (a)” for “State, local, tribal, and territorial law enforcement officers” and “for investigating and preventing cybersecurity incidents, electronic crimes, and related cybersecurity threats, and for forensic examinations of computers, mobile devices, and other information systems” for “necessary to conduct cyber and electronic crime and related threat investigations and computer and mobile device forensic examinations”.Enacted provision · exact public law section
(4) in subsection (d)— (A) by striking “State, local, tribal, and territorial law enforcement officers” and inserting “recipients of education and training provided pursuant to subsection (a)”; and (B) by striking “necessary to conduct cyber and electronic crime and related threat investigations and computer and mobile device forensic examinations” and inserting “for investigating and preventing cybersecurity incidents, electronic crimes, and related cybersecurity threats, and for forensic examinations of computers, mobile devices, and other information systems”;James M. Inhofe National Defense Authorization Act for Fiscal Year 2023
Pub. L. 117–263 § 7123(5) · 136 Stat. 2395
Substituted · 6 U.S.C. § 383(e)
Pub. L. 117–263, § 7123(5), in heading, substituted “Cyber Fraud Task Forces” for “Electronic Crime Task Forces” and, in text
Substituted · 6 U.S.C. § 383(e)
Pub. L. 117–263, § 7123(5), in heading, substituted “Cyber Fraud” for “Electronic Crime”
Substituted · 6 U.S.C. § 383(e)
Pub. L. 117–263, § 7123(5), in heading, substituted “recipients of education and training provided pursuant to subsection (a)” for “State, local, tribal, and territorial law enforcement officers”
Substituted · 6 U.S.C. § 383(e)
Pub. L. 117–263, § 7123(5), in heading, substituted “by” for “at”
Source evidence
Code amendment note
Subsec. (e). Pub. L. 117–263, § 7123(5), in heading, substituted “Cyber Fraud Task Forces” for “Electronic Crime Task Forces” and, in text, substituted “Cyber Fraud” for “Electronic Crime”, “recipients of education and training provided pursuant to subsection (a)” for “State, local, tribal, and territorial law enforcement officers”, and “by” for “at”.Enacted provision · exact public law section
(5) in subsection (e)— (A) by amending the heading to read as follows: “Cyber Fraud Task Forces”; (B) by striking “Electronic Crime” and inserting “Cyber Fraud”; (C) by striking “State, local, tribal, and territorial law enforcement officers” and inserting “recipients of education and training provided pursuant to subsection (a)”; and (D) by striking “at” and inserting “by”; andJames M. Inhofe National Defense Authorization Act for Fiscal Year 2023
Pub. L. 117–263 § 7123(6) · 136 Stat. 2395
Added · 6 U.S.C. § 383(g)(i)
Pub. L. 117–263, § 7123(6), added subsecs. (g) to (i)
Source evidence
Code amendment note
Subsecs. (g) to (i). Pub. L. 117–263, § 7123(6), added subsecs. (g) to (i).Enacted provision · exact public law section
(6) by inserting after subsection (f) the following new subsections: “(g) Expenses.— The Director of the United States Secret Service may pay for all or a part of the education, training, or equipment provided by the Institute, including relating to the travel, transportation, and subsistence expenses of recipients of education and training provided pursuant to subsection (a). “(h) Annual Reports to Congress.— “(1) In general.— The Secretary shall include in the annual report required under section 1116 of title 31, United States Code, information regarding the activities of the Institute, including, where possible, the following: “(A) An identification of jurisdictions with recipients of the education and training provided pursuant to subsection (a) during such year. “(B) Information relating to the costs associated with that education and training. “(C) Any information regarding projected future demand for the education and training provided pursuant to subsection (a). “(D) Impacts of the activities of the Institute on the capability of jurisdictions to investigate and prevent cybersecurity incidents, electronic crimes, and related cybersecurity threats. “(E) A description of the nomination process for potential recipients of the information and training provided pursuant to subsection (a). “(F) Any other issues determined relevant by the Secretary. “(2) Exception.— Any information required under paragraph (1) that is submitted as part of the annual budget submitted by the President to Congress under section 1105 of title 31, United States Code, is not required to be included in the report required under paragraph (1). “(i) Definitions.— In this section: “(1) Cybersecurity threat.— The term ‘cybersecurity threat’ has the meaning given such term in section 102 of the Cybersecurity Act of 2015 (enacted as division N of the Consolidated Appropriations Act, 2016 (Public Law 114–113; 6 U.S.C. 1501)). “(2) Incident.— The term ‘incident’ has the meaning given such term in section 2209(a). “(3) Information system.— The term ‘information system’ has the meaning given such term in section 102 of the Cybersecurity Act of 2015 (enacted as division N of the Consolidated Appropriations Act, 2016 (Public Law 114–113; 6 U.S.C. 1501(9))).” .
13 of 14 references resolved to an enrolled provision · 1 partial
Editorial Notes
References in Text
Section 659(a) of this title, referred to in subsec. (i)(2), was amended by Pub. L. 117–263, § 7143(b)(2)(D)(i), and no longer defines the term “incident”. Reference to term “incident” as defined in this chapter deemed to be a reference to that term as defined in section 650(12) of this title, see section 7143(f)(2) of Pub. L. 117–263, set out as a Rule of Construction note under section 650 of this title.
Amendments
2022—Subsec. (a). Pub. L. 117–263, § 7123(1), substituted, in heading, “In general; mission” for “In general”, in first sentence, “2023 through 2028” for “2017 through 2022”, and, in second sentence, “The Institute’s mission shall be to educate, train, and equip State, local, territorial, and Tribal law enforcement officers, prosecutors, and judges, as well as participants in the United States Secret Service’s network of cyber fraud task forces who are Federal employees, members of the uniformed services, or State, local, Tribal, or territorial employees, regarding the investigation and prevention of cybersecurity incidents, electronic crimes, and related cybersecurity threats, including through the dissemination of homeland security information, in accordance with relevant Federal law regarding privacy, civil rights, and civil liberties protections.” for “The Institute shall disseminate information related to the investigation and prevention of cyber and electronic crime and related threats, and educate, train, and equip State, local, tribal, and territorial law enforcement officers, prosecutors, and judges.”
Subsec. (b). Pub. L. 117–263, § 7123(2), amended subsec. (b) generally. Prior to amendment, subsec. (b) related to the functions of the Institute.
Subsec. (c). Pub. L. 117–263, § 7123(3), substituted “cybersecurity incidents, electronic crimes, and related cybersecurity threats is shared with recipients of education and training provided pursuant to subsection (a)” for “cyber and electronic crime and related threats is shared with State, local, tribal, and territorial law enforcement officers and prosecutors” and inserted at end “When selecting participants for such training, the Institute shall prioritize, to the extent reasonable and practicable, providing education and training to individuals from geographically-diverse jurisdictions throughout the United States, and the Institute shall prioritize, to the extent reasonable and practicable, State, local, tribal, and territorial law enforcement officers, prosecutors, judges, and other employees.”
Subsec. (d). Pub. L. 117–263, § 7123(4), substituted “recipients of education and training provided pursuant to subsection (a)” for “State, local, tribal, and territorial law enforcement officers” and “for investigating and preventing cybersecurity incidents, electronic crimes, and related cybersecurity threats, and for forensic examinations of computers, mobile devices, and other information systems” for “necessary to conduct cyber and electronic crime and related threat investigations and computer and mobile device forensic examinations”.
Subsec. (e). Pub. L. 117–263, § 7123(5), in heading, substituted “Cyber Fraud Task Forces” for “Electronic Crime Task Forces” and, in text, substituted “Cyber Fraud” for “Electronic Crime”, “recipients of education and training provided pursuant to subsection (a)” for “State, local, tribal, and territorial law enforcement officers”, and “by” for “at”.
Subsecs. (g) to (i). Pub. L. 117–263, § 7123(6), added subsecs. (g) to (i).
Credits
2017–2022 · 2 acts
- 2017Pub. L. 107–296, title VIII, § 822, as added Pub. L. 115–76, § 2(a), , 131 Stat. 1246
- 2022amended Pub. L. 117–263, div. G, title LXXI, § 7123, , 136 Stat. 3641.
Show as published
(Pub. L. 107–296, title VIII, § 822, as added Pub. L. 115–76, § 2(a), , 131 Stat. 1246; amended Pub. L. 117–263, div. G, title LXXI, § 7123, , 136 Stat. 3641.)