,i  #aaeth ,,congress  #b;d ,session    
,h4 ,r4 #fgce  ,,in ,,the ,,house ,,of  
,,representatives  ,september #g1       
#bjah,mr4 ,mc,carthy 7for himself1 ,mr4 
,hurd1 ,mr4 ,langevin1 and ,mr4         
,ratcliffe7 introduced the following    
bill2 which was referred to the         
,committee on ,homeland ,security  ,a   
,,bill  ,to direct the ,secretary of    
,homeland ,security to establish a      
vulnerability disclosure policy for     
,department of ,homeland ,security      
internet websites1 and for other        
purposes4  #a4 ,department of ,homeland 
,security disclosure of security        
vulnerabilities  7a7 ,vulnerability     
disclosure policy ,the ,secretary of    
,homeland ,security shall establish a   
policy applicable to individuals1       
organizations1 and companies that report
 security vulnerabilities on ,department
 of ,homeland ,security public internet 
websites that shall include--  7#a7 the 
information technology to which the     
policy applies2  7#b7 the conditions    

under which parties may legally operate 
to discover and report security         
vulnerabilities2  7#c7 how individuals1 
organizations1 and companies should     
disclose discovered security            
vulnerabilities to the ,department2     
7#d7 the communication that parties that
 report security vulnerabilities should 
expect from the ,department2 and  7#e7  
how the ,department will disclose1 or   
how parties that report security        
vulnerabilities may disclose1 reported  
security vulnerabilities4  7b7          
,remediation process ,the ,secretary    
shall develop a process for the         
,department of ,homeland ,security to   
address how the ,department will        
mitigate or remediate security          
vulnerabilities reported through the    
policy developed in subsection 7a74  7c7
 ,consultation ,in developing the       
security vulnerability disclosure policy
 under subsection 7a71 the ,secretary   
shall consult with--  7#a7 the ,attorney
 ,general regarding how to ensure that  

individuals1 organizations1 and         
companies that comply with the          
requirements of the policy developed    
under subsection 7a7 are protected from 
prosecution under section #ajcj of title
 #ah1 ,united ,states ,code1 civil      
lawsuits1 and similar provisions of law 
with respect to specific activities     
authorized under the policy2  7#b7 the  
,secretary of ,defense and the          
,administrator of ,general ,services    
regarding lessons that may be applied   
from existing vulnerability disclosure  
programs2 and  7#c7 non-governmental    
security researchers4  7d7 ,public      
availability ,the ,secretary shall make 
the policy developed under subsection   
7a7 publicly available4  7e7 ,submission
 to ,congress  7#a7 ,not later than #ij 
days after the date of the enactment of 
this ,act1 the ,secretary shall submit  
to ,congress the policy required under  
subsection 7a7 and the remediation      
process required under subsection 7b74  
7#b7 ,not later than one year after     

creating the policy required under      
subsection 7a7 the ,secretary shall     
submit a report to ,congress1 and       
annually thereafter for each of the next
 three years1 the ,secretary shall brief
 ,congress with the following           
information with respect to the policy  
required under subsection 7a7 and the   
process required under subsection 7b73  
7,a7 the number of unique security      
vulnerabilities reported2  7,b7 the     
number of previously unknown security   
vulnerabilities mitigated or remediated2
  7,c7 the number of unique parties that
 reported security vulnerabilities2 and 
7,d7 the average length of time between 
the reporting of security               
vulnerabilities and mitigation or       
remediation of such vulnerabilities4    
7f7 ,definitions ,in this section-- 7#a7
 the term security vulnerability has the
 meaning given that term in section     
#aeja of title #f1 ,united ,states      
,code1 in information technology2 and   
7#b7 the term information system has the

 meaning given that term by section     
#cejb of title #dd1 ,united ,states     
,code4