,,ii #aaeth ,,congress #ast ,session ,s4 #bbfa ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,december #ba1 #bjag ,mr4 ,lankford 7for himself1 ,ms4 ,klobuchar1 ,mr4 ,graham1 ,ms4 ,harris1 ,ms4 ,collins1 and ,mr4 ,heinrich7 introduced the following bill2 which was read twice and referred to the ,committee on ,rules and ,administration ,a ,,bill ,to protect the administration of ,federal elections against cybersecurity threats4 #a4 ,short title ,this ,act may be cited as the ,secure ,elections ,act4 #b4 ,sense of ,congress ,it is the sense of ,congress that-- 7#a7 under the ,constitution of the ,united ,states1 the ,states conduct elections1 and ,congress recognizes the importance of maintaining ,state leadership in election administration2 7#b7 free and fair elections are central to our democracy2 7#c7 protecting our elections is a national security priority2 and 7#d7 an attack on our election systems by a foreign power is a hostile act and should be met with appropriate retaliatory actions1 including immediate and severe sanctions4 #c4 ,definitions ,in this ,act3 7#a7 ,advisory panel ,the term ,advisory ,panel means the advisory panel of independent experts on election cybersecurity established under section #e7;a77#a74 7#b7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,rules and ,administration1 the ,committee on ,armed ,services1 the ,committee on ,homeland ,security and ,governmental ,affairs1 the ,committee on ,appropriations1 the ,select ,committee on ,intelligence1 the majority leader1 and the minority leader of the ,senate2 and 7,b7 the ,committee on ,house ,administration1 the ,committee on ,armed ,services1 the ,committee on ,homeland ,security1 the ,committee on ,appropriations1 the ,permanent ,select ,committee on ,intelligence1 the ,speaker1 and the minority leader of the ,house of ,representatives4 7#c7 ,appropriate ,federal entities ,the term appropriate ,federal entities means-- 7,a7 the ,department of ,commerce1 including the ,national ,institute of ,standards and ,technology2 7,b7 the ,department of ,defense2 7,c7 the ,department1 including the component of the ,department that reports to the ,under ,secretary responsible for overseeing critical infrastructure protection1 cybersecurity1 and other related programs of the ,department2 7,d7 the ,department of ,justice1 including the ,federal ,bureau of ,investigation2 7,e7 the ,commission2 and 7,f7 the ,office of the ,director of ,national ,intelligence1 the ,national ,security ,agency1 and such other elements of the intelligence community 7as defined in section #c of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc77 as the ,director of ,national ,intelligence determines are appropriate4 7#d7 ,chairman ,the term ,chairman means the ,chairman of the ,election ,assistance ,commission4 7#e7 ,commission ,the term ,commission means the ,election ,assistance ,commission4 7#f7 ,department ,the term ,department means the ,department of ,homeland ,security4 7#g7 ,election agency ,the term election agency means any component of a ,state or any component of a county1 municipality1 or other subdivision of a ,state that is responsible for administering ,federal elections4 7#h7 ,election cybersecurity incident ,the term election cybersecurity incident means any information security incident involving an election system4 7#i7 ,election cybersecurity threat ,the term election cybersecurity threat means any cybersecurity threat 7as defined in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja77 to an election system4 7#aj7 ,election cybersecurity vulnerability ,the term election cybersecurity vulnerability means any security vulnerability 7as defined in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja77 that affects an election system4 7#aa7 ,election service provider ,the term election service provider means any person providing1 supporting1 or maintaining an election system on behalf of an election agency1 such as a contractor or vendor4 7#ab7 ,election system ,the term election system means any information system 7as defined in section #cejb of title #dd1 ,united ,states ,code7 used for the management1 support1 or administration of a ,federal election1 such as a voting system1 a voter registration website or database1 an electronic pollbook1 a system for tabulating or reporting election results1 or an election agency email system4 7#ac7 ,federal election ,the term ,federal election means any election 7as defined in section #cja7a7 of the ,federal ,election ,campaign ,act of #aiga 7#eb ,u4,s4,c4 #cjaja7a77 for ,federal office 7as defined in section #cja7c7 of the ,federal ,election ,campaign ,act of #aiga 7#eb ,u4,s4,c4 #cjaja7c774 7#ad7 ,federal entity ,the term ,federal entity means any agency 7as defined in section #eea of title #e1 ,united ,states ,code74 7#ae7 ,incident ,the term incident has the meaning given the term in section #ceeb of title #dd1 ,united ,states ,code4 7#af7 ,information security ,the term information security has the meaning given the term in section #ceeb of title #dd1 ,united ,states ,code4 7#ag7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security1 or1 upon designation by the ,secretary of ,homeland ,security1 the ,deputy ,secretary of ,homeland ,security1 the ,under ,secretary responsible for overseeing critical infrastructure protection1 cybersecurity1 and other related programs of the ,department1 or a ,senate-confirmed official that reports to that ,under ,secretary4 7#ah7 ,state ,the term ,state means each of the several ,states of the ,united ,states1 the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 ,guam1 ,american ,samoa1 the ,commonwealth of ,northern ,mariana ,islands1 and the ,united ,states ,virgin ,islands4 7#ai7 ,state election official ,the term ,state election official means-- 7,a7 the chief ,state election official of a ,state designated under section #aj of the ,national ,voter ,registration ,act of #aiic 7#eb ,u4,s4,c4 #bjeji72 or 7,b7 in the ,commonwealth of ,puerto ,rico1 ,guam1 ,american ,samoa1 the ,commonwealth of ,northern ,mariana ,islands1 and the ,united ,states ,virgin ,islands1 a chief ,state election official designated by the ,state for purposes of this ,act4 7#bj7 ,state law enforcement officer ,the term ,state law enforcement officer means the head of a ,state law enforcement agency1 such as an attorney general4 7#ba7 ,voting system ,the term voting system has the meaning given the term in section #cja7;b7 of the ,help ,america ,vote ,act of #bjjb 7#eb ,u4,s4,c4 #bajha7;b774 #d4 ,information sharing 7a7 ,designation of responsible ,federal entity ,the ,secretary shall have primary responsibility within the ,federal ,government for sharing information about election cybersecurity incidents1 threats1 and vulnerabilities with ,federal entities and with election agencies4 7b7 ,presumption of ,federal information sharing to the department ,if a ,federal entity receives information about an election cybersecurity incident1 threat1 or vulnerability1 the ,federal entity shall promptly share that information with the ,department1 unless the head of the entity 7or a ,senate-confirmed official designated by the head7 makes a specific determination in writing that there is good cause to withhold the particular information4 7c7 ,presumption of ,federal and ,state information sharing from the department ,if the ,department receives information about an election cybersecurity incident1 threat1 or vulnerability1 unless the ,secretary makes a specific determination in writing that there is good cause to withhold the particular information1 the ,department shall promptly share that information with-- 7#a7 the appropriate ,federal entities2 7#b7 all ,state election agencies2 7#c7 all election agencies that have requested ongoing updates on election cybersecurity incidents1 threats1 or vulnerabilities2 and 7#d7 all election agencies that may be affected by the risks associated with the particular election cybersecurity incident1 threat1 or vulnerability4 7d7 ,technical resources for election agencies ,in sharing information about election cybersecurity incidents1 threats1 and vulnerabilities with election agencies under this section1 the ,department shall1 to the extent possible-- 7#a7 provide cyber threat indicators and defensive measures 7as such terms are defined in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja771 such as recommended technical instructions1 that assist with protecting against and detecting associated risks2 7#b7 identify resources available for protecting against1 detecting1 responding to1 and recovering from associated risks1 including technical capabilities of the ,department2 and 7#c7 provide guidance about further sharing of the information4 7e7 ,declassification review ,if the ,department receives classified information about an election cybersecurity incident1 threat1 or vulnerability-- 7#a7 the ,secretary shall promptly submit a request for expedited declassification review to the head of a ,federal entity with authority to conduct the review1 consistent with ,executive ,order #acebf or any successor order2 and 7#b7 the head of the ,federal entity described in paragraph 7#a7 shall promptly conduct the review4 7f7 ,role of non-,federal entities ,the ,department may share information about election cybersecurity incidents1 threats1 and vulnerabilities through a non-,federal entity1 such as the ,multi-,state ,information ,sharing and ,analysis ,center4 7g7 ,protection of personal and confidential information ,if a ,federal entity shares information about an election cybersecurity incident1 threat1 or vulnerability1 the ,federal entity shall-- 7#a7 minimize the acquisition1 retention1 use1 and disclosure of personal information of voters1 except as necessary to identify1 protect against1 detect1 respond to1 or recover from election cybersecurity incidents1 threats1 and vulnerabilities2 and 7#b7 take reasonable steps to protect confidential ,federal and ,state information from unauthorized disclosure4 7h7 ,duty ,to assess possible cybersecurity incidents 7#a7 ,election agencies ,if an election agency becomes aware of the possibility of an election cybersecurity incident1 the election agency shall promptly assess whether an election cybersecurity incident occurred and notify the ,state election official4 7#b7 ,election service providers ,if an election service provider becomes aware of the possibility of an election cybersecurity incident1 the election service provider shall promptly assess whether an election cybersecurity incident occurred and notify the relevant election agencies consistent with subsection 7j74 7i7 ,information sharing about cybersecurity incidents by election agencies ,if an election agency has reason to believe that an election cybersecurity incident has occurred with respect to an election system owned1 operated1 or maintained by or on behalf of the election agency1 the election agency shall1 in the most expedient time possible and without unreasonable delay 7in no event longer than #c calendar days after discovery of the incident71 provide notification of the election cybersecurity incident to the ,secretary4 7j7 ,information sharing about cybersecurity incidents by election service providers ,if an election service provider has reason to believe that an election cybersecurity incident may have occurred1 or that an information security incident related to the role of the provider as an election service provider may have occurred1 the election service provider shall-- 7#a7 notify the relevant election agencies in the most expedient time possible and without unreasonable delay 7in no event longer than #c calendar days after discovery of the possible incident72 and 7#b7 cooperate with the election agencies in providing the notifications required under subsections 7h77#a7 and 7i74 7k7 ,content of notification by election agencies ,the notifications required under subsections 7h77#a7 and 7i7-- 7#a7 shall include an initial assessment of-- 7,a7 the date and duration of the election cybersecurity incident2 7,b7 the circumstances of the election cybersecurity incident1 including the specific election systems believed to have been accessed and information acquired2 and 7,c7 planned and implemented technical measures to respond to and recover from the incident2 and 7#b7 shall be updated with additional material information1 including technical data1 as it becomes available4 7l7 ,security clearance ,not later than #cj days after the date of enactment of this ,act1 the ,secretary-- 7#a7 shall establish an expedited process for providing appropriate security clearance to ,state election officials and designated technical personnel employed by ,state election agencies2 7#b7 shall establish an expedited process for providing appropriate security clearance to members of the ,commission and designated technical personnel employed by the ,commission2 and 7#c7 shall establish a process for providing appropriate security clearance to personnel at other election agencies4 7m7 ,catalog of cybersecurity services ,the ,secretary-- 7#a7 shall make publicly available1 including on the public website of the ,department1 a catalog of cybersecurity services that the appropriate ,federal agencies can provide to election agencies and a point of contact for each service2 and 7#b7 may create a classified annex to the catalog and make it available only to election agency personnel with appropriate security clearance4 7n7 ,protection from liability ,nothing in this ,act may be construed to provide a cause of action against a ,state1 unit of local government1 or an election service provider4 7o7 ,assessment of inter-,state information sharing about election cybersecurity 7#a7 ,in general ,the ,secretary and the ,chairman1 in coordination with the heads of the appropriate ,federal entities and appropriate officials of ,state and local governments1 shall conduct an assessment of-- 7,a7 the structure and functioning of the ,multi-,state ,information ,sharing and ,analysis ,center for purposes of election cybersecurity2 and 7,b7 other mechanisms for inter-state information sharing about election cybersecurity4 7#b7 ,comment from election agencies ,in carrying out the assessment required under paragraph 7#a71 the ,secretary and the ,chairman shall solicit and consider comments from all ,state election agencies4 7#c7 ,distribution ,the ,secretary and the ,chairman shall jointly issue the assessment required under paragraph 7#a7 to-- 7,a7 all election agencies known to the ,department and the ,commission2 and 7,b7 the appropriate congressional committees4 7p7 ,congressional notification 7#a7 ,in general ,if an appropriate ,federal entity has reason to believe that a significant election cybersecurity incident has occurred1 the entity shall-- 7,a7 not later than #g calendar days after the date on which there is a reasonable basis to conclude that the significant incident has occurred1 provide notification of the incident to-- 7i7 the appropriate congressional committees2 7ii7 the members of the ,senate representing the ,states affected by the incident2 and 7iii7 the members of the ,house of ,representatives representing the congressional districts affected by the incident2 and 7,b7 update the initial notification under paragraph 7#a7 within a reasonable period of time after additional information relating to the incident is discovered4 7#b7 ,reporting threshold ,the ,secretary shall-- 7,a7 promulgate a uniform definition of a significant election cybersecurity incident2 and 7,b7 shall submit the definition promulgated under subparagraph 7,a7 to the appropriate congressional committees4 #e4 ,advisory panel and guidelines 7a7 ,advisory ,panel 7#a7 ,in general ,the ,secretary shall establish an advisory panel of independent experts on election cybersecurity4 7#b7 ,membership ,the ,advisory ,panel shall consist of not less than #i members1 of whom-- 7,a7 #e shall be appointed by the ,secretary1 in consultation with the ,chairman and the ,director of the ,national ,institute of ,standards and ,technology1 of whom #a shall be designated as the ,chairperson of the ,advisory ,panel2 7,b7 #a shall be appointed by the ,national ,association of ,secretaries of ,state2 7,c7 #a shall be appointed by the ,national ,association of ,state ,election ,directors2 7,d7 #a shall be appointed by the ,national ,association of ,counties2 and 7,e7 #a shall be appointed by the ,national ,league of ,cities4 7#c7 ,eligibility ,individuals appointed to the ,advisory ,panel established under paragraph 7#a7-- 7,a7 may not be officers or employees of the ,united ,states2 7,b7 if appointed under paragraph 7#b77;,a71 shall possess expertise in cybersecurity2 and 7,c7 if appointed under any other subparagraph of paragraph 7#b71 shall possess expertise in cybersecurity1 election law1 or election administration4 7#d7 ,terms2 vacancies ,members of the ,advisory ,panel shall serve for a term set by the ,secretary4 ,any vacancy in the ,advisory ,panel shall be filled in the same manner as the original appointment4 7#e7 ,compensation ,members of the ,advisory ,panel shall serve on the ,advisory ,panel without compensation1 except that members of the ,advisory ,panel may be allowed travel expenses1 including per diem in lieu of subsistence1 at rates authorized for employees of agencies under subchapter ,i of chapter #eg of title #e1 ,united ,states ,code1 while away from their homes or regular places of business in the performance of services for the ,advisory ,panel4 7#f7 ,administrative staff ,upon request of the ,advisory ,panel1 the ,secretary shall provide to the ,advisory ,panel1 on a reimbursable basis1 the administrative support services necessary for the ,advisory ,panel to carry out its responsibilities under this ,act4 7b7 ,guidelines 7#a7 ,in general ,the ,advisory ,panel shall develop a set of guidelines for election cybersecurity1 including standards for procuring1 maintaining1 testing1 auditing1 operating1 and updating election systems4 7#b7 ,requirements ,in developing the guidelines1 the ,advisory ,panel shall-- 7,a7 identify the top risks to election systems2 7,b7 describe how specific technology choices can increase or decrease those risks2 and 7,c7 provide recommended policies1 best practices1 and overall security strategies for identifying1 protecting against1 detecting1 responding to1 and recovering from the risks identified under subparagraph 7,a74 7c7 ,grant program ,the ,advisory ,panel shall assist the ,department and the ,commission in carrying out the grant program required under section #g by-- 7#a7 submitting recommendations to the ,department about the grant program application process2 7#b7 submitting recommendations1 including recommended criteria1 to the ,department for the grant program review process2 7#c7 submitting recommendations1 including recommended criteria1 to the ,department for use of remaining grant funds2 7#d7 submitting recommendations1 including recommended criteria1 to the ,department for the interim grant program for non-paper equipment replacement2 and 7#e7 providing any other assistance that the ,department or the ,commission requests4 7d7 ,paper ballots and statistical audits ,the guidelines developed under subsection 7b7 shall include provisions regarding paper ballots and statistical audits for ,federal elections1 including that-- 7#a7 each vote is made by a paper ballot 7marked by hand or device71 and the voter has an opportunity to inspect and confirm the marked paper ballot before casting it 7consistent with accessibility accommodations72 and 7#b7 each election result is determined by tabulating marked paper ballots 7by hand or device71 and prior to certification by a ,state of the election result1 election agencies within the ,state inspect 7by hand and not by device7 a random sample of the marked paper ballots and thereby establish high statistical confidence in the election result4 7e7 ,issues considered 7#a7 ,in general ,in developing the guidelines required under subsection 7b71 the ,advisory ,panel shall consider-- 7,a7 applying established cybersecurity best practices to ,federal election administration by ,states and local governments1 including appropriate technologies1 procedures1 and personnel for identifying1 protecting against1 detecting1 responding to1 and recovering from cybersecurity events2 7,b7 mechanisms to verify that election systems accurately tabulate ballots1 report results1 and identify a winner for each election for ,federal office1 even if computer hardware or software malfunctions due to error or an election cybersecurity incident2 7,c7 specific types of election audits1 including procedures and shortcomings for such audits2 7,d7 durational requirements needed to facilitate election audits prior to election certification1 including variations in the acceptance of postal ballots1 time allowed to cure provisional ballots1 and election certification deadlines2 7,e7 providing actionable guidance to election agencies that have not applied for or received grant funds under section #g1 and to agencies that seek to implement additional cybersecurity protections2 7,f7 how the guidelines could assist other components of ,state and local governments2 and 7,g7 any other factors that the ,advisory ,panel determines to be relevant4 7#b7 ,relationship to ,voluntary ,voting ,guidelines and ,national ,institute of ,standards and ,technology ,cybersecurity guidance ,in developing the guidelines required under subsection 7b71 the ,advisory ,panel shall consider-- 7,a7 the ,voluntary ,voting ,guidelines developed by the ,commission2 and 7,b7 cybersecurity standards and best practices developed by the ,national ,institute of ,standards and ,technology1 including frameworks1 consistent with section #b7;c7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgb7;c774 7f7 ,public comment ,the ,advisory ,panel shall-- 7#a7 provide a reasonable opportunity for public comment1 including through ,department publication in the ,federal ,register1 on the guidelines required under subsection 7b71 including a #de-;day opportunity for public comment on a draft of the guidelines before they are submitted under subsection 7i71 which shall1 to the extent practicable1 occur concurrently with the other activities of the ,advisory ,panel under this section2 and 7#b7 consider the public comments in developing the guidelines4 7g7 ,consultation ,in developing the guidelines required under subsection 7b71 the ,advisory ,panel shall consult with-- 7#a7 the appropriate ,federal entities2 7#b7 the ,standards ,board1 ,board of ,advisors1 and ,technical ,guidelines ,development ,committee of the ,commission2 7#c7 the ,federal ,communications ,commission2 7#d7 the ,federal ,trade ,commission2 7#e7 the ,national ,governors ,association2 7#f7 the ,national ,association of ,secretaries of ,state2 7#g7 the ,national ,association of ,state ,election ,directors2 7#h7 the ,national ,association of ,election ,officials2 7#i7 the ,national ,association of ,counties2 7#aj7 the ,national ,league of ,cities2 7#aa7 the ,international ,association of ,government ,officials2 7#ab7 the ,multi-,state ,information ,sharing and ,analysis ,center2 7#ac7 the ,national ,science ,foundation2 and 7#ad7 any other interested entities that the ,advisory ,panel determines are necessary to the development of the guidelines4 7h7 ,submission to secretary ,not later than #ahj days after the date of enactment of this ,act1 the ,advisory ,panel shall submit the guidelines required under subsection 7b7 to the ,secretary4 7i7 ,submission to congress2 modification ,not later than #ad calendar days after the date on which the ,secretary receives guidelines under subsection 7h7 or 7l71 the ,secretary shall submit the guidelines to the appropriate congressional committees4 ,the ,secretary may modify the guidelines in advance of submission to ,congress if-- 7#a7 the ,secretary determines that there is good cause to modify the guidelines1 consistent with the considerations established in subsection 7e7 and notwithstanding the recommendation of the ,advisory ,panel2 and 7#b7 the ,secretary submits a written justification of the modification to the ,advisory ,panel and the appropriate congressional committees4 7j7 ,distribution to election agencies ,the ,secretary shall distribute the guidelines required under subsection 7b7 to all election agencies known to the ,department and the ,commission4 7k7 ,publication ,the ,secretary shall make the guidelines required under subsection 7b7 available on the public website of the ,department4 7l7 ,periodic review ,not later than ,january #ca1 #bjai1 and once every #b years thereafter1 the ,advisory ,panel shall review and update the guidelines required under subsection 7b74 7m7 ,rule of construction ,nothing in the section shall be construed to subject the process for developing the guidelines required under subsection 7b7 to subchapter ,,ii of chapter #e1 and chapter #g1 of title #e1 ,united ,states ,code 7commonly known as the ,administrative ,procedure ,act74 #f4 ,reports to ,congress 7a7 ,reports on foreign threats to elections 7#a7 ,in general ,not later than #cj days after the date of enactment of this ,act1 and #cj days after the end of each fiscal year thereafter1 the ,secretary and the ,director of ,national ,intelligence1 in coordination with the heads of the appropriate ,federal entities1 shall submit a joint report to the appropriate congressional committees on foreign threats to elections in the ,united ,states1 including physical and cybersecurity threats4 7#b7 ,voluntary participation by ,states ,the ,secretary shall solicit and consider comments from all ,state election agencies4 ,participation by an election agency in the report under this subsection shall be voluntary and at the discretion of the ,state4 7b7 ,reports on grant program ,not later than #b years after the date of enactment of this ,act1 and every #d years thereafter1 the ,comptroller ,general of the ,united ,states shall submit a report to the appropriate congressional committees on the ,department grant program established under section #g1 including how grant funds have been distributed and used to implement the guidelines required under section #e7;b74 #g4 ,state election system cybersecurity and modernization grants 7a7 ,authority 7#a7 ,in general ,the ,secretary1 acting through the component of the ,department that reports to the ,under ,secretary responsible for overseeing critical infrastructure protection1 cybersecurity1 and other related programs of the ,department1 shall award grants to ,states in accordance with this section4 7#b7 ,coordination 7,a7 ,in general ,the ,secretary shall coordinate with the ,commission in carrying out this section4 7,b7 ,joint program ,if the ,secretary determines that jointly carrying out this section with the ,commission would increase ,state participation and cybersecurity preparedness1 the ,secretary shall-- 7i7 submit notice of the determination to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives2 and 7ii7 enter into a ,memorandum of ,understanding with the ,commission to carry out the grant program4 7b7 ,application process 7#a7 ,in general ,the ,secretary shall-- 7,a7 establish a process for ,states to apply for election system cybersecurity and modernization grants2 7,b7 in establishing the application process1 consider the recommendations of the ,advisory ,panel under section #e7;c72 and 7,c7 ensure that the application process requires that a ,state seeking a grant provide a detailed explanation of how election agencies within the ,state will implement the guidelines established under section #e7;b74 7#b7 ,review ,the ,secretary-- 7,a7 shall fund a ,state application if the ,secretary determines that-- 7i7 the election agencies within the ,state will likely implement the guidelines established under section #e7;b72 7ii7 with respect to the guidelines related to statistical audits1 consistent with section #e7;d71 the ,state will complete a statewide pilot program during a biennial ,federal general election not later than #bjbb2 and 7iii7 the ,state will match at least ten percent of the total grant allocation for election cybersecurity improvements2 and 7,b7 in reviewing a ,state application1 shall consider the recommendations and criteria of the ,advisory ,panel under section #e7;c74 7#c7 ,state implementation 7,a7 ,in general ,a ,state receiving a grant under this section may adopt any reasonable implementation of the guidelines established under section #e7;b74 7,b7 ,inconsistency with ,state law ,if implementation of the guidelines would be inconsistent with ,state law1 the ,state-- 7i7 shall identify in the application of the ,state the legal issue and the guidelines that the ,state cannot implement2 7ii7 shall specify in the application of the ,state the amount of grant funds that the ,state would spend implementing those guidelines if the law were not inconsistent2 and 7iii7 shall not spend the amount of grant funds specified under clause 7ii7 until the legal issue is resolved4 7#d7 ,protection of personal information ,the application process established under this subsection shall not require a ,state to disclose the personal information of any voter4 7c7 ,use of funds 7#a7 ,in general ,except as provided in paragraph 7#b71 a ,state receiving a grant under this section shall use the funds received under the grant to implement the guidelines established under section #e7;b74 7#b7 ,remaining funds ,a ,state may use funds from a grant under this section to improve1 upgrade1 or acquire hardware1 software1 or services related to election administration1 consistent with the guidelines established under section #e7;b71 if-- 7,a7 the ,state election official submits a written certification to the ,secretary that the election agencies within the ,state have implemented the guidelines established under section #e7;b72 and 7,b7 the ,secretary1 after consideration of the recommendations and criteria of the ,advisory ,panel under section #e7;c71 approves the use of funds4 7#c7 ,prohibition on use for certain voting systems ,funds received under a grant under this section may not be used for any voting system that records each vote in electronic storage unless the system is an optical scanner that reads paper ballots4 7d7 ,contracting assistance ,not later than #ij days after the date of enactment of this ,act1 the ,administrator of ,general ,services1 in consultation with the ,director of the ,national ,institute of ,standards and ,technology1 shall take such actions as may be necessary through competitive processes-- 7#a7 to qualify a set of private sector entities that are capable of assisting the ,states with identifying1 protecting against1 detecting1 responding to1 and recovering from election cybersecurity incidents1 threats1 and vulnerabilities2 7#b7 to establish contract vehicles to enable ,states to access the services of #a or more of the private sector organizations after receiving amounts under a grant under this section2 7#c7 to ensure that the contract vehicles permit individual ,states to augment ,federal funds with funding otherwise available to the ,states2 and 7#d7 to provide a list of qualified entities to the ,secretary and ,chairman in order to ensure it is readily available to ,state election officials4 7e7 ,limitation on amount of grant 7#a7 ,in general ,subject to paragraph 7#c71 the amount of funds provided to a ,state under a grant under this section shall be equal to the product obtained by multiplying-- 7,a7 the total amount appropriated for grants pursuant to the authorization under section #f2 by 7,b7 the ,state allocation percentage for the ,state 7as determined under paragraph 7#b774 7#b7 ,state allocation percentage ,the ,state allocation percentage for a ,state is the amount 7expressed as a percentage7 equal to the quotient obtained by dividing-- 7,a7 the total voting age population of all ,states 7as reported in the most recent decennial census72 by 7,b7 the voting age population of the ,state 7as reported in the most recent decennial census74 7#c7 ,minimum amount of payment ,the amount determined under this subsection may not be less than-- 7,a7 in the case of any of the several ,states or the ,district of ,columbia1 #j4e percent of the total amount appropriated for grants under this section2 or 7,b7 in the case of the ,commonwealth of ,puerto ,rico1 ,guam1 ,american ,samoa1 the ,commonwealth of ,northern ,mariana ,islands1 or the ,united ,states ,virgin ,islands1 #j4a percent of such total amount4 7#d7 ,pro rata reductions ,the ,secretary shall make such pro rata reductions to the allocations determined under paragraph 7#a7 as are necessary to comply with the requirements of paragraph 7#c74 7f7 ,interim grant program for election preparedness 7#a7 ,in general ,the ,secretary shall award a grant to an election agency1 regardless of ,state submission of an application under subsection 7b71 that-- 7,a7 receives a cyber hygiene scan1 a risk and vulnerability assessment1 or a similar cybersecurity evaluation by the ,department or a contractor approved by the ,department2 and 7,b7 not later than ,november #f1 #bjah1 submits to the ,department-- 7i7 the results of the evaluation described in subparagraph 7,a72 7ii7 a plan for rapidly remediating the vulnerabilities identified by the evaluation1 including specific expenditures2 and 7iii7 in the case of an application by any election agency of a political subdivision of a ,state1 a certification of approval from the ,state election agency4 7#b7 ,prioritization for local governments ,a ,state election agency may authorize some or all other election agencies within the ,state to apply for interim grants under paragraph 7#a74 ,if the amount available under paragraph 7#e7 is not sufficient to fund the applications received from election agencies within the ,state1 the ,state election agency may establish a priority order for funding applications4 7#c7 ,use of funds ,an election agency that receives a grant under paragraph 7#a7 shall only use the funds received under the grant to implement the remediation plan submitted under paragraph 7#a77;,b77ii74 7#d7 ,unavailability of department services ,if an election agency requests an evaluation by the ,department consistent with paragraph 7#a77;,a71 and the ,department is not able to provide the evaluation during the #cj-;calendar-day period following the request1 the agency may-- 7,a7 procure a reasonably equivalent evaluation from a private-sector entity2 and 7,b7 use funds received from a grant under subparagraph 7,a7 as reimbursement for the cost of the evaluation4 7#e7 ,limitation on amount of grant2 coordination with cybersecurity and modernization grants 7,a7 ,limitation ,the aggregate amount of grants under this subsection to all election agencies in a ,state shall not exceed #aj percent of the limitation with respect to such ,state under subsection 7e77#a74 7,b7 ,coordination with cybersecurity and modernization grants ,the amount under subsection 7e77#a7 for purposes of grants under subsection 7a77#a7 to a ,state shall be reduced by the amount of grants provided under this subsection to election agencies within the ,state1 less any unused amount returned to the ,department4 7g7 ,interim grant program for ,non-,paper equipment replacement 7#a7 ,in general ,the ,secretary shall award grants to ,states designated under paragraph 7#b7 for the purpose of replacing voting systems that would not be eligible for purchase under subsection 7c77#c74 7#b7 ,eligibility ,not later than #fj days after the date of enactment of this ,act1 the ,secretary shall develop a list of ,states in which #aj percent or more of votes in the first ,federal election occurring after the date of enactment of this ,act are expected to be cast using voting systems that would not be eligible for purchase under subsection 7c77#c71 and shall submit the list to the appropriate congressional committees4 7#c7 ,use of funds ,a ,state election agency that receives funds under paragraph 7#a7 shall only use the funds to replace voting systems that would not be eligible for purchase under subsection 7c77#c74 7#d7 ,application process ,the ,secretary shall-- 7,a7 establish an application process for ,states designated under paragraph 7#b7 to apply for grants under this subsection2 and 7,b7 consider the recommendations of the ,advisory ,panel under section #e7;c7 in establishing the application process2 and ensure that a ,state applying for a grant submits-- 7i7 an inventory of voting systems in the ,state that would not be eligible for purchase under subsection7c77#c72 7ii7 a plan to expeditiously replace those voting systems2 and 7iii7 a commitment to ,state funding for replacements that is at least equivalent to the grant amount4 7#e7 ,review ,the ,secretary-- 7,a7 shall fund a ,state application if the ,secretary determines that the ,state will likely replace the voting systems that would not be eligible for purchase under subsection 7c77#c72 and 7,b7 in reviewing a ,state application1 shall consider the recommendations and criteria of the ,advisory ,panel under section #e7;c74 7#f7 ,limitations2 coordination with cybersecurity and modernization grants 7,a7 ,limitations ,of the total amount authorized to be appropriated under subsection 7i7 for the first fiscal year beginning after the date of enactment of this ,act1 #ahf1jjj1jjj shall be used for grants awarded under this subsection4 7,b7 ,formula for grant amounts ,the grant amount made available to each ,state shall be set according to the proportional formula described in subsection 7e71 as applied to the list of ,states designated under paragraph 7#b7 and the number of votes cast in those ,states using voting systems that would not be eligible for purchase under subsection 7c77#c74 7,c7 ,coordination with cybersecurity and modernization grants ,if the ,secretary determines that no additional ,state will receive a grant under this paragraph1 the ,secretary shall reallocate any amounts remaining under subparagraph 7,a7 to the cybersecurity and modernization grant program established under this section4 7h7 ,financial assistance for auditing expenses 7#a7 ,in general ,the ,secretary shall award grants to ,states that1 in order to implement the guidelines established under section #e7;b71 inspect 7by hand and not by device7 a number of marked paper ballots in a ,federal election that is greater than #e percent of the voting age population within the ,state 7in the case of national or statewide office7 or district covered by the election4 7#b7 ,application process ,the ,secretary shall establish an application process for a ,state that qualifies under paragraph 7#a7 to apply for a grant to reimburse its expenses associated with inspecting 7by hand and not by device7 paper ballots in excess of #e percent of the voting age population within the ,state 7in the case of national or statewide office7 or district covered by the election4 7#c7 ,local governments ,a ,state election agency may authorize some or all other election agencies within the ,state to apply for grants under paragraph 7#a74 7#d7 ,timing2 distribution ,the ,secretary shall award grants under this subsection on ,january #ca1 #bjai1 and every #b years thereafter4 ,if the amount appropriated for carrying out this subsection is insufficient to fund the grants1 the ,secretary shall fund them according to the proportional formula described in subsection 7e71 as applied to the ,states seeking grants under this subsection and the number of marked paper ballots that were inspected by hand in excess of #e percent of the voting age population within the ,state 7in the case of national or statewide office7 or district covered by the election4 7#e7 ,limitation ,of the total amount authorized to be appropriated under subsection 7i71 #e1jjj1jjj shall be used for grants under this subsection4 7i7 ,authorization of appropriations 7#a7 ,in general ,there is authorized to be appropriated to the ,department #chf1jjj1jjj to carry out this section for fiscal year #bjah4 7#b7 ,availability ,any amounts appropriated pursuant to paragraph 7#a7 shall remain available without fiscal year limitation until expended4 7#c7 ,funding source 7,a7 ,definitions ,in this paragraph-- 7i7 the terms agency1 closeout1 and ,federal grant award have the meanings given those terms in section #b of the ,grants ,oversight and ,new ,efficiency ,act 7,public ,law #aad-aag2 #acj ,stat4 #f72 and 7ii7 the term ,director means the ,director of the ,office of ,management and ,budget4 7,b7 ,closeout of expired and undisbursed ,federal grants ,not later than #a year after the date of enactment of this ,act1 the ,director shall promulgate procedures requiring the head of each agency to promptly conduct a closeout of each ,federal grant award4 7,c7 ,related reports ,in promulgating the procedures required under subparagraph 7,b71 the ,director shall consider the recommendations and data in the reports required to be submitted under section #b of the ,grants ,oversight and ,new ,efficiency ,act 7,public ,law #aad-aag2 #acj ,stat4 #f7 and section #ecj of the ,commerce1 ,justice1 ,science1 and ,related ,agencies ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #abi ,stat4 #bcbi71 and similar reports4 7,d7 ,expiration ,the procedures required under subparagraph 7,b7 shall expire #d years after the date on which the procedures are promulgated4 #h4 ,hack the election program 7a7 ,establishment ,not later than #a year after the date of enactment of this ,act1 the ,secretary shall establish a program to improve election system cybersecurity by facilitating and encouraging assessments by independent technical experts1 in cooperation with election agencies and election service providers1 to identify and report election cybersecurity vulnerabilities4 7b7 ,voluntary participation ,participation in the ,hack the ,election program shall be entirely voluntary for election agencies and election service providers4 7c7 ,input from election agencies ,in developing the ,hack the ,election program under this section1 the ,secretary shall solicit input from election agencies1 and shall encourage election agencies to participate4 7d7 ,activities ,in establishing the program required under subsection 7a71 the ,secretary shall-- 7#a7 establish a recurring competition for independent technical experts to assess election systems for the purpose of identifying and reporting election cybersecurity vulnerabilities2 7#b7 establish an expeditious process by which independent technical experts can qualify to participate in the competition2 7#c7 establish a schedule of awards 7monetary or non-monetary7 for reports of previously unidentified election cybersecurity vulnerabilities discovered by independent technical experts during the competition2 7#d7 establish a process for election agencies and election service providers to voluntarily participate in the program by designating specific election systems1 periods of time1 and circumstances for assessment by independent technical experts2 and 7#e7 promptly notify election agencies and election service providers about relevant election cybersecurity vulnerabilities discovered through the competition1 and provide technical assistance in remedying the vulnerabilities4 7e7 ,use of service providers ,the ,secretary may award competitive contracts as necessary to manage the program required under subsection 7a74 7f7 ,consultation ,in developing the program required under subsection 7a71 the ,secretary shall consult with-- 7#a7 the ,attorney ,general to address possible liability for participating individuals under section #ajcj of title #ah1 ,united ,states ,code1 section #abja of title #ag1 ,united ,states ,code1 or other relevant ,federal law2 and 7#b7 the relevant offices at the ,department of ,defense that were responsible for launching the #bjaf ,hack the ,pentagon pilot program and subsequent ,department of ,defense bug bounty programs4