,,ii #aaeth ,,congress #b;d ,session ,s4 #beic ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #bb1 #bjah ,mr4 ,lankford 7for himself1 ,ms4 ,klobuchar1 ,mr4 ,graham1 ,ms4 ,harris1 ,ms4 ,collins1 ,mr4 ,heinrich1 ,mr4 ,burr1 and ,mr4 ,warner7 introduced the following bill2 which was read twice and referred to the ,committee on ,rules and ,administration ,a ,,bill ,to protect the administration of ,federal elections against cybersecurity threats4 #a4 ,short title ,this ,act may be cited as the ,secure ,elections ,act4 #b4 ,sense of ,congress ,it is the sense of ,congress that-- 7#a7 the ,states conduct elections and should maintain control of and responsibility for them2 7#b7 it is important to maintain ,state leadership in election administration2 7#c7 free and fair elections are central to our democracy2 7#d7 protecting our elections is a national security priority2 and 7#e7 an attack on our election systems by a foreign power is a hostile act and should be met with appropriate retaliatory actions1 including immediate and severe sanctions4 #c4 ,definitions ,in this ,act3 7#a7 ,advisory panel ,the term ,advisory ,panel means the advisory panel of independent experts on election cybersecurity established under section #e7;a77#a74 7#b7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,rules and ,administration1 the ,committee on ,armed ,services1 the ,committee on ,homeland ,security and ,governmental ,affairs1 the ,committee on ,appropriations1 the ,select ,committee on ,intelligence1 the majority leader1 and the minority leader of the ,senate2 and 7,b7 the ,committee on ,house ,administration1 the ,committee on ,armed ,services1 the ,committee on ,homeland ,security1 the ,committee on ,appropriations1 the ,permanent ,select ,committee on ,intelligence1 the ,speaker1 and the minority leader of the ,house of ,representatives4 7#c7 ,appropriate ,federal entities ,the term appropriate ,federal entities means-- 7,a7 the ,department of ,commerce1 including the ,national ,institute of ,standards and ,technology2 7,b7 the ,department of ,defense2 7,c7 the ,department1 including the component of the ,department that reports to the ,under ,secretary responsible for overseeing critical infrastructure protection1 cybersecurity1 and other related programs of the ,department2 7,d7 the ,department of ,justice1 including the ,federal ,bureau of ,investigation2 7,e7 the ,commission2 and 7,f7 the ,office of the ,director of ,national ,intelligence1 the ,national ,security ,agency1 and such other elements of the intelligence community 7as defined in section #c of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc77 as the ,director of ,national ,intelligence determines are appropriate4 7#d7 ,chairman ,the term ,chairman means the ,chairman of the ,election ,assistance ,commission4 7#e7 ,commission ,the term ,commission means the ,election ,assistance ,commission4 7#f7 ,department ,the term ,department means the ,department of ,homeland ,security4 7#g7 ,election agency ,the term election agency means any component of a ,state or any component of a county1 municipality1 or other subdivision of a ,state that is responsible for administering ,federal elections4 7#h7 ,election cybersecurity incident ,the term election cybersecurity incident means any incident involving an election system4 7#i7 ,election cybersecurity threat ,the term election cybersecurity threat means any cybersecurity threat 7as defined in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja77 to an election system4 7#aj7 ,election cybersecurity vulnerability ,the term election cybersecurity vulnerability means any security vulnerability 7as defined in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja77 that affects an election system4 7#aa7 ,election service provider ,the term election service provider means any person providing1 supporting1 or maintaining an election system on behalf of an election agency1 such as a contractor or vendor4 7#ab7 ,election system ,the term election system means a voting system1 an election management system1 a voter registration website or database1 an electronic pollbook1 a system for tabulating or reporting election results1 an election agency communications system1 or any other information system 7as defined in section #cejb of title #dd1 ,united ,states ,code7 that the ,secretary identifies as central to the management1 support1 or administration of a ,federal election4 7#ac7 ,federal election ,the term ,federal election means any election 7as defined in section #cja7a7 of the ,federal ,election ,campaign ,act of #aiga 7#eb ,u4,s4,c4 #cjaja7a777 for ,federal office 7as defined in section #cja7c7 of the ,federal ,election ,campaign ,act of #aiga 7#eb ,u4,s4,c4 #cjaja7c7774 7#ad7 ,federal entity ,the term ,federal entity means any agency 7as defined in section #eea of title #e1 ,united ,states ,code74 7#ae7 ,incident ,the term incident has the meaning given the term in section #bbg7;a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #adh7;a774 7#af7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security4 7#ag7 ,state ,the term ,state means each of the several ,states of the ,united ,states1 the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 ,guam1 ,american ,samoa1 the ,commonwealth of ,northern ,mariana ,islands1 and the ,united ,states ,virgin ,islands4 7#ah7 ,state election official ,the term ,state election official means-- 7,a7 the chief ,state election official of a ,state designated under section #aj of the ,national ,voter ,registration ,act of #aiic 7#eb ,u4,s4,c4 #bjeji72 or 7,b7 in the ,commonwealth of ,puerto ,rico1 ,guam1 ,american ,samoa1 the ,commonwealth of ,northern ,mariana ,islands1 and the ,united ,states ,virgin ,islands1 a chief ,state election official designated by the ,state for purposes of this ,act4 7#ai7 ,state law enforcement officer ,the term ,state law enforcement officer means the head of a ,state law enforcement agency1 such as an attorney general4 7#bj7 ,voting system ,the term voting system has the meaning given the term in section #cja7;b7 of the ,help ,america ,vote ,act of #bjjb 7#eb ,u4,s4,c4 #bajha7;b774 #d4 ,information sharing 7a7 ,designation of responsible ,federal entity ,the ,secretary shall have primary responsibility within the ,federal ,government for sharing information about election cybersecurity incidents1 threats1 and vulnerabilities with ,federal entities and with election agencies4 7b7 ,presumption of ,federal information sharing to the department ,if a ,federal entity receives information about an election cybersecurity incident1 threat1 or vulnerability1 the ,federal entity shall promptly share that information with the ,department1 unless the head of the entity 7or a ,senate-confirmed official designated by the head7 makes a specific determination in writing that there is good cause to withhold the particular information4 7c7 ,presumption of ,federal and ,state information sharing from the department ,if the ,department receives information about an election cybersecurity incident1 threat1 or vulnerability1 the ,department shall promptly share that information with-- 7#a7 the appropriate ,federal entities2 7#b7 all ,state election agencies2 7#c7 to the maximum extent practicable1 all election agencies that have requested ongoing updates on election cybersecurity incidents1 threats1 or vulnerabilities2 and 7#d7 to the maximum extent practicable1 all election agencies that may be affected by the risks associated with the particular election cybersecurity incident1 threat1 or vulnerability4 7d7 ,technical resources for election agencies ,in sharing information about election cybersecurity incidents1 threats1 and vulnerabilities with election agencies under this section1 the ,department shall1 to the maximum extent practicable-- 7#a7 provide cyber threat indicators and defensive measures 7as such terms are defined in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja771 such as recommended technical instructions1 that assist with preventing1 mitigating1 and detecting threats or vulnerabilities2 7#b7 identify resources available for protecting against1 detecting1 responding to1 and recovering from associated risks1 including technical capabilities of the ,department2 and 7#c7 provide guidance about further sharing of the information4 7e7 ,declassification review ,if the ,department receives classified information about an election cybersecurity incident1 threat1 or vulnerability-- 7#a7 the ,secretary shall promptly submit a request for expedited declassification review to the head of a ,federal entity with authority to conduct the review1 consistent with ,executive ,order #acebf or any successor order1 unless the ,secretary determines that such a request would be inappropriate2 and 7#b7 the head of the ,federal entity described in paragraph 7#a7 shall promptly conduct the review4 7f7 ,role of non-,federal entities ,the ,department may share information about election cybersecurity incidents1 threats1 and vulnerabilities through a non-,federal entity4 7g7 ,protection of personal and confidential information 7#a7 ,in general ,if a ,federal entity shares information relating to an election cybersecurity incident1 threat1 or vulnerability1 the ,federal entity shall1 within ,federal information systems 7as defined in section #cejb of title #dd1 ,united ,states ,code7 of the entity-- 7,a7 minimize the acquisition1 use1 and disclosure of personal information of voters1 except as necessary to identify1 protect against1 detect1 respond to1 or recover from election cybersecurity incidents1 threats1 and vulnerabilities2 7,b7 notwithstanding any other provision of law1 prohibit the retention of personal information of voters1 such as-- 7i7 voter registration information1 including physical address1 email address1 and telephone number2 7ii7 political party affiliation or registration information2 and 7iii7 voter history1 including registration status or election participation2 and 7,c7 protect confidential ,federal and ,state information from unauthorized disclosure4 7#b7 ,exemption from disclosure ,information relating to an election cybersecurity incident1 threat1 or vulnerability1 such as personally identifiable information of reporting persons or individuals affected by such incident1 threat1 or vulnerability1 shared by or with the ,federal ,government shall be-- 7,a7 deemed voluntarily shared information and exempt from disclosure under section #eeb of title #e1 ,united ,states ,code1 and any ,state1 tribal1 or local provision of law requiring disclosure of information or records2 and 7,b7 withheld1 without discretion1 from the public under section #eeb7;b77#c77;,b7 of title #e1 ,united ,states ,code1 and any ,state1 tribal1 or local provision of law requiring disclosure of information or records4 7h7 ,duty ,to assess possible cybersecurity incidents 7#a7 ,election agencies ,if an election agency becomes aware of the possibility of an election cybersecurity incident1 the election agency shall promptly assess whether an election cybersecurity incident occurred and notify the ,state election official4 7#b7 ,election service providers ,if an election service provider becomes aware of the possibility of an election cybersecurity incident1 the election service provider shall promptly assess whether an election cybersecurity incident occurred and notify the relevant election agencies consistent with subsection 7j74 7i7 ,information sharing about cybersecurity incidents by election agencies ,if an election agency has reason to believe that an election cybersecurity incident has occurred with respect to an election system owned1 operated1 or maintained by or on behalf of the election agency1 the election agency shall1 in the most expedient time possible and without unreasonable delay1 provide notification of the election cybersecurity incident to the ,department4 7j7 ,information sharing about cybersecurity incidents by election service providers ,if an election service provider has reason to believe that an election cybersecurity incident may have occurred1 or that an incident related to the role of the provider as an election service provider may have occurred1 the election service provider shall-- 7#a7 notify the relevant election agencies in the most expedient time possible and without unreasonable delay2 and 7#b7 cooperate with the election agencies in providing the notifications required under subsections 7h77#a7 and 7i74 7k7 ,content of notification by election agencies ,the notifications required under subsections 7h77#a7 and 7i7-- 7#a7 shall include an initial assessment of-- 7,a7 the date1 time1 and duration of the election cybersecurity incident2 7,b7 the circumstances of the election cybersecurity incident1 including the specific election systems believed to have been accessed and information acquired2 and 7,c7 planned and implemented technical measures to respond to and recover from the incident2 and 7#b7 shall be updated with additional material information1 including technical data1 as it becomes available4 7l7 ,security clearance ,not later than #cj days after the date of enactment of this ,act1 the ,secretary-- 7#a7 shall establish an expedited process for providing appropriate security clearance to ,state election officials and designated technical personnel employed by ,state election agencies2 7#b7 shall establish an expedited process for providing appropriate security clearance to members of the ,commission and designated technical personnel employed by the ,commission2 and 7#c7 shall establish a process for providing appropriate security clearance to personnel at other election agencies4 7m7 ,protection from liability ,nothing in this ,act may be construed to provide a cause of action against a ,state1 unit of local government1 or an election service provider4 7n7 ,assessment of inter-,state information sharing about election cybersecurity 7#a7 ,in general ,the ,secretary and the ,chairman1 in coordination with the heads of the appropriate ,federal entities and appropriate officials of ,state and local governments1 shall conduct an assessment of-- 7,a7 the structure and functioning of the ,multi-,state ,information ,sharing and ,analysis ,center for purposes of election cybersecurity2 and 7,b7 other mechanisms for inter-state information sharing about election cybersecurity4 7#b7 ,comment from election agencies ,in carrying out the assessment required under paragraph 7#a71 the ,secretary and the ,chairman shall solicit and consider comments from all ,state election agencies4 7#c7 ,distribution ,the ,secretary and the ,chairman shall jointly issue the assessment required under paragraph 7#a7 to-- 7,a7 all election agencies known to the ,department and the ,commission2 and 7,b7 the appropriate congressional committees4 7o7 ,congressional notification 7#a7 ,in general ,if an appropriate ,federal entity has reason to believe that a significant election cybersecurity incident has occurred1 the entity shall-- 7,a7 not later than #g calendar days after the date on which there is a reasonable basis to conclude that the significant incident has occurred1 provide notification of the incident to the appropriate congressional committees2 and 7,b7 update the initial notification under paragraph 7#a7 within a reasonable period of time after additional information relating to the incident is discovered4 7#b7 ,reporting threshold ,the ,secretary shall-- 7,a7 promulgate a uniform definition of a significant election cybersecurity incident2 and 7,b7 shall submit the definition promulgated under subparagraph 7,a7 to the appropriate congressional committees4 #e4 ,advisory panel and guidelines 7a7 ,advisory ,panel 7#a7 ,in general ,the ,commission shall establish an advisory panel of independent experts on election cybersecurity4 7#b7 ,membership ,the ,advisory ,panel shall consist of not less than #i members1 of whom-- 7,a7 one shall be appointed by the ,chairman1 in consultation with the ,secretary and the ,director of the ,national ,institute of ,standards and ,technology1 and shall be designated as the ,chairman of the advisory panel2 7,b7 four shall be appointed by the ,chairman1 in consultation with the ,secretary2 and 7,c7 four shall be appointed by the ,secretary1 in consultation with the ,chairman and the ,director of the ,national ,institute of ,standards and ,technology4 7#c7 ,eligibility ,individuals appointed to the ,advisory ,panel established under paragraph 7#a7-- 7,a7 may not be officers or employees of the ,united ,states2 7,b7 if appointed under paragraph 7#b77;,a71 shall possess expertise in election law1 election administration1 or cybersecurity2 and 7,c7 if appointed under subparagraph 7,b7 or 7,c7 of paragraph 7#b71 shall possess expertise in cybersecurity4 7#d7 ,terms2 vacancies ,members of the ,advisory ,panel shall serve for a term set by the ,commission4 ,any vacancy in the ,advisory ,panel shall be filled in the same manner as the original appointment4 7#e7 ,compensation ,members of the ,advisory ,panel shall serve on the ,advisory ,panel without compensation1 except that members of the ,advisory ,panel may be allowed travel expenses1 including per diem in lieu of subsistence1 at rates authorized for employees of agencies under subchapter ,i of chapter #eg of title #e1 ,united ,states ,code1 while away from their homes or regular places of business in the performance of services for the ,advisory ,panel4 7#f7 ,administrative staff ,upon request of the ,advisory ,panel1 the ,commission shall provide to the ,advisory ,panel1 on a reimbursable basis1 the administrative support services necessary for the ,advisory ,panel to carry out its responsibilities under this ,act4 7b7 ,guidelines 7#a7 ,in general ,the ,advisory ,panel shall develop a set of guidelines for election cybersecurity1 including standards for procuring1 maintaining1 testing1 auditing1 operating1 and updating election systems4 7#b7 ,requirements ,in developing the guidelines1 the ,advisory ,panel shall-- 7,a7 identify the top risks to election systems2 7,b7 describe how specific technology choices can increase or decrease those risks2 and 7,c7 provide recommended policies1 best practices1 and overall security strategies for identifying1 protecting against1 detecting1 responding to1 and recovering from the risks identified under subparagraph 7,a74 7c7 ,grant program ,the ,advisory ,panel shall assist the ,commission and the ,department in carrying out the grant program required under section #g by-- 7#a7 submitting recommendations to the ,commission about the grant program application process2 7#b7 submitting recommendations1 including recommended criteria1 to the ,commission for the grant program review process2 7#c7 submitting recommendations1 including recommended criteria1 to the ,commission for use of remaining grant funds2 7#d7 submitting recommendations1 including recommended criteria1 to the ,commission for the interim grant program for non-paper equipment replacement2 and 7#e7 providing any other assistance that the ,commission or the ,department requests4 7d7 ,voting systems and statistical audits ,the guidelines developed under subsection 7b7 shall include provisions regarding voting systems and statistical audits for ,federal elections1 including that-- 7#a7 each vote is cast using a voting system that-- 7,a7 would be eligible to be purchased under section #g7;f72 and 7,b7 allows the voter an opportunity to inspect and confirm the marked ballot before casting it 7consistent with accessibility requirements72 and 7#b7 each election result is determined by tabulating marked ballots 7by hand or device71 and prior to certification by a ,state of the election result1 election agencies within the ,state inspect 7by hand and not by device7 a random sample of the marked ballots and thereby establish high statistical confidence in the election result4 7e7 ,issues considered 7#a7 ,in general ,in developing the guidelines required under subsection 7b71 the ,advisory ,panel shall consider-- 7,a7 applying established cybersecurity best practices to ,federal election administration by ,states and local governments1 including appropriate technologies1 procedures1 and personnel for identifying1 protecting against1 detecting1 responding to1 and recovering from cybersecurity events2 7,b7 mechanisms to verify that election systems accurately tabulate ballots1 report results1 and identify a winner for each election for ,federal office1 even if there is an error or fault in the voting system2 7,c7 specific types of election audits1 including procedures and shortcomings for such audits2 7,d7 durational requirements needed to facilitate election audits prior to election certification1 including variations in the acceptance of postal ballots1 time allowed to cure provisional ballots1 and election certification deadlines2 7,e7 providing actionable guidance to election agencies that have not applied for or received grant funds under section #g1 and to agencies that seek to implement additional cybersecurity protections2 7,f7 how the guidelines could assist other components of ,state and local governments2 and 7,g7 any other factors that the ,advisory ,panel determines to be relevant4 7#b7 ,relationship to voluntary voting system guidelines and ,national ,institute of ,standards and ,technology ,cybersecurity guidance ,in developing the guidelines required under subsection 7b71 the ,advisory ,panel shall consider-- 7,a7 the voluntary voting system guidelines developed by the ,commission2 and 7,b7 cybersecurity standards and best practices developed by the ,national ,institute of ,standards and ,technology1 including frameworks1 consistent with section #b7;c7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgb7;c774 7f7 ,public comment ,the ,advisory ,panel shall-- 7#a7 provide a reasonable opportunity for public comment1 including through ,commission publication in the ,federal ,register1 on the guidelines required under subsection 7b71 including a #de-;day opportunity for public comment on a draft of the guidelines before they are submitted under subsection 7i71 which shall1 to the extent practicable1 occur concurrently with the other activities of the ,advisory ,panel under this section2 and 7#b7 consider the public comments in developing the guidelines4 7g7 ,consultation ,in developing the guidelines required under subsection 7b71 the ,advisory ,panel shall consult with-- 7#a7 the appropriate ,federal entities2 7#b7 the ,standards ,board1 ,board of ,advisors1 and ,technical ,guidelines ,development ,committee of the ,commission2 7#c7 the ,federal ,communications ,commission2 7#d7 the ,federal ,trade ,commission2 7#e7 the ,national ,governors ,association2 7#f7 the ,national ,association of ,secretaries of ,state2 7#g7 the ,national ,association of ,state ,election ,directors2 7#h7 the ,national ,association of ,election ,officials2 7#i7 the ,national ,association of ,counties2 7#aj7 the ,national ,league of ,cities2 7#aa7 the ,international ,association of ,government ,officials2 7#ab7 the ,multi-,state ,information ,sharing and ,analysis ,center2 7#ac7 the ,national ,science ,foundation2 and 7#ad7 any other interested entities that the ,advisory ,panel determines are necessary to the development of the guidelines4 7h7 ,submission to ,commission ,not later than #ahj days after the date of enactment of this ,act1 the ,advisory ,panel shall submit the guidelines required under subsection 7b7 to the ,commission4 7i7 ,submission to ,congress2 modification ,not later than #ad calendar days after the date on which the ,commission receives guidelines under subsection 7h7 or 7l71 the ,commission shall submit the guidelines to the appropriate congressional committees4 ,the ,commission may modify the guidelines in advance of submission to ,congress if-- 7#a7 the ,commission determines that there is good cause to modify the guidelines1 consistent with the considerations established in subsection 7e7 and notwithstanding the recommendation of the ,advisory ,panel2 and 7#b7 the ,commission submits a written justification of the modification to the ,advisory ,panel and the appropriate congressional committees4 7j7 ,distribution to election agencies ,the ,commission shall distribute the guidelines required under subsection 7b7 to all election agencies known to the ,commission and the ,department4 7k7 ,publication ,the ,commission shall make the guidelines required under subsection 7b7 available on the public website of the ,department4 7l7 ,periodic review ,not later than ,january #ca1 #bjai1 and once every #b years thereafter1 the ,advisory ,panel shall review and update the guidelines required under subsection 7b74 7m7 ,rule of construction ,nothing in this section shall be construed to subject the process for developing the guidelines required under subsection 7b7 to subchapter ,,ii of chapter #e1 and chapter #g1 of title #e1 ,united ,states ,code 7commonly known as the ,administrative ,procedure ,act74 7n7 ,conforming amendment ,section #bjb of the ,help ,america ,vote ,act of #bjjb 7#eb ,u4,s4,c4 #bjiba7 is amended by striking and at the end of paragraph 7#e71 by striking the period at the end of paragraph 7#f7 and inserting 2 and1 and by adding at the end the following new paragraph3 7#g7 establishing the advisory panel of independent experts on election cybersecurity under section #e7;a77#a7 of the ,secure ,elections ,act4 4 #f4 ,reports to ,congress 7a7 ,reports on foreign threats to elections 7#a7 ,in general ,not later than #cj days after the date of enactment of this ,act1 and #cj days after the end of each fiscal year thereafter1 the ,secretary and the ,director of ,national ,intelligence1 in coordination with the heads of the appropriate ,federal entities1 shall submit a joint report to the appropriate congressional committees on foreign threats to elections in the ,united ,states1 including physical and cybersecurity threats4 7#b7 ,voluntary participation by ,states ,the ,secretary shall solicit and consider comments from all ,state election agencies4 ,participation by an election agency in the report under this subsection shall be voluntary and at the discretion of the ,state4 7b7 ,reports on grant program 7#a7 ,in general ,not later than #b years after the date of enactment of this ,act1 and1 subject to paragraph 7#b71 every #d years thereafter1 the ,comptroller ,general of the ,united ,states shall submit a report to the appropriate congressional committees on the grant program established under section #g1 including how grant funds have been distributed and used to implement the guidelines required under section #e7;b74 7#b7 ,sunset ,if the ,comptroller ,general determines that over #ij percent of the funds appropriated under section #g7;h77#a7 have been expended by the ,states1 the reporting requirement in paragraph 7#a7 shall cease to be effective after the ,comptroller ,general submits a final report4 #g4 ,state election system cybersecurity and modernization grants 7a7 ,authority 7#a7 ,in general ,the ,commission shall award grants in accordance with this section4 7#b7 ,coordination 7,a7 ,in general ,the ,commission shall coordinate with the ,secretary in carrying out this section4 7,b7 ,joint program ,if the ,chairman determines that jointly carrying out this section with the ,secretary would increase ,state participation and cybersecurity preparedness1 the ,chairman shall-- 7i7 submit notice of the determination to the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,rules and ,administration of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,house ,administration of the ,house of ,representatives2 and 7ii7 enter into a ,memorandum of ,understanding with the ,secretary to carry out the grant program4 7b7 ,cybersecurity and modernization grants 7#a7 ,application process 7,a7 ,in general ,the ,commission shall-- 7i7 establish a process for ,states to apply for election system cybersecurity and modernization grants2 7ii7 in establishing the application process1 consider the recommendations of the ,advisory ,panel under section #e7;c72 and 7iii7 ensure that the application process requires that a ,state seeking a grant provide a detailed explanation of how election agencies within the ,state will implement the guidelines established under section #e7;b74 7,b7 ,review ,the ,commission-- 7i7 shall fund a ,state application submitted under subparagraph 7,a7 if the ,commission determines that-- 7,i7 the election agencies within the ,state will likely implement the guidelines established under section #e7;b72 7,,ii7 with respect to the guidelines related to statistical audits1 consistent with section #e7;d71 the ,state will complete a statewide pilot program during a biennial ,federal general election not later than #bjbb2 and 7,,iii7 the ,state will match at least ten percent of the total grant allocation for election cybersecurity improvements2 and 7ii7 in reviewing a ,state application1 shall consider the recommendations and criteria of the ,advisory ,panel under section #e7;c74 7,c7 ,state implementation 7i7 ,in general ,a ,state receiving a grant under this subsection may adopt any reasonable implementation of the guidelines established under section #e7;b74 7ii7 ,inconsistency with ,state law ,if implementation of the guidelines would be inconsistent with ,state law1 the ,state shall-- 7,i7 identify in the application of the ,state the legal issue and the guidelines that the ,state cannot implement2 7,,ii7 specify in the application of the ,state the amount of grant funds that the ,state would spend implementing those guidelines if the law were not inconsistent2 and 7,,iii7 not spend the amount of grant funds specified under subclause 7,,ii7 until the legal issue is resolved4 7,d7 ,protection of personal information ,the application process established under this paragraph shall not require a ,state to disclose the personal information of any voter4 7#b7 ,use of funds 7,a7 ,in general ,except as provided in subparagraph 7,b71 a ,state receiving a grant under this subsection shall use the funds received under the grant to implement the guidelines established under section #e7;b74 7,b7 ,remaining funds ,a ,state may use funds from a grant under this subsection to improve1 upgrade1 or acquire hardware1 software1 or services for the purposes of improving administration of ,federal elections1 consistent with the guidelines established under section #e7;b71 if-- 7i7 the ,state election official submits a written certification to the ,commission that the election agencies within the ,state have implemented the guidelines established under section #e7;b72 and 7ii7 the ,commission1 after consideration of the recommendations and criteria of the ,advisory ,panel under section #e7;c71 approves the use of funds4 7#c7 ,limitation on amount of grants 7,a7 ,in general ,subject to subparagraph 7,c71 the amount of funds provided to a ,state under a grant under this subsection shall be equal to the product obtained by multiplying-- 7i7 the total amount appropriated for grants pursuant to the authorization under subsection 7h7 reduced by the amounts described in subsections 7d77#f7 and 7e77#e72 by 7ii7 the ,state allocation percentage for the ,state 7as determined under paragraph 7#b774 7,b7 ,state allocation percentage ,the ,state allocation percentage for a ,state is the amount 7expressed as a percentage7 equal to the quotient obtained by dividing-- 7i7 the total voting age population of all ,states 7as reported in the most recent decennial census72 by 7ii7 the voting age population of the ,state 7as reported in the most recent decennial census74 7,c7 ,minimum amount of payment ,the amount determined under this subsection may not be less than-- 7i7 in the case of any of the several ,states or the ,district of ,columbia1 #j4e percent of the total amount appropriated for grants under this section2 or 7ii7 in the case of the ,commonwealth of ,puerto ,rico1 ,guam1 ,american ,samoa1 the ,commonwealth of ,northern ,mariana ,islands1 or the ,united ,states ,virgin ,islands1 #j4a percent of such total amount4 7,d7 ,pro rata reductions ,the ,commission shall make such pro rata reductions to the allocations determined under subparagraph 7,a7 as are necessary to comply with the requirements of subparagraph 7,c74 7#d7 ,grants for local jurisdictions 7,a7 ,eligibility ,if a ,state notifies the ,commission that it will not apply for election system cybersecurity and modernization grants under this subsection1 the ,commission shall award grants to election agencies within the ,state4 7,b7 ,application process ,the ,commission shall establish a process for election agencies that are eligible under subparagraph 7,a7 to apply for election system cybersecurity and modernization grants1 consistent with the application process for ,states established under paragraph 7#a74 7,c7 ,use of funds ,an election agency that receives a grant under this subsection is subject to the use of funds restrictions in paragraph 7#b74 7,d7 ,limitation on amount of grant ,the amount of funds provided to an election agency under a grant under this subsection shall be equal to the amount obtained by multiplying the amount available to the ,state under paragraph 7#c7 by the quotient obtained by dividing-- 7i7 the voting age population of the ,state 7as reported in the most recent decennial census7 who would cast their ballots in a ,federal election using voting systems operated by the election agency 7under current ,state law72 by 7ii7 the voting age population of the ,state 7as reported in the most recent decennial census74 7c7 ,interim grant program for election preparedness 7#a7 ,in general ,the ,commission1 in consultation with the ,secretary1 shall award a grant to an election agency1 regardless of ,state submission of an application under subsection 7b77#a77;,a71 that-- 7,a7 receives a cyber hygiene scan1 a risk and vulnerability assessment1 or a similar cybersecurity evaluation by the ,department or a contractor approved by the ,department2 and 7,b7 not later than ,november #f1 #bjah1 submits to the ,commission and the ,department-- 7i7 the results of the evaluation described in subparagraph 7,a72 7ii7 a plan for rapidly remediating the vulnerabilities identified by the evaluation1 including specific expenditures2 and 7iii7 in the case of an application by any election agency of a political subdivision of a ,state1 a certification of approval from the ,state election agency4 7#b7 ,prioritization for local governments ,a ,state election agency may authorize some or all other election agencies within the ,state to apply for interim grants under paragraph 7#a74 ,if the amount available under paragraph 7#e7 is not sufficient to fund the applications received from election agencies within the ,state1 the ,state election agency may establish a priority order for funding applications4 7#c7 ,use of funds ,an election agency that receives a grant under paragraph 7#a7 shall only use the funds received under the grant to implement the remediation plan submitted under paragraph 7#a77;,b77ii74 7#d7 ,unavailability of department services ,if an election agency requests an evaluation by the ,department consistent with paragraph 7#a77;,a71 and the ,department is not able to provide the evaluation during the #cj-;calendar-day period following the request1 the agency may-- 7,a7 procure a reasonably equivalent evaluation from a private-sector entity2 and 7,b7 use funds received from a grant under paragraph 7#a7 as reimbursement for the cost of the evaluation4 7#e7 ,limitation on amount of grant2 coordination with cybersecurity and modernization grants 7,a7 ,limitation ,the aggregate amount of grants under this subsection to all election agencies in a ,state shall not exceed #aj percent of the limitation with respect to such ,state under subsection 7b77#c74 7,b7 ,coordination with cybersecurity and modernization grants ,the amount under subsection 7b77#c7 for purposes of grants under subsection 7b7 to a ,state shall be reduced by the amount of grants provided under this subsection to election agencies within the ,state1 less any unused amount returned to the ,department4 7d7 ,interim grant program for non-,paper equipment replacement 7#a7 ,in general ,the ,commission shall award grants to ,states designated under paragraph 7#b7 for the purpose of replacing voting systems that would not be eligible for purchase under subsection 7f74 7#b7 ,eligibility ,not later than #fj days after the date of enactment of this ,act1 the ,commission shall develop a list of ,states in which #aj percent or more of votes in the first ,federal election occurring after the date of enactment of this ,act are expected to be cast using voting systems that would not be eligible for purchase under subsection 7f71 and shall submit the list to the appropriate congressional committees4 7#c7 ,application process ,the ,commission shall-- 7,a7 establish an application process for ,states designated under paragraph 7#b7 to apply for grants under this subsection2 and 7,b7 consider the recommendations of the ,advisory ,panel under section #e7;c7 in establishing the application process2 and ensure that a ,state applying for a grant submits-- 7i7 an inventory of voting systems in the ,state that would not be eligible for purchase under subsection 7f72 7ii7 a plan to expeditiously replace those voting systems2 and 7iii7 a commitment to ,state funding for replacements that is at least equivalent to the grant amount4 7#d7 ,review ,the ,commission-- 7,a7 shall fund a ,state application if the ,commission determines that the ,state will likely replace the voting systems that would not be eligible for purchase under subsection 7f72 and 7,b7 in reviewing a ,state application1 shall consider the recommendations and criteria of the ,advisory ,panel under section #e7;c74 7#e7 ,use of funds ,a ,state election agency that receives funds under paragraph 7#a7 shall only use the funds to replace voting systems that would not be eligible for purchase under subsection 7f74 7#f7 ,limitations2 coordination with cybersecurity and modernization grants 7,a7 ,limitations ,of the total amount authorized to be appropriated under subsection 7h71 #ahf1jjj1jjj shall be used for grants awarded under this subsection4 7,b7 ,formula for grant amounts ,the grant amount made available to each ,state shall be set according to the proportional formula described in subsection 7b77#c71 as applied to the list of ,states designated under paragraph 7#b7 and the number of votes cast in those ,states using voting systems that would not be eligible for purchase under subsection 7f74 7,c7 ,coordination with cybersecurity and modernization grants ,if the ,secretary determines that no additional ,state will receive a grant under this paragraph1 the ,secretary shall reallocate any amounts remaining under subparagraph 7,a7 to the cybersecurity and modernization grant program under subsection 7b74 7#g7 ,grants for local jurisdictions 7,a7 ,eligibility ,if a ,state designated under paragraph 7#b7 notifies the ,commission that it will not apply for grants under this subsection1 the ,commission shall award grants to election agencies within such ,state4 7,b7 ,application process ,the ,commission shall establish a process for election agencies that are eligible under subparagraph 7,a7 to apply for grants under this subsection1 consistent with the application process for ,states established under paragraph 7#c74 7,c7 ,review ,the ,commission shall review applications of election agencies under this paragraph in a similar manner to the manner required for applications by ,states under paragraph 7#d74 7,d7 ,use of funds ,an election agency that receives a grant under this subsection is subject to the use of funds restrictions in paragraph 7#e74 7,e7 ,limitation on amount of grant ,the amount of funds provided to an election agency under a grant under this subsection shall be equal to the amount obtained by multiplying the amount available to the ,state under paragraph 7#f77;,b7 by the quotient obtained by dividing-- 7i7 the voting age population of the ,state 7as reported in the most recent decennial census7 who would cast their ballots in a ,federal election using voting systems that are operated by the election agency 7under current ,state law7 and that would not be eligible for purchase under subsection 7f72 by 7ii7 the voting age population of the ,state 7as reported in the most recent decennial census7 who would cast their ballots in a ,federal election using voting systems that would not be eligible for purchase under subsection 7f74 7e7 ,financial assistance for auditing expenses 7#a7 ,in general ,the ,commission shall award grants to reimburse ,states that conduct statistical audits of a proportionally large number of ballots in close ,federal elections if the statistical audit-- 7,a7 is consistent with the guidelines established under section #e7;b72 and 7,b7 includes the inspection 7by hand and not by device7 of an amount of paper ballots in excess of #e percent of the voting age population within the ,state 7in the case of national or statewide office7 or district covered by the election4 7#b7 ,applications process 7,a7 ,in general ,a ,state seeking a grant under this subsection shall submit an application in such form and manner and at such time as the ,commission may require4 7,b7 ,local governments ,a ,state election agency may authorize some or all other election agencies within the ,state to apply for grants under paragraph 7#a74 ,the ,commission shall establish rules for the application of paragraphs 7#c7 and 7#d77;,b7 to agencies requesting grants under this subparagraph4 7#c7 ,limitation on amount of grants ,the amount of funds provided under a grant under this subsection shall be equal to the cost of the statistical audit1 less the cost of inspecting 7by hand and not by device7 a number of ballots equal to #e percent of-- 7,a7 in the case of an election for a national or statewide office1 the voting age population within the ,state2 or 7,b7 in the case of an election for any other office1 the voting age population within the district covered by the election4 7#d7 ,timing2 distribution 7,a7 ,in general ,the ,commission shall award grants under this subsection on ,january #ca1 #bjai1 and every #b years thereafter4 7,b7 ,insufficient funds ,if the amount appropriated for carrying out this subsection is insufficient to fund the grants1 the ,commission shall fund such grants according to the proportional formula described in subsection 7b77#c71 as applied to the ,states seeking grants under this subsection and the number of marked paper ballots that were inspected by hand in excess of #e percent of the voting age population within the ,state 7in the case of national or statewide office7 or district covered by the election4 7#e7 ,limitation ,of the total amount authorized to be appropriated under subsection 7h71 #e1jjj1jjj shall be used for grants under this subsection4 7f7 ,prohibition on use for certain voting systems 7#a7 ,in general ,funds received under a grant under this section may not be used for any voting system that records each vote in electronic storage1 unless the system is an optical scanner that reads paper ballots4 7#b7 ,electronic user interfaces ,funds received under a grant under this section may be used for a voting system with an electronic user interface provided that the voting system is consistent with clause 7i74 7g7 ,contracting assistance ,not later than #ij days after the date of enactment of this ,act1 the ,administrator of ,general ,services1 in consultation with the ,director of the ,national ,institute of ,standards and ,technology1 shall take such actions as may be necessary through competitive processes-- 7#a7 to qualify a set of private sector entities that are capable of assisting ,states with identifying1 protecting against1 detecting1 responding to1 and recovering from election cybersecurity incidents1 threats1 and vulnerabilities2 7#b7 to establish contract vehicles to enable ,states to access the services of #a or more of the private sector organizations after receiving amounts under a grant under this section2 7#c7 to ensure that the contract vehicles permit individual ,states to augment ,federal funds with funding otherwise available to the ,states2 and 7#d7 to provide a list of qualified entities to the ,chairman and ,secretary in order to ensure it is readily available to ,state election officials4 7h7 ,authorization of appropriations 7#a7 ,in general ,there is authorized to be appropriated to the ,commission #chf1jjj1jjj to carry out this section for fiscal year #bjah4 7#b7 ,availability ,any amounts appropriated pursuant to paragraph 7#a7 shall remain available without fiscal year limitation until expended4 7#c7 ,funding source 7,a7 ,definitions ,in this paragraph-- 7i7 the terms agency1 closeout1 and ,federal grant award have the meanings given those terms in section #b of the ,grants ,oversight and ,new ,efficiency ,act 7,public ,law #aad-aag2 #acj ,stat4 #f72 and 7ii7 the term ,director means the ,director of the ,office of ,management and ,budget4 7,b7 ,closeout of expired and undisbursed ,federal grants ,not later than #a year after the date of enactment of this ,act1 the ,director shall promulgate procedures requiring the head of each agency to promptly conduct a closeout of each ,federal grant award4 7,c7 ,related reports ,in promulgating the procedures required under subparagraph 7,b71 the ,director shall consider the recommendations and data in the reports required to be submitted under section #b of the ,grants ,oversight and ,new ,efficiency ,act 7,public ,law #aad-aag2 #acj ,stat4 #f7 and section #ecj of the ,commerce1 ,justice1 ,science1 and ,related ,agencies ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #abi ,stat4 #bcbi71 and similar reports4 7,d7 ,expiration ,the procedures required under subparagraph 7,b7 shall expire #d years after the date on which the procedures are promulgated4 7i7 ,conforming amendment ,section #bjb7g7 of the ,help ,america ,vote ,act of #bjjb 7#eb ,u4,s4,c4 #bjiba71 as amended by section #e1 is amended by inserting and carrying out the grant programs under section #g of such ,act after ,secure ,elections ,act4