,,ii #aafth ,,congress #ast ,session ,s4 #ahjh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,june #ab1 #bjai,mr4 ,gardner 7for himself and ,mr4 ,markey7 introduced the following bill2 which was read twice and referred to the ,committee on ,foreign ,relations ,a ,,bill ,to require the ,secretary of ,state to design and establish a ,vulnerability ,disclosure ,process to improve ,department of ,state cybersecurity and a bug bounty program to identify and report vulnerabilities of ,internet-facing information technology of the ,department of ,state1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,hack ,your ,state ,department ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,bug bounty program ,the term bug bounty program means a program under which an approved individual1 organization1 or company is temporarily authorized to identify and report vulnerabilities of ,internet-facing information technology of the ,department in exchange for compensation4 7#b7 ,department ,the term ,department means the ,department of ,state4 7#c7 ,information technology ,the term information technology has the meaning given such term in section #aaaja of title #dj1 ,united ,states ,code4 7#d7 ,secretary ,the term ,secretary means the ,secretary of ,state4 7#e7 ,,vdp ,the term ,,vdp means the ,vulnerability ,disclosure ,process established pursuant to section #c4 #c4 ,department of ,state ,vulnerability ,disclosure ,process 7a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary shall design1 establish1 and make publicly known a ,vulnerability ,disclosure ,process to improve cybersecurity within the ,department by-- 7#a7 providing security researchers with clear guidelines for-- 7,a7 conducting vulnerability discovery activities directed at ,department information technology2 and 7,b7 submitting discovered security vulnerabilities to the ,department2 and 7#b7 creating ,department procedures and infrastructure to receive and fix discovered vulnerabilities4 7b7 ,requirements ,in establishing ,,vdp pursuant to subsection 7a71 the ,secretary shall-- 7#a7 identify which ,department information technology should be included in the process2 7#b7 determine whether the process should differentiate among and specify the types of security vulnerabilities that may be targeted2 7#c7 provide a readily available means of reporting discovered security vulnerabilities and the form in which such vulnerabilities should be reported2 7#d7 identify which ,department offices and positions will be responsible for receiving1 prioritizing1 and addressing security vulnerability disclosure reports2 7#e7 consult with the ,attorney ,general regarding how to ensure that individuals1 organizations1 and companies that comply with the ,,vdp requirements are protected from prosecution under section #ajcj of title #ah1 ,united ,states ,code1 and similar provisions of law for specific activities authorized under ,,vdp2 7#f7 consult with the relevant offices at the ,department of ,defense that were responsible for launching the #bjaf ,vulnerability ,disclosure ,program1 ,hack the ,pentagon1 and subsequent ,department of ,defense bug bounty programs2 7#g7 engage qualified interested persons1 including nongovernmental sector representatives1 about the structure of ,,vdp1 as constructive and to the extent practicable2 and 7#h7 award contracts to entities1 as necessary1 to manage ,,vdp and implement the remediation of discovered security vulnerabilities4 7c7 ,annual reports ,not later than #ahj days after the establishment of ,,vdp under subsection 7a7 and annually thereafter for the following #f years1 the ,secretary shall submit a report to the ,committee on ,foreign ,relations of the ,senate and the ,committee on ,foreign ,affairs of the ,house of ,representatives regarding the establishment of ,,vdp1 including information relating to-- 7#a7 the number and severity1 in accordance with the ,national ,vulnerabilities ,database of the ,national ,institute of ,standards and ,technology1 of security vulnerabilities reported through ,,vdp2 7#b7 the number of previously unidentified security vulnerabilities remediated as a result of such reporting2 7#c7 the current number of outstanding previously unidentified security vulnerabilities and the ,department's remediation plans to address such vulnerabilities2 7#d7 the average period between the reporting of security vulnerabilities and the remediation of such vulnerabilities2 7#e7 the resources1 surge staffing1 roles1 and responsibilities within the ,department used to implement ,,vdp and complete the necessary security vulnerability remediation2 and 7#f7 any other information that the ,secretary determines to be relevant4 #d4 ,department of ,state ,bug ,bounty ,pilot ,program 7a7 ,establishment of pilot program 7#a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,secretary shall establish a ,bug ,bounty ,pilot ,program to minimize security vulnerabilities of ,internet-facing information technology of the ,department4 7#b7 ,requirements ,in establishing the pilot program under paragraph 7#a71 the ,secretary shall-- 7,a7 provide compensation for reports of previously unidentified security vulnerabilities within the websites1 applications1 and other ,internet-facing information technology of the ,department that are accessible to the public2 7,b7 award contracts to entities1 as necessary1 to manage the pilot program and for executing the remediation of security vulnerabilities identified pursuant to subparagraph 7,a72 7,c7 identify which ,department information technology should be included in the pilot program2 7,d7 consult with the ,attorney ,general on how to ensure that individuals1 organizations1 or companies that comply with the requirements of the pilot program are protected from prosecution under section #ajcj of title #ah1 ,united ,states ,code1 and similar provisions of law for specific activities authorized under the pilot program2 7,e7 consult with the relevant offices at the ,department of ,defense that were responsible for launching the #bjaf ,hack the ,pentagon pilot program and subsequent ,department of ,defense bug bounty programs2 7,f7 develop a process by which an approved individual1 organization1 or company can-- 7i7 register with entities referred to in subparagraph 7,b72 7ii7 submit to a background check1 as determined by the ,department2 and 7iii7 receive a determination as to eligibility for participation in the pilot program2 7,g7 engage qualified interested persons1 including nongovernmental sector representatives1 about the structure of the pilot program1 as constructive and to the extent practicable2 and 7,h7 consult with relevant ,united ,states ,government officials to ensure that the pilot program complements persistent network and vulnerability scans of the ,department's ,internet-accessible systems1 such as the scans conducted pursuant to ,binding ,operational ,directive #ae-ja1 issued by the ,secretary of ,homeland ,security on ,may #ba1 #bjae4 7#c7 ,duration ,the pilot program established under paragraph 7#a7 should be terminated not later than #a year after the date on which it is established4 7b7 ,report ,not later than #ahj days after the completion of the ,bug ,bounty ,pilot ,program under subsection 7a71 the ,secretary shall submit a report to the ,committee on ,foreign ,relations of the ,senate and the ,committee on ,foreign ,affairs of the ,house of ,representatives that describes the pilot program1 including information regarding-- 7#a7 the number of approved individuals1 organizations1 or companies involved in the pilot program1 broken down by-- 7,a7 the number of approved individuals1 organizations1 or companies that registered for the pilot program2 7,b7 the number of such entities that were approved to participate in the pilot program2 7,c7 the number of such entities that submitted security vulnerabilities under the pilot program2 and 7,d7 the number of such entities that received compensation under the pilot program2 7#b7 the number and severity1 in accordance with the ,national ,vulnerabilities ,database of the ,national ,institute of ,standards and ,technology1 of security vulnerabilities reported under the pilot program2 7#c7 the number of previously unidentified security vulnerabilities remediated as a result of the pilot program2 7#d7 the current number of outstanding previously unidentified security vulnerabilities and the ,department's plans for remediating such vulnerabilities2 7#e7 the average period between the reporting of security vulnerabilities and the remediation of such vulnerabilities2 7#f7 the types of compensation provided under the pilot program2 and 7#g7 the lessons learned from the pilot program4