,i #aagth ,,congress #ast ,session ,h4 ,r4 #ccac ,,in ,,the ,,house ,,of ,,representatives ,may #ah1 #bjba,mr4 ,lieu 7for himself1 ,ms4 ,spanberger1 ,mr4 ,pfluger1 and ,ms4 ,tenney7 introduced the following bill2 which was referred to the ,committee on ,foreign ,affairs ,a ,,bill ,to require the ,secretary of ,state to design and establish a ,vulnerability ,disclosure ,process 7,,vdp7 to improve ,department of ,state cybersecurity and a bug bounty program to identify and report vulnerabilities of internet-facing information technology of the ,department of ,state1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,hack ,your ,state ,department ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,bug bounty program ,the term bug bounty program means a program under which an approved individual1 organization1 or company is temporarily authorized to identify and report vulnerabilities of internet-facing information technology of the ,department in exchange for compensation4 7#b7 ,department ,the term ,department means the ,department of ,state4 7#c7 ,information technology ,the term information technology has the meaning given such term in section #aaaja of title #dj1 ,united ,states ,code4 7#d7 ,secretary ,the term ,secretary means the ,secretary of ,state4 #c4 ,department of ,state ,vulnerability ,disclosure ,process 7a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary shall design1 establish1 and make publicly known a ,vulnerability ,disclosure ,process 7,,vdp7 to improve ,department cybersecurity by-- 7#a7 providing security researchers with clear guidelines for-- 7,a7 conducting vulnerability discovery activities directed at ,department information technology2 and 7,b7 submitting discovered security vulnerabilities to the ,department2 and 7#b7 creating ,department procedures and infrastructure to receive and fix discovered vulnerabilities4 7b7 ,requirements ,in establishing the ,,vdp pursuant to paragraph 7#a71 the ,secretary shall-- 7#a7 identify which ,department information technology should be included in the process2 7#b7 determine whether the process should differentiate among and specify the types of security vulnerabilities that may be targeted2 7#c7 provide a readily available means of reporting discovered security vulnerabilities and the form in which such vulnerabilities should be reported2 7#d7 identify which ,department offices and positions will be responsible for receiving1 prioritizing1 and addressing security vulnerability disclosure reports2 7#e7 consult with the ,attorney ,general regarding how to ensure that individuals1 organizations1 and companies that comply with the requirements of the process are protected from prosecution under section #ajcj of title #ah1 ,united ,states ,code1 and similar provisions of law for specific activities authorized under the process2 7#f7 consult with the relevant offices at the ,department of ,defense that were responsible for launching the #bjaf ,vulnerability ,disclosure ,program1 ,hack the ,pentagon1 and subsequent ,department of ,defense bug bounty programs2 7#g7 engage qualified interested persons1 including nongovernmental sector representatives1 about the structure of the process as constructive and to the extent practicable2 and 7#h7 award contracts to entities1 as necessary1 to manage the process and implement the remediation of discovered security vulnerabilities4 7c7 ,annual reports ,not later than #ahj days after the establishment of the ,,vdp under subsection 7a7 and annually thereafter for the next six years1 the ,secretary of ,state shall submit to the ,committee on ,foreign ,affairs of the ,house of ,representatives and the ,committee on ,foreign ,relations of the ,senate a report on the ,,vdp1 including information relating to the following3 7#a7 ,the number and severity of all security vulnerabilities reported4 7#b7 ,the number of previously unidentified security vulnerabilities remediated as a result4 7#c7 ,the current number of outstanding previously unidentified security vulnerabilities and ,department of ,state remediation plans4 7#d7 ,the average length of time between the reporting of security vulnerabilities and remediation of such vulnerabilities4 7#e7 ,the resources1 surge staffing1 roles1 and responsibilities within the ,department used to implement the ,,vdp and complete security vulnerability remediation4 7#f7 ,any other information the ,secretary determines relevant4 #d4 ,department of ,state bug bounty pilot program 7a7 ,establishment of pilot program 7#a7 ,in general ,not later than one year after the date of the enactment of this ,act1 the ,secretary shall establish a bug bounty pilot program to minimize security vulnerabilities of internet-facing information technology of the ,department4 7#b7 ,requirements ,in establishing the pilot program described in paragraph 7#a71 the ,secretary shall-- 7,a7 provide compensation for reports of previously unidentified security vulnerabilities within the websites1 applications1 and other internet-facing information technology of the ,department that are accessible to the public2 7,b7 award contracts to entities1 as necessary1 to manage such pilot program and for executing the remediation of security vulnerabilities identified pursuant to subparagraph 7,a72 7,c7 identify which ,department information technology should be included in such pilot program2 7,d7 consult with the ,attorney ,general on how to ensure that individuals1 organizations1 or companies that comply with the requirements of such pilot program are protected from prosecution under section #ajcj of title #ah1 ,united ,states ,code1 and similar provisions of law for specific activities authorized under such pilot program2 7,e7 consult with the relevant offices at the ,department of ,defense that were responsible for launching the #bjaf ,hack the ,pentagon pilot program and subsequent ,department of ,defense bug bounty programs2 7,f7 develop a process by which an approved individual1 organization1 or company can register with the entity referred to in subparagraph 7,b71 submit to a background check as determined by the ,department1 and receive a determination as to eligibility for participation in such pilot program2 7,g7 engage qualified interested persons1 including nongovernmental sector representatives1 about the structure of such pilot program as constructive and to the extent practicable2 and 7,h7 consult with relevant ,united ,states ,government officials to ensure that such pilot program complements persistent network and vulnerability scans of the ,department of ,state's internet-accessible systems1 such as the scans conducted pursuant to ,binding ,operational ,directive ,,bod-#ai-jb or successor ,directive4 7#c7 ,duration ,the pilot program established under paragraph 7#a7 should be short-term in duration and not last longer than one year4 7b7 ,report ,not later than #ahj days after the date on which the bug bounty pilot program under subsection 7a7 is completed1 the ,secretary shall submit to the ,committee on ,foreign ,relations of the ,senate and the ,committee on ,foreign ,affairs of the ,house of ,representatives a report on such pilot program1 including information relating to-- 7#a7 the number of approved individuals1 organizations1 or companies involved in such pilot program1 broken down by the number of approved individuals1 organizations1 or companies that-- 7,a7 registered2 7,b7 were approved2 7,c7 submitted security vulnerabilities2 and 7,d7 received compensation2 7#b7 the number and severity of all security vulnerabilities reported as part of such pilot program2 7#c7 the number of previously unidentified security vulnerabilities remediated as a result of such pilot program2 7#d7 the current number of outstanding previously unidentified security vulnerabilities and ,department remediation plans2 7#e7 the average length of time between the reporting of security vulnerabilities and remediation of such vulnerabilities2 7#f7 the types of compensation provided under such pilot program2 and 7#g7 the lessons learned from such pilot program4