f,i #aahth ,,congress #b;d ,session ,h4 ,r4 #gddg ,,in ,,the ,,house ,,of ,,representatives ,february #bc1 #bjbd,ms4 ,spanberger 7for herself and ,mr4 ,valadao7 introduced the following bill2 which was referred to the ,committee on ,house ,administration1 and in addition to the ,committee on ,science1 ,space1 and ,technology1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to amend the ,help ,america ,vote ,act of #bjjb to require the ,election ,assistance ,commission to provide for the conduct of penetration testing as part of the testing and certification of voting systems and to provide for the establishment of an ,independent ,security ,testing and ,coordinated ,vulnerability ,disclosure ,pilot ,program for ,election ,systems4 #a4 ,short title ,this ,act may be cited as the ,strengthening ,election ,cybersecurity to ,uphold ,respect for ,elections through ,independent ,testing ,act or the ,,secure ,,it ,act4 #b4 ,requiring penetration testing as part of the testing and certification of voting systems ,section #bca of the ,help ,america ,vote ,act of #bjjb 7#eb ,u4,s4,c4 #bjiga7 is amended by adding at the end the following new subsection3 7e7 ,required penetration testing 7#a7 ,in general ,not later than #ahj days after the date of the enactment of this subsection1 the ,commission shall provide for the conduct of penetration testing as part of the testing1 certification1 decertification1 and recertification of voting system hardware and software by accredited laboratories under this section4 7#b7 ,accreditation ,the ,director of the ,national ,institute of ,standards and ,technology shall recommend to the ,commission entities the ,director proposes be accredited to carry out penetration testing under this subsection and certify compliance with the penetration testing-related guidelines required by this subsection4 ,the ,commission shall vote on the accreditation of any entity recommended4 ,the requirements for such accreditation shall be a subset of the requirements for accreditation of laboratories under subsection 7b7 and shall only be based on consideration of an entity's competence to conduct penetration testing under this subsection4 4 #c4 ,independent security testing and coordinated cybersecurity vulnerability disclosure program for election systems 7a7 ,in general ,subtitle ,d of title ,,ii of the ,help ,america ,vote ,act of #bjjb 7#db ,u4,s4,c4 #aedja et seq47 is amended by adding at the end the following new part3 #g ,independent security testing and coordinated cybersecurity vulnerability disclosure pilot program for election systems #big4 ,independent security testing and coordinated cybersecurity vulnerability disclosure pilot program for election systems 7a7 ,establishment ,the ,commission1 in consultation with the ,secretary1 shall establish an ,independent ,security ,testing and ,coordinated ,vulnerability ,disclosure ,pilot ,program for ,election ,systems 7,,vdp-,e7 7in this section referred to as the program7 in order to test for and disclose cybersecurity vulnerabilities in election systems4 7b7 ,duration ,the program shall be conducted for a period of #e years4 7c7 ,requirements ,in carrying out the program1 the ,commission1 in consultation with the ,secretary1 shall-- 7#a7 establish a mechanism by which an election systems vendor may make their election system 7including voting machines and source code7 available to cybersecurity researchers participating in the program2 7#b7 provide for the vetting of cybersecurity researchers prior to their participation in the program1 including the conduct of background checks2 7#c7 establish terms of participation that-- 7,a7 describe the scope of testing permitted under the program2 7,b7 require researchers to-- 7i7 notify the vendor1 the ,commission1 and the ,secretary of any cybersecurity vulnerability they identify with respect to an election system2 and 7ii7 otherwise keep such vulnerability confidential for #ahj days after such notification2 7,c7 require the good faith participation of all participants in the program2 and 7,d7 require an election system vendor1 after receiving notification of a critical or high vulnerability 7as defined by the ,national ,institute of ,standards and ,technology7 in an election system of the vendor1 to-- 7i7 send a patch or propound some other fix or mitigation for such vulnerability to the appropriate ,state and local election officials1 in consultation with the researcher who discovered it2 and 7ii7 notify the ,commission and the ,secretary that such patch has been sent to such officials2 7#d7 in the case where a patch or fix to address a vulnerability disclosed under paragraph 7#c77;,b77i7 is intended to be applied to a system certified by the ,commission1 provide-- 7,a7 for the expedited review of such patch or fix within #ij days after receipt by the ,commission2 and 7,b7 if such review is not completed by the last day of such #ij-;day period1 that such patch or fix shall be deemed to be certified by the ,commission2 and 7#e7 #ahj days after the disclosure of a vulnerability under paragraph 7#c77;,b77i71 notify the ,director of the ,cybersecurity and ,infrastructure ,security ,agency of the vulnerability for inclusion in the database of ,common ,vulnerabilities and ,exposures4 7d7 ,voluntary participation2 safe harbor 7#a7 ,voluntary participation ,participation in the program shall be voluntary for election systems vendors and researchers4 7#b7 ,safe harbor ,research conducted under the program1 and any subsequent publication of such research1 shall be treated as follows3 7,a7 ,the research and publication shall be treated as authorized in accordance with section #ajcj of title #ah1 ,united ,states ,code 7commonly known as the ,computer ,fraud and ,abuse ,act71 7and similar ,state laws71 and the election system vendor will not initiate or support legal action against the researcher for accidental1 good faith violations of the program4 7,b7 ,the research and publication shall be exempt from the anti-circumvention rule of section #abja of title #ag1 ,united ,states ,code 7commonly known as the ,digital ,millennium ,copyright ,act71 and the election system vendor will not bring a claim against a researcher for circumvention of technology controls4 7#c7 ,rule of construction ,nothing in this subsection may be construed to limit or otherwise affect any exception to the general prohibition against the circumvention of technological measures under subparagraph 7,a7 of section #abja7;a77#a7 of title #ag1 ,united ,states ,code1 including with respect to any use that is excepted from that general prohibition by the ,librarian of ,congress under subparagraphs 7,b7 through 7,d7 of such section #abja7;a77#a74 7#d7 ,exempt from disclosure ,cybersecurity vulnerabilities discovered under the program shall be exempt from section #eeb of title #e1 ,united ,states ,code 7commonly referred to as the ,freedom of ,information ,act74 7e7 ,definitions ,in this section3 7#a7 ,cybersecurity vulnerability ,the term cybersecurity vulnerability means1 with respect to an election system1 any security vulnerability that affects the election system4 7#b7 ,election infrastructure ,the term election infrastructure means-- 7,a7 storage facilities1 polling places1 and centralized vote tabulation locations used to support the administration of elections for public office2 and 7,b7 related information and communications technology1 including-- 7i7 voter registration databases2 7ii7 election management systems2 7iii7 voting machines2 7iv7 electronic mail and other communications systems 7including electronic mail and other systems of vendors who have entered into contracts with election agencies to support the administration of elections1 manage the election process1 and report and display election results72 and 7v7 other systems used to manage the election process and to report and display election results on behalf of an election agency4 7#c7 ,election system ,the term election system means any information system that is part of an election infrastructure1 including any related information and communications technology described in paragraph 7#b77;,b74 7#d7 ,election system vendor ,the term election system vendor means any person providing1 supporting1 or maintaining an election system on behalf of a ,state or local election official4 7#e7 ,information system ,the term information system has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#f7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security4 7#g7 ,security vulnerability ,the term security vulnerability has the meaning given the term in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja74 4 7b7 ,clerical amendment ,the table of contents of such ,act is amended by adding at the end of the items relating to subtitle ,d of title ,,ii the following3 ,,part #g--;,independent security testing and coordinated cybersecurity vulnerability disclosure program for election systems ,sec4 #big4 ,independent security testing and coordinated cybersecurity vulnerability disclosure program for election systems4 4