,,ii #aaith ,,congress #b;d ,session ,s4 #cidi ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,february #bf1 #bjbf,mr4 ,wyden 7for himself1 ,mr4 ,fetterman1 and ,mr4 ,cassidy7 introduced the following bill2 which was read twice and referred to the ,committee on ,agriculture1 ,nutrition1 and ,forestry ,a ,,bill ,to amend the ,food and ,nutrition ,act of #bjjh to require the promulgation of cybersecurity and digital service regulations relating to the use of ,,ebt cards under the supplemental nutrition assistance program1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,enhanced ,cybersecurity for ,,snap ,act of #bjbf4 #b4 ,enhanced cybersecurity for ,,ebt cards ,section #g7;h7 of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjaf7;h77 is amended by adding at the end the following3 7#ae7 ,cybersecurity of ,,ebt cards 7,a7 ,definitions ,in this paragraph3 7i7 ,chip-enabled 7,i7 ,in general ,the term chip-enabled1 with respect to a payment card1 means a payment card that uses industry standard secure payment technology1 as identified by the ,administrator of the ,food and ,nutrition ,service in consultation with the ,secretary of the ,treasury and the ,director of the ,national ,institute of ,standards and ,technology1 that-- 7aa7 provides for secure card-based payment2 and 7bb7 is resistant to cloning4 7,,ii7 ,chip card technology ,the ,administrator of the ,food and ,nutrition ,service1 in consultation with the ,secretary of the ,treasury and the ,accredited ,standards ,committee ,x#i1 shall consider whether the secure payment technology described in subclause 7,i7 should meet the industry standards for contact and contactless payments4 7ii7 ,mobile friendly ,the term #8mobile friendly' has the meaning given the term in section #ceei7;b7 of title #dd1 ,united ,states ,code4 7iii7 ,,nist ,,pin and password standards ,the term ,,nist ,,pin and password standards means the ,,pin and password standards described in ,special ,publication #hjj-fc;,b entitled ,digital ,identity ,guidelines 7or a successor document7 of the ,national ,institute of ,standards and ,technology4 7iv7 ,,pin ,the term ,,pin has the meaning given the term personal identification number 7,,pin7 in section #bga4b of title #g1 ,code of ,federal ,regulations 7or successor regulations74 7,b7 ,regulations 7i7 ,in general ,not later than #b years after the date of enactment of this paragraph1 the ,secretary shall promulgate1 and every #e years thereafter1 the ,secretary shall review and update as necessary1 cybersecurity and digital service regulations relating to ,,ebt cards and mobile technologies under the supplemental nutrition assistance program1 including1 at a minimum1 to ensure that cybersecurity measures for ,,ebt cards and mobile technologies keep pace with security safeguards used by the private sector and required by ,federal agencies for credit1 debit1 and other payment cards and mobile technologies4 7ii7 ,requirements ,the ,secretary shall ensure that the cybersecurity and digital service regulations described in clause 7i7 require the following3 7,i7 7aa7 ,each ,state shall operate the user interfaces listed on the list of required user interfaces maintained by the ,secretary under item 7dd77,,aa71 in accordance with this subclause1 #a or more user interfaces of which households in the ,state may1 at the election of the applicable household1 use to manage the ,,ebt account of the applicable household4 7bb7 7,,aa7 ,a ,state may operate other user interfaces under item 7aa7 in addition to the required user interfaces on the list maintained by the ,secretary under item 7dd77,,aa74 7,,bb7 ,any web-based online portal operated by a ,state as a user interface shall be mobile friendly4 7cc7 ,each user interface offered by a ,state under items 7aa7 and 7bb71 as applicable1 shall-- 7,,aa7 provide information in each language in which the ,state agency is required to make material available pursuant to section #bgb4d7;b7 of title #g1 ,code of ,federal ,regulations 7or successor regulations72 7,,bb7 be available to households at least #ii percent of the time2 and 7,,cc7 include any other features required by the ,secretary4 7dd7 7,,aa7 ,the ,secretary shall maintain a list of required user interfaces for purposes of item 7aa71 which may include a web-based online portal and a mobile application4 7,,bb7 ,the list under subitem 7,,aa7 shall include an application programming interface through which at least #a user interface offered by a ,state under item 7aa7 allows households to delegate access to some or all account features identified by the ,secretary to third-party provided software4 ,no fee shall be charged to any party for the use of that application programming interface4 7,,cc7 ,during the #aj-year period following the date on which the regulations promulgated pursuant to clause 7i7 become final1 unless the ,secretary extends that period1 the ,secretary shall maintain on the list under subitem 7,,aa7 the following user interfaces3 text message1 voice telephone service1 and a nondigital user interface that does not require the use of a phone or computer by the household4 7,,ii7 7aa7 ,each ,state shall provide households on an opt-in basis-- 7,,aa7 through each digital user interface offered under subclause 7,i71 timely electronic notice of transactions using the ,,ebt account of the household2 and 7,,bb7 through each user interface offered under subclause 7,i71 access to1 including the ability to search1 historical transactions for not less than the preceding #ab months4 7bb7 ,transaction information under subitems 7,,aa7 and 7,,bb7 of item 7aa7 shall include the amount of the transaction1 the merchant for the transaction1 the city and ,state of the merchant for an in-person transaction1 and the delivery address or collection address for an online transaction4 7cc7 ,each ,state shall offer households the ability1 through each user interface offered under subclause 7,i71 to report a fraudulent transaction to the ,state4 7dd7 ,a ,state shall not require a household to respond to or acknowledge a notice of transaction delivered pursuant to item 7aa77,,aa74 7ee7 ,a ,state shall notify any household that has reported an instance of ,,ebt card skimming or fraud1 or is otherwise identified as being a victim of ,,ebt card skimming or fraud1 of any ,state or ,federal funds that may be reimbursed if the household experiences fraud again4 7,,iii7 ,each ,state shall provide households issued an ,,ebt card the ability1 through each user interface offered under subclause 7,i7 to check the enrollment status of the household1 including the date on which the household is required to apply for recertification4 7,,iv7 ,not later than #b years after the date on which the regulations promulgated pursuant to clause 7i7 become final1 ,states shall begin issuing chip-enabled ,,ebt cards4 7,v7 ,not later than #d years after the date on which the regulations promulgated pursuant to clause 7i7 become final1 ,states may not issue new ,,ebt cards with magnetic stripes4 7,,vi7 ,not later than #e years after the date on which the regulations promulgated pursuant to clause 7i7 become final1 ,states shall be required to reissue any existing valid ,,ebt cards with magnetic stripes as chip-enabled ,,ebt cards without magnetic stripes4 7,,vii7 ,in the case of a chip-enabled ,,ebt card reissued pursuant to any of subclauses 7,,iv7 through 7,,vi71 absent suspicion of fraud1 as applicable1 a ,state shall-- 7aa7 reissue a new chip-enabled ,,ebt card2 and 7bb7 deactivate the current chip-enabled ,,ebt card on the date that is the earlier of-- 7,,aa7 the date on which the new chip-enabled ,,ebt card is activated2 and 7,,bb7 #fj days after the date on which the new chip-enabled ,,ebt card is sent to the household4 7iii7 ,sunset for requirement to use chip technology ,under the cybersecurity regulations described in clause 7i71 all ,,ebt cards1 except ,,ebt cards issued to victims of a disaster pursuant to section #e7;h7 or solely for benefits under the summer electronic benefits transfer for children program established under section #ac;,a of the ,richard ,b4 ,russell ,national ,school ,lunch ,act 7#db ,u4,s4,c4 #agfb71 issued during the #e-year period following the deadline for carrying out clause 7ii77,,vi7 shall be chip-enabled1 unless the ,secretary extends that period4 7iv7 ,rule of construction ,the cybersecurity and digital service regulations described in clause 7i7 shall supersede any regulations promulgated under paragraph 7#b7 of section #eja7;a7 of division ,,hh of the ,consolidated ,appropriations ,act1 #bjbc 7#g ,u4,s4,c4 #bjaf;a7a77 7as in effect on the day before the date of enactment of the ,enhanced ,cybersecurity for ,,snap ,act of #bjbf74 7,c7 ,reimbursements ,each ,state upgrading ,,ebt cards to comply with the regulations promulgated under subparagraph 7,b77i7 shall receive reimbursement from the ,secretary in an amount determined by the ,secretary to cover all reasonable costs incurred by the ,state1 including-- 7i7 the #a-time up-front costs paid by the ,state to card vendors2 7ii7 the additional annual fees associated with chip-enabled cards paid by ,states to card vendors2 and 7iii7 postage or other delivery-related costs4 7,d7 ,prohibition on password and ,,pin requirements inconsistent with ,federal cybersecurity standards ,beginning #fj days after the date of enactment of this paragraph1 a ,state agency may not require1 with respect to a ,,pin for use of an ,,ebt card or a password for access to an online account or mobile application managing the ,,ebt card-- 7i7 that the ,,pin or password be periodically changed in circumstances that are prohibited by the ,,nist ,,pin and password standards2 or 7ii7 that the password meet complexity requirements that are prohibited by the ,,nist ,,pin and password standards4 7,e7 ,grant program for chip-enabled ,,ebt cards 7i7 ,definitions ,in this subparagraph3 7,i7 ,administering entity ,the term administering entity means an entity awarded a grant under clause 7ii7 to provide subgrants to eligible entities4 7,,ii7 ,eligible entity ,the term eligible entity means-- 7aa7 an entity described in paragraph 7#a7 or 7#c7 of section #c7o7 that-- 7,,aa7 is authorized to participate in the supplemental nutrition assistance program under section #i2 7,,bb7 does not have payment terminals that accept chip-enabled ,,ebt cards2 and 7,,cc7 is located in an area with limited grocery access1 as determined by the ,secretary2 and 7bb7 an entity described in paragraph 7#b71 7#d71 or 7#e7 of section #c7o7 that meets the requirements described in subitems 7,,aa7 and 7,,bb7 of item 7aa74 7ii7 ,grants ,the ,secretary shall establish a grant program to award a grant to an administering entity to provide subgrants to eligible entities to upgrade to chip-compatible payment terminals that support contact and contactless payment card technology4 7,f7 ,data collection ,the ,secretary shall-- 7i7 collect1 and publish on the website of the ,department of ,agriculture1 data on-- 7,i7 the length of time each user interface offered by each ,state pursuant to subparagraph 7,b77ii77,i7 was unavailable for use1 including due to technical problems or maintenance needs2 and 7,,ii7 cybersecurity measures adopted for ,,ebt cards in each ,state2 and 7ii7 maintain and annually update the data collected under clause 7i7 to support ,states in implementing any regulations promulgated pursuant to subparagraph 7,b77i74 7,g7 ,public report 7i7 ,in general ,not later than #a year after the date of enactment of this paragraph1 and every #b years thereafter1 the ,secretary shall submit to the ,committees on ,appropriations and ,agriculture1 ,nutrition1 and ,forestry of the ,senate and the ,committees on ,appropriations and ,agriculture of the ,house of ,representatives1 and make publicly available on the website of the ,department of ,agriculture1 a report that-- 7,i7 identifies trends relating to the theft of benefits1 including the frequency of theft of benefits1 the locations at which ,,ebt cards are compromised1 and the method by which ,,ebt cards are compromised2 7,,ii7 evaluates the effectiveness of existing cybersecurity regulations for the supplemental nutrition assistance program1 including identifying ineffective measures and the compliance burden borne by individual benefit recipients2 7,,iii7 describes the efforts of ,states-- 7aa7 to update cybersecurity measures for ,,ebt cards2 and 7bb7 to reimburse stolen benefits2 and 7,,iv7 examines usability issues of ,,ebt cards1 including issues that present barriers to households using benefits or affect fraud prevention goals4 7ii7 ,restricted annex ,the report under clause 7i7 may include a nonpublicly available annex containing classified or law enforcement-sensitive information and any identifying merchant information4 4 #c4 ,online transaction security ,section #g7;h7 of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjaf7;h77 7as amended by section #b7 is amended by adding at the end the following3 7#af7 ,online transaction security 7,a7 ,in general ,in promulgating and updating1 as necessary1 the regulations under paragraph 7#ae77;,b77i71 the ,secretary shall1 with respect to online transactions using ,,ebt cards 7or any successor financial product used for a substantially similar purpose7-- 7i7 require security measures that-- 7,i7 are effective in detecting and preventing theft of benefits through online transactions1 including the theft of data from online merchants that may compromise the ability of a household to use benefits in transactions with other merchants1 either online or in-person2 and 7,,ii7 prevent sensitive data from being stolen during online transactions and securely manage sensitive data generated by online transactions1 including through cybersecurity enhancements for online retailers2 7ii7 establish standard reporting methods for ,states to collect and share data with the ,secretary on the scope of benefits and data being stolen through online transactions2 and 7iii7 in carrying out clauses 7i7 and 7ii71 take into consideration the feasibility of cost1 availability1 and implementation for ,states4 7,b7 ,consultation ,in carrying out subparagraph 7,a71 the ,secretary shall consult with the ,director of the ,administration for ,children and ,families1 the ,attorney ,general of the ,united ,states1 ,state agencies1 retail food stores1 and ,,ebt contractors-- 7i7 on the measures1 methods1 and considerations under that subparagraph2 and 7ii7 to determine-- 7,i7 how benefits are being stolen and sensitive data is being compromised through online transactions2 and 7,,ii7 how those stolen benefits and data are being used4 7,c7 ,report 7i7 ,in general ,not later than #c years after the date of enactment of this paragraph1 and every #b years thereafter1 the ,secretary shall submit to the ,committee on ,agriculture1 ,nutrition1 and ,forestry of the ,senate and the ,committee on ,agriculture of the ,house of ,representatives a report that includes-- 7,i7 to the maximum extent practicable1 information on the frequency of theft of benefits1 the number of reported thefts from online transactions1 the amount of benefits stolen through online transactions1 and the online retailers most commonly compromised2 7,,ii7 a description of the measures and methods developed1 and considerations taken1 under subparagraph 7,a72 7,,iii7 the determinations made under subparagraph 7,b77ii72 and 7,,iv7 recommendations on how to consistently detect1 track1 report1 and prevent theft of benefits1 including the theft of data described in subparagraph 7,a77i77,i74 7ii7 ,confidential annex ,the report under clause 7i7 may include a nonpublicly available confidential annex containing any identifying merchant information4 4 #d4 ,ensuring no loss of access to benefits due to ,,ebt card damage1 loss1 or fraud ,section #g7;h77#g7 of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjaf7;h77#g77 is amended-- 7#a7 by striking ,regulations and inserting the following3 7,a7 ,in general ,regulations 2 and 7#b7 by adding at the end the following3 7,b7 ,ensuring no loss of access to benefits due to ,,ebt card damage1 loss1 or fraud ,not later than #ahj days after the date of enactment of the ,enhanced ,cybersecurity for ,,snap ,act of #bjbf1 the ,secretary shall promulgate regulations requiring the following3 7i7 ,if an ,,ebt card is damaged1 no longer functions properly1 is stolen1 or is frozen due to fraud1 the applicable ,state shall take the necessary steps to ensure that the household receives a replacement card1 either by mail or in person1 as selected by the household1 not later than #c business days after the household submits to the ,state a request for a replacement ,,ebt card4 7ii7 ,a ,state shall not require1 but shall offer as an option1 in-person collection of a new or replacement ,,ebt card4 4 #e4 ,no replacement fees for certain ,,ebt cards ,section #g7;h77#h77;,a7 of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjaf7;h77#h77;,a77 is amended-- 7#a7 by striking ,a ,state agency and inserting the following3 7i7 ,in general ,except as provided in clause 7ii71 a ,state agency 2 and 7#b7 by adding at the end the following3 7ii7 ,exceptions ,beginning #fj days after the date of enactment of the ,enhanced ,cybersecurity for ,,snap ,act of #bjbf1 a ,state agency may not collect a charge under clause 7i7 if the replacement of the ,,ebt card is due to-- 7,i7 the ,,ebt card malfunctioning2 7,,ii7 suspected or reported fraud relating to that ,,ebt card by an individual outside of the household to which the ,,ebt card belongs2 7,,iii7 the expiration of the ,,ebt card2 or 7,,iv7 required replacement of the ,,ebt card in compliance with regulations promulgated pursuant to paragraph 7#ae77;,b74 4 #f4 ,requirement for retailer use of chip-enabled payment terminals as a condition of ,,snap participation ,section #i7;a7 of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjah7;a77 is amended-- 7#a7 in paragraph 7#b7-- 7,a7 by striking 7#b7 ,the ,secretary and inserting the following3 7#b7 ,regulations ,the ,secretary 2 and 7,b7 by indenting the margins of subparagraphs 7,a7 and 7,b7 appropriately2 7#b7 by indenting the margin of paragraph 7#c7 appropriately2 and 7#c7 by adding at the end the following3 7#e7 ,chip-enabled payment terminals ,beginning not later than #ahj days after the date on which the regulations promulgated pursuant to section #g7;h77#ae77;,b77i7 become final1 the ,secretary shall require retail food stores and wholesale food concerns seeking authorization or reauthorization to accept and redeem benefits under the supplemental nutrition assistance program to have a chip-enabled 7as defined in section #g7;h77#ae77;,a77 payment terminal at each retail location of the retail food store or wholesale food concern4 4 #g4 ,report on ,,ebt cards issued in ,puerto ,rico 7a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary of ,agriculture shall submit to the ,committees on ,appropriations and ,agriculture1 ,nutrition1 and ,forestry of the ,senate and the ,committees on ,appropriations and ,agriculture of the ,house of ,representatives1 and make publicly available on the website of the ,department of ,agriculture1 a report on the security of ,,ebt cards 7as defined in section #c of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjab77 issued in the ,commonwealth of ,puerto ,rico1 including-- 7#a7 the resistance of those ,,ebt cards to cloning2 and 7#b7 if appropriate1 recommendations for improving the security of the electronic benefit transfer system against ,,ebt card cloning-based fraud4 7b7 ,restricted annex ,the report under subsection 7a7 may include a nonpublicly available annex containing classified or law enforcement-sensitive information4 #h4 ,conforming amendments ,section #eja of division ,,hh of the ,consolidated ,appropriations ,act1 #bjbc 7#g ,u4,s4,c4 #bjaf;a71 is amended-- 7#a7 in subsection 7a7-- 7,a7 by striking paragraphs 7#a7 and 7#b72 7,b7 by redesignating paragraphs 7#c7 through 7#e7 as paragraphs 7#a7 through 7#c71 respectively2 and 7,c7 in paragraph 7#c7 7as so redesignated7-- 7i7 in subparagraph 7,b71 by adding and at the end2 7ii7 by striking subparagraph 7,c72 and 7iii7 by redesignating subparagraph 7,d7 as subparagraph 7,c72 and 7#b7 in subsection 7b7-- 7,a7 in paragraph 7#a7-- 7i7 in subparagraph 7,a77vi71 by striking measures and all that follows through 7a77#a7 and inserting measures2 7ii7 in subparagraph 7,b71 by adding and at the end2 7iii7 in subparagraph 7,c71 by striking and at the end2 and 7iv7 by striking subparagraph 7,d72 and 7,b7 in paragraph 7#c71 by striking subsection 7a77#c7 and inserting subsection 7a77#a74