Us Congress 2023-2024 Regular Session

Us Congress Senate Bill SB1500 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	II
2	2	118THCONGRESS
3	3	1
4	4	STSESSION S. 1500
5	5	To amend the Help America Vote Act of 2002 to require the Election
6	6	Assistance Commission to provide for the conduct of penetration testing
7	7	as part of the testing and certification of voting systems and to provide
8	8	for the establishment of an Independent Security Testing and Coordi-
9	9	nated Vulnerability Disclosure Pilot Program for Election Systems.
10	10	IN THE SENATE OF THE UNITED STATES
11	11	MAY9, 2023
12	12	Mr. W
13	13	ARNER(for himself and Ms. COLLINS) introduced the following bill;
14	14	which was read twice and referred to the Committee on Rules and Ad-
15	15	ministration
16	16	A BILL
17	17	To amend the Help America Vote Act of 2002 to require
18	18	the Election Assistance Commission to provide for the
19	19	conduct of penetration testing as part of the testing
20	20	and certification of voting systems and to provide for
21	21	the establishment of an Independent Security Testing
22	22	and Coordinated Vulnerability Disclosure Pilot Program
23	23	for Election Systems.
24	24	Be it enacted by the Senate and House of Representa-1
25	25	tives of the United States of America in Congress assembled, 2
26	26	VerDate Sep 11 2014 22:46 May 15, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1500.IS S1500
27	27	pbinns on DSKJLVW7X2PROD with $$_JOB 2
28	28	•S 1500 IS
29	29	SECTION 1. SHORT TITLE. 1
30	30	This Act may be cited as the ‘‘Strengthening Election 2
31	31	Cybersecurity to Uphold Respect for Elections through 3
32	32	Independent Testing Act’’ or the ‘‘SECURE IT Act’’. 4
33	33	SEC. 2. REQUIRING PENETRATION TESTING AS PART OF 5
34	34	THE TESTING AND CERTIFICATION OF VOT-6
35	35	ING SYSTEMS. 7
36	36	Section 231 of the Help America Vote Act of 2002 8
37	37	(52 U.S.C. 20971) is amended by adding at the end the 9
38	38	following new subsection: 10
39	39	‘‘(e) R
40	40	EQUIREDPENETRATIONTESTING.— 11
41	41	‘‘(1) I
42	42	N GENERAL.—Not later than 180 days 12
43	43	after the date of the enactment of this subsection, 13
44	44	the Commission shall provide for the conduct of pen-14
45	45	etration testing as part of the testing, certification, 15
46	46	decertification, and recertification of voting system 16
47	47	hardware and software by accredited laboratories 17
48	48	under this section. 18
49	49	‘‘(2) A
50	50	CCREDITATION.—The Director of the 19
51	51	National Institute of Standards and Technology 20
52	52	shall recommend to the Commission entities the Di-21
53	53	rector proposes be accredited to carry out penetra-22
54	54	tion testing under this subsection and certify compli-23
55	55	ance with the penetration testing-related guidelines 24
56	56	required by this subsection. The Commission shall 25
57	57	vote on the accreditation of any entity recommended. 26
58	58	VerDate Sep 11 2014 22:46 May 15, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1500.IS S1500
59	59	pbinns on DSKJLVW7X2PROD with $$_JOB 3
60	60	•S 1500 IS
61	61	The requirements for such accreditation shall be a 1
62	62	subset of the requirements for accreditation of lab-2
63	63	oratories under subsection (b) and shall only be 3
64	64	based on consideration of an entity’s competence to 4
65	65	conduct penetration testing under this subsection.’’. 5
66	66	SEC. 3. INDEPENDENT SECURITY TESTING AND COORDI-6
67	67	NATED CYBERSECURITY VULNERABILITY 7
68	68	DISCLOSURE PROGRAM FOR ELECTION SYS-8
69	69	TEMS. 9
70	70	(a) I
71	71	NGENERAL.—Subtitle D of title II of the Help 10
72	72	America Vote Act of 2002 (42 U.S.C. 15401 et seq.) is 11
73	73	amended by adding at the end the following new part: 12
74	74	‘‘PART 7—INDEPENDENT SECURITY TESTING AND 13
75	75	COORDINATED CYBERSECURITY VULNER-14
76	76	ABILITY DISCLOSURE PILOT PROGRAM FOR 15
77	77	ELECTION SYSTEMS 16
78	78	‘‘SEC. 297. INDEPENDENT SECURITY TESTING AND COORDI-17
79	79	NATED CYBERSECURITY VULNERABILITY 18
80	80	DISCLOSURE PILOT PROGRAM FOR ELEC-19
81	81	TION SYSTEMS. 20
82	82	‘‘(a) I
83	83	NGENERAL.— 21
84	84	‘‘(1) E
85	85	STABLISHMENT.—The Commission, in 22
86	86	consultation with the Secretary, shall establish an 23
87	87	Independent Security Testing and Coordinated Vul-24
88	88	nerability Disclosure Pilot Program for Election Sys-25
89	89	VerDate Sep 11 2014 22:46 May 15, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1500.IS S1500
90	90	pbinns on DSKJLVW7X2PROD with $$_JOB 4
91	91	•S 1500 IS
92	92	tems (VDP–E) (in this section referred to as the 1
93	93	‘program’) in order to test for and disclose cyberse-2
94	94	curity vulnerabilities in election systems. 3
95	95	‘‘(2) D
96	96	URATION.—The program shall be con-4
97	97	ducted for a period of 5 years. 5
98	98	‘‘(3) R
99	99	EQUIREMENTS.—In carrying out the pro-6
100	100	gram, the Commission, in consultation with the Sec-7
101	101	retary, shall— 8
102	102	‘‘(A) establish a mechanism by which an 9
103	103	election systems vendor may make their election 10
104	104	system (including voting machines and source 11
105	105	code) available to cybersecurity researchers par-12
106	106	ticipating in the program; 13
107	107	‘‘(B) provide for the vetting of cybersecu-14
108	108	rity researchers prior to their participation in 15
109	109	the program, including the conduct of back-16
110	110	ground checks; 17
111	111	‘‘(C) establish terms of participation 18
112	112	that— 19
113	113	‘‘(i) describe the scope of testing per-20
114	114	mitted under the program; 21
115	115	‘‘(ii) require researchers to— 22
116	116	‘‘(I) notify the vendor, the Com-23
117	117	mission, and the Secretary of any cy-24
118	118	bersecurity vulnerability they identify 25
119	119	VerDate Sep 11 2014 22:46 May 15, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1500.IS S1500
120	120	pbinns on DSKJLVW7X2PROD with $$_JOB 5
121	121	•S 1500 IS
122	122	with respect to an election system; 1
123	123	and 2
124	124	‘‘(II) otherwise keep such vulner-3
125	125	ability confidential for 180 days after 4
126	126	such notification; 5
127	127	‘‘(iii) require the good faith participa-6
128	128	tion of all participants in the program; and 7
129	129	‘‘(iv) require an election system ven-8
130	130	dor, after receiving notification of a critical 9
131	131	or high vulnerability (as defined by the 10
132	132	National Institute of Standards and Tech-11
133	133	nology) in an election system of the ven-12
134	134	dor, to— 13
135	135	‘‘(I) send a patch or propound 14
136	136	some other fix or mitigation for such 15
137	137	vulnerability to the appropriate State 16
138	138	and local election officials, in con-17
139	139	sultation with the researcher who dis-18
140	140	covered it; and 19
141	141	‘‘(II) notify the Commission and 20
142	142	the Secretary that such patch has 21
143	143	been sent to such officials; 22
144	144	‘‘(D) in the case where a patch or fix to 23
145	145	address a vulnerability disclosed under subpara-24
146	146	VerDate Sep 11 2014 02:42 May 16, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1500.IS S1500
147	147	pbinns on DSKJLVW7X2PROD with $$_JOB 6
148	148	•S 1500 IS
149	149	graph (C)(ii)(I) is intended to be applied to a 1
150	150	system certified by the Commission, provide— 2
151	151	‘‘(i) for the expedited review of such 3
152	152	patch or fix within 90 days after receipt by 4
153	153	the Commission; and 5
154	154	‘‘(ii) if such review is not completed 6
155	155	by the last day of such 90 day period, that 7
156	156	such patch or fix shall be deemed to be 8
157	157	certified by the Commission; and 9
158	158	‘‘(E) 180 days after the disclosure of a 10
159	159	vulnerability under subparagraph (C)(ii)(I), no-11
160	160	tify the Director of the Cybersecurity and In-12
161	161	frastructure Security Agency of the vulner-13
162	162	ability for inclusion in the database of Common 14
163	163	Vulnerabilities and Exposures. 15
164	164	‘‘(4) V
165	165	OLUNTARY PARTICIPATION ; SAFE HAR-16
166	166	BOR.— 17
167	167	‘‘(A) V
168	168	OLUNTARY PARTICIPATION .—Par-18
169	169	ticipation in the program shall be voluntary for 19
170	170	election systems vendors and researchers. 20
171	171	‘‘(B) S
172	172	AFE HARBOR.—When conducting 21
173	173	research under this program, such research and 22
174	174	subsequent publication shall be considered to 23
175	175	be: 24
176	176	VerDate Sep 11 2014 22:46 May 15, 2023 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S1500.IS S1500
177	177	pbinns on DSKJLVW7X2PROD with $$_JOB 7
178	178	•S 1500 IS
179	179	‘‘(i) Authorized in accordance with 1
180	180	section 1030 of title 18, United States 2
181	181	Code (commonly known as the ‘Computer 3
182	182	Fraud and Abuse Act’), (and similar State 4
183	183	laws), and the election system vendor will 5
184	184	not initiate or support legal action against 6
185	185	the researcher for accidental, good faith 7
186	186	violations of the program. 8
187	187	‘‘(ii) Exempt from the anti-circumven-9
188	188	tion rule of section 1201 of title 17, United 10
189	189	States Code (commonly known as the ‘Dig-11
190	190	ital Millennium Copyright Act’), and the 12
191	191	election system vendor will not bring a 13
192	192	claim against a researcher for circumven-14
193	193	tion of technology controls. 15
194	194	‘‘(C) R
195	195	ULE OF CONSTRUCTION .—Nothing 16
196	196	in this paragraph may be construed to limit or 17
197	197	otherwise affect any exception to the general 18
198	198	prohibition against the circumvention of techno-19
199	199	logical measures under subparagraph (A) of 20
200	200	section 1201(a)(1) of title 17, United States 21
201	201	Code, including with respect to any use that is 22
202	202	excepted from that general prohibition by the 23
203	203	Librarian of Congress under subparagraphs (B) 24
204	204	through (D) of such section 1201(a)(1). 25
205	205	VerDate Sep 11 2014 02:42 May 16, 2023 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1500.IS S1500
206	206	pbinns on DSKJLVW7X2PROD with $$_JOB 8
207	207	•S 1500 IS
208	208	‘‘(5) EXEMPT FROM DISCLOSURE .—Cybersecu-1
209	209	rity vulnerabilities discovered under the program 2
210	210	shall be exempt from section 552 of title 5, United 3
211	211	States Code (commonly referred to as the Freedom 4
212	212	of Information Act). 5
213	213	‘‘(6) D
214	214	EFINITIONS.—In this subsection: 6
215	215	‘‘(A) C
216	216	YBERSECURITY VULNERABILITY .— 7
217	217	The term ‘cybersecurity vulnerability’ means, 8
218	218	with respect to an election system, any security 9
219	219	vulnerability that affects the election system. 10
220	220	‘‘(B) E
221	221	LECTION INFRASTRUCTURE .—The 11
222	222	term ‘election infrastructure’ means— 12
223	223	‘‘(i) storage facilities, polling places, 13
224	224	and centralized vote tabulation locations 14
225	225	used to support the administration of elec-15
226	226	tions for public office; and 16
227	227	‘‘(ii) related information and commu-17
228	228	nications technology, including— 18
229	229	‘‘(I) voter registration databases; 19
230	230	‘‘(II) election management sys-20
231	231	tems; 21
232	232	‘‘(III) voting machines; 22
233	233	‘‘(IV) electronic mail and other 23
234	234	communications systems (including 24
235	235	electronic mail and other systems of 25
236	236	VerDate Sep 11 2014 22:46 May 15, 2023 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S1500.IS S1500
237	237	pbinns on DSKJLVW7X2PROD with $$_JOB 9
238	238	•S 1500 IS
239	239	vendors who have entered into con-1
240	240	tracts with election agencies to sup-2
241	241	port the administration of elections, 3
242	242	manage the election process, and re-4
243	243	port and display election results); and 5
244	244	‘‘(V) other systems used to man-6
245	245	age the election process and to report 7
246	246	and display election results on behalf 8
247	247	of an election agency. 9
248	248	‘‘(C) E
249	249	LECTION SYSTEM.—The term ‘elec-10
250	250	tion system’ means any information system that 11
251	251	is part of an election infrastructure, including 12
252	252	any related information and communications 13
253	253	technology described in subparagraph (B)(ii). 14
254	254	‘‘(D) E
255	255	LECTION SYSTEM VENDOR .—The 15
256	256	term ‘election system vendor’ means any person 16
257	257	providing, supporting, or maintaining an elec-17
258	258	tion system on behalf of a State or local elec-18
259	259	tion official. 19
260	260	‘‘(E) I
261	261	NFORMATION SYSTEM .—The term 20
262	262	‘information system’ has the meaning given the 21
263	263	term in section 3502 of title 44, United States 22
264	264	Code. 23
265	265	‘‘(F) S
266	266	ECRETARY.—The term ‘Secretary’ 24
267	267	means the Secretary of Homeland Security. 25
268	268	VerDate Sep 11 2014 22:46 May 15, 2023 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S1500.IS S1500
269	269	pbinns on DSKJLVW7X2PROD with $$_JOB 10
270	270	•S 1500 IS
271	271	‘‘(G) SECURITY VULNERABILITY .—The 1
272	272	term ‘security vulnerability’ has the meaning 2
273	273	given the term in section 102 of the Cybersecu-3
274	274	rity Information Sharing Act of 2015 (6 U.S.C. 4
275	275	1501).’’. 5
276	276	(b) C
277	277	LERICALAMENDMENT.—The table of contents 6
278	278	of such Act is amended by adding at the end of the items 7
279	279	relating to subtitle D of title II the following: 8
280	280	‘‘PART 7—INDEPENDENT SECURITYTESTING ANDCOORDINATEDCYBERSE-
281	281	CURITYVULNERABILITYDISCLOSUREPROGRAM FORELECTIONSYSTEMS
282	282	‘‘Sec. 297. Independent security testing and coordinated cybersecurity vulner-
283	283	ability disclosure program for election systems.’’.
284	284	Æ
285	285	VerDate Sep 11 2014 22:46 May 15, 2023 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6301 E:\BILLS\S1500.IS S1500
286	286	pbinns on DSKJLVW7X2PROD with $$_JOB