115 HR 6435 IH: Election Vendor Security Act U.S. House of Representatives 2018-07-18 text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.

I115th CONGRESS2d SessionH. R. 6435IN THE HOUSE OF REPRESENTATIVESJuly 18, 2018Mr. Raskin (for himself, Mr. Hoyer, Mr. Sarbanes, Mr. Brady of Pennsylvania, Ms. Lofgren, Mr. Cummings, Mr. Ruppersberger, Mr. Brown of Maryland, and Ms. Meng) introduced the following bill; which was referred to the Committee on House AdministrationA BILLTo amend the Help America Vote Act of 2002 to prohibit States from entering into agreements with vendors for the provision, support, or maintenance of election systems if the vendors are owned or controlled by persons who are not citizens, nationals, or permanent residents of the United States or do not meet cybersecurity best practices, and for other purposes.

1.

Short title

This Act may be cited as the Election Vendor Security Act.

2.

Prohibiting agreements with vendors for operation of election systems who are foreign nationals or who fail to meet cybersecurity best practices

(a)

Prohibition

Title III of the Help America Vote Act of 2002 (52 U.S.C. 21083 et seq.) is amended— (1)by redesignating sections 304 and 305 as sections 305 and 306; and (2)by inserting after section 303 the following new section:

304.

Requirements for vendors of election systems

(a)

Prohibiting agreements with vendors failing To meet requirements

A State, unit of local government, or any component of a State or unit of local government which is responsible for the administration of an election for Federal office may not enter into an agreement with a vendor to provide, support, or maintain any component of the election system unless the vendor meets the criteria described in subsection (b). (b)

Criteria for vendors

The criteria described in this subsection with respect to a vendor are as follows, as established and published by the Chair of the Commission in coordination with the Secretary of Homeland Security: (1)The vendor shall certify that it is owned and controlled by a citizen, national, or permanent resident of the United States, and that none of its activities are directed, supervised, controlled, subsidized, or financed, and none of its policies are determined by, any foreign principal (as defined in section 1(b) of the Foreign Agents Registration Act of 1938 (22 U.S.C. 611(b)), or by any agent of a foreign principal required to register under such Act. (2)The vendor shall disclose to the Chair and the Secretary, and to the chief State election official of any State in which the vendor provides, supports, or maintains any component of an election system, any sourcing outside the United States for parts of the system. (3)The vendor shall ensure that the election system will be developed and maintained in a manner that is consistent with the cybersecurity best practices established under subsection (c). (4)The vendor shall maintain its information technology infrastructure in a manner that is consistent with the cybersecurity best practices established under subsection (c). (5)The vendor shall report any known or suspected security incidents involving election systems to the chief State election official of the State involved or the official’s designee, the Chair, and the Secretary not later than 10 days after the vendor first knows or suspects that the incident occurred. (c)

Cybersecurity best practices

Not later than 90 days after the date of the enactment of this section, the Chair and the Secretary of Homeland Security shall establish and publish cybersecurity best practices for vendors who provide, support, or maintain election systems, and shall establish and publish updates to such best practices at such times as the Chair and the Secretary consider appropriate. (d)

Availability of list of participating vendors

(1)

Submission of list to Commission

Not later than 90 days before the date of each regularly scheduled general election for Federal office (beginning with the election held in November 2018), each State shall submit to the Commission a list of all vendors who will be providing, supporting, or maintaining any component of any election system which will be used to carry out such election in the State. (2)

Posting by Commission

Upon receiving a list from a State under paragraph (1), the Commission shall post the list on the official public website of the Commission. (e)

Election system defined

In this section, the term election system means any system used in the administration of elections for Federal office, as well as related information and communications technology, including voter registration databases, voting machines, electronic mail and other communications systems (including electronic mail and other systems of vendors who have entered into contracts with election agencies to support the administration of elections, manage the election process, and report and display election results), and other systems used to manage the election process and to report and display election results on behalf of a State or unit of local government.

. (b)

Conforming amendment relating to enforcement

Section 401 of such Act (52 U.S.C. 21111) is amended by striking and 303 and inserting 303, and 304. (c)

Clerical amendments

The table of contents of such Act is amended— (1)by redesignating the items relating to sections 304 and 305 as relating to sections 305 and 306; and (2)by inserting after the item relating to section 303 the following new item: Sec. 304. Requirements for vendors of election systems.. (d)

Effective date

The amendments made by this section shall apply with respect to the regularly scheduled general election for Federal office held in November 2018 and each succeeding election for Federal office.