116th CONGRESS 1st Session |
To protect elections for public office by providing financial support and enhanced security for the infrastructure used to carry out such elections, and for other purposes.
May 10, 2019
Mr. Thompson of Mississippi (for himself, Ms. Lofgren, Mr. Sarbanes, Mr. Richmond, Mr. Raskin, Mr. Langevin, Mrs. Davis of California, Mrs. Demings, Mr. Butterfield, Ms. Jackson Lee, Ms. Fudge, Mr. Payne, Mr. Aguilar, Miss Rice of New York, Mr. Rose of New York, Ms. Underwood, Ms. Slotkin, Mr. Cleaver, Mr. Green of Texas, Ms. Clarke of New York, Mrs. Watson Coleman, Ms. Barragán, Ms. Titus, Ms. Torres Small of New Mexico, and Mr. Correa) introduced the following bill; which was referred to the Committee on House Administration, and in addition to the Committees on Homeland Security, Intelligence (Permanent Select), Science, Space, and Technology, Foreign Affairs, and the Judiciary, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned
To protect elections for public office by providing financial support and enhanced security for the infrastructure used to carry out such elections, and for other purposes.
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,
(a) Short title.—This Act may be cited as the “Election Security Act of 2019”.
(b) Table of contents.—The table of contents of this Act is as follows:
Sec. 1. Short title; table of contents.
Sec. 101. Short title.
Sec. 102. Paper ballot and manual counting requirements.
Sec. 103. Accessibility and ballot verification for individuals with disabilities.
Sec. 104. Durability and readability requirements for ballots.
Sec. 105. Paper ballot printing requirements.
Sec. 106. Study and report on optimal ballot design.
Sec. 107. Effective date for new requirements.
Sec. 111. Grants for obtaining compliant paper ballot voting systems and carrying out voting system security improvements.
“Sec. 297. Grants for obtaining compliant paper ballot voting systems and carrying out voting system security improvements.
“Sec. 297A. Voting system security improvements described.
“Sec. 297B. Eligibility of States.
“Sec. 297C. Reports to Congress.
“Sec. 297D. Authorization of appropriations.
Sec. 112. Coordination of voting system security activities with use of requirements payments and election administration requirements under Help America Vote Act of 2002.
Sec. 113. Incorporation of definitions.
Sec. 121. Grants to States for conducting risk-limiting audits of results of elections.
“Sec. 298. Grants for conducting risk-limiting audits of results of elections.
“Sec. 298A. Eligibility of States.
“Sec. 298B. Authorization of appropriations.
Sec. 122. GAO analysis of effects of audits.
Sec. 131. Election infrastructure innovation grant program.
Sec. 201. Election infrastructure designation.
Sec. 202. Timely threat information.
Sec. 203. Security clearance assistance for election officials.
Sec. 204. Security risk and vulnerability assessments.
Sec. 205. Annual reports.
Sec. 206. Pre-election threat assessments.
Sec. 301. National strategy to protect United States democratic institutions.
Sec. 302. National Commission to Protect United States Democratic Institutions.
Sec. 401. Testing of existing voting systems to ensure compliance with election cybersecurity guidelines and other guidelines.
Sec. 402. Treatment of electronic poll books as part of voting systems.
Sec. 403. Pre-election reports on voting system usage.
Sec. 404. Streamlining collection of election information.
Sec. 501. Short title.
Sec. 502. Election Security Bug Bounty Program.
Sec. 503. Definitions.
Sec. 601. Establishment of advisory committee.
Sec. 701. Use of voting machines manufactured in the United States.
Sec. 801. Definitions.
Sec. 802. Initial report on adequacy of resources available for implementation.
Sec. 901. Severability.
This subtitle may be cited as the “Voter Confidence and Increased Accessibility Act of 2019”.
(a) In general.—Section 301(a)(2) of the Help America Vote Act of 2002 (52 U.S.C. 21081(a)(2)) is amended to read as follows:
“(2) PAPER BALLOT REQUIREMENT.—
“(A) VOTER-VERIFIED PAPER BALLOTS.—
“(i) PAPER BALLOT REQUIREMENT.— (I) The voting system shall require the use of an individual, durable, voter-verified paper ballot of the voter’s vote that shall be marked and made available for inspection and verification by the voter before the voter’s vote is cast and counted, and which shall be counted by hand or read by an optical character recognition device or other counting device. For purposes of this subclause, the term ‘individual, durable, voter-verified paper ballot’ means a paper ballot marked by the voter by hand or a paper ballot marked through the use of a nontabulating ballot marking device or system, so long as the voter shall have the option to mark his or her ballot by hand.
“(II) The voting system shall provide the voter with an opportunity to correct any error on the paper ballot before the permanent voter-verified paper ballot is preserved in accordance with clause (ii).
“(III) The voting system shall not preserve the voter-verified paper ballots in any manner that makes it possible, at any time after the ballot has been cast, to associate a voter with the record of the voter’s vote without the voter’s consent.
“(ii) PRESERVATION AS OFFICIAL RECORD.—The individual, durable, voter-verified paper ballot used in accordance with clause (i) shall constitute the official ballot and shall be preserved and used as the official ballot for purposes of any recount or audit conducted with respect to any election for Federal office in which the voting system is used.
“(iii) MANUAL COUNTING REQUIREMENTS FOR RECOUNTS AND AUDITS.— (I) Each paper ballot used pursuant to clause (i) shall be suitable for a manual audit, and shall be counted by hand in any recount or audit conducted with respect to any election for Federal office.
“(II) In the event of any inconsistencies or irregularities between any electronic vote tallies and the vote tallies determined by counting by hand the individual, durable, voter-verified paper ballots used pursuant to clause (i), and subject to subparagraph (B), the individual, durable, voter-verified paper ballots shall be the true and correct record of the votes cast.
“(iv) APPLICATION TO ALL BALLOTS.—The requirements of this subparagraph shall apply to all ballots cast in elections for Federal office, including ballots cast by absent uniformed services voters and overseas voters under the Uniformed and Overseas Citizens Absentee Voting Act and other absentee voters.
“(B) SPECIAL RULE FOR TREATMENT OF DISPUTES WHEN PAPER BALLOTS HAVE BEEN SHOWN TO BE COMPROMISED.—
“(i) IN GENERAL.—In the event that—
“(I) there is any inconsistency between any electronic vote tallies and the vote tallies determined by counting by hand the individual, durable, voter-verified paper ballots used pursuant to subparagraph (A)(i) with respect to any election for Federal office; and
“(II) it is demonstrated by clear and convincing evidence (as determined in accordance with the applicable standards in the jurisdiction involved) in any recount, audit, or contest of the result of the election that the paper ballots have been compromised (by damage or mischief or otherwise) and that a sufficient number of the ballots have been so compromised that the result of the election could be changed,
the determination of the appropriate remedy with respect to the election shall be made in accordance with applicable State law, except that the electronic tally shall not be used as the exclusive basis for determining the official certified result.
“(ii) RULE FOR CONSIDERATION OF BALLOTS ASSOCIATED WITH EACH VOTING MACHINE.—For purposes of clause (i), only the paper ballots deemed compromised, if any, shall be considered in the calculation of whether or not the result of the election could be changed due to the compromised paper ballots.”.
(b) Conforming amendment clarifying applicability of alternative language accessibility.—Section 301(a)(4) of such Act (52 U.S.C. 21081(a)(4)) is amended by inserting “(including the paper ballots required to be used under paragraph (2))” after “voting system”.
(c) Other conforming amendments.—Section 301(a)(1) of such Act (52 U.S.C. 21081(a)(1)) is amended—
(1) in subparagraph (A)(i), by striking “counted” and inserting “counted, in accordance with paragraphs (2) and (3)”;
(2) in subparagraph (A)(ii), by striking “counted” and inserting “counted, in accordance with paragraphs (2) and (3)”;
(3) in subparagraph (A)(iii), by striking “counted” each place it appears and inserting “counted, in accordance with paragraphs (2) and (3)”; and
(4) in subparagraph (B)(ii), by striking “counted” and inserting “counted, in accordance with paragraphs (2) and (3)”.
(a) In general.—Section 301(a)(3)(B) of the Help America Vote Act of 2002 (52 U.S.C. 21081(a)(3)(B)) is amended to read as follows:
“(B) (i) ensure that individuals with disabilities and others are given an equivalent opportunity to vote, including with privacy and independence, in a manner that produces a voter-verified paper ballot as for other voters;
“(ii) satisfy the requirement of subparagraph (A) through the use of at least one voting system equipped for individuals with disabilities, including nonvisual and enhanced visual accessibility for the blind and visually impaired, and nonmanual and enhanced manual accessibility for the mobility and dexterity impaired, at each polling place; and
“(iii) meet the requirements of subparagraph (A) and paragraph (2)(A) by using a system that—
“(I) allows the voter to privately and independently verify the permanent paper ballot through the presentation, in accessible form, of the printed or marked vote selections from the same printed or marked information that would be used for any vote counting or auditing; and
“(II) allows the voter to privately and independently verify and cast the permanent paper ballot without requiring the voter to manually handle the paper ballot;”.
(b) Specific requirement of study, testing, and development of accessible paper ballot verification mechanisms.—
(1) STUDY AND REPORTING.—Subtitle C of title II of such Act (52 U.S.C. 21081 et seq.) is amended—
(A) by redesignating section 247 as section 248; and
(B) by inserting after section 246 the following new section:
“SEC. 247. Study and report on accessible paper ballot verification mechanisms.
“(a) Study and report.—The Director of the National Science Foundation shall make grants to not fewer than 3 eligible entities to study, test, and develop accessible paper ballot voting, verification, and casting mechanisms and devices and best practices to enhance the accessibility of paper ballot voting and verification mechanisms for individuals with disabilities, for voters whose primary language is not English, and for voters with difficulties in literacy, including best practices for the mechanisms themselves and the processes through which the mechanisms are used.
“(b) Eligibility.—An entity is eligible to receive a grant under this part if it submits to the Director (at such time and in such form as the Director may require) an application containing—
“(1) certifications that the entity shall specifically investigate enhanced methods or devices, including non-electronic devices, that will assist such individuals and voters in marking voter-verified paper ballots and presenting or transmitting the information printed or marked on such ballots back to such individuals and voters, and casting such ballots;
“(2) a certification that the entity shall complete the activities carried out with the grant not later than December 31, 2020; and
“(3) such other information and certifications as the Director may require.
“(c) Availability of technology.—Any technology developed with the grants made under this section shall be treated as non-proprietary and shall be made available to the public, including to manufacturers of voting systems.
“(d) Coordination with grants for technology improvements.—The Director shall carry out this section so that the activities carried out with the grants made under subsection (a) are coordinated with the research conducted under the grant program carried out by the Commission under section 271, to the extent that the Director and Commission determine necessary to provide for the advancement of accessible voting technology.
“(e) Authorization of appropriations.—There is authorized to be appropriated to carry out subsection (a) $5,000,000, to remain available until expended.”.
(2) CLERICAL AMENDMENT.—The table of contents of such Act is amended—
(A) by redesignating the item relating to section 247 as relating to section 248; and
(B) by inserting after the item relating to section 246 the following new item:
“Sec. 247. Study and report on accessible paper ballot verification mechanisms.”.
(c) Clarification of accessibility standards under voluntary voting system guidance.—In adopting any voluntary guidance under subtitle B of title III of the Help America Vote Act with respect to the accessibility of the paper ballot verification requirements for individuals with disabilities, the Election Assistance Commission shall include and apply the same accessibility standards applicable under the voluntary guidance adopted for accessible voting systems under such subtitle.
(d) Permitting use of funds for protection and advocacy systems To support actions To enforce election-Related disability access.—Section 292(a) of the Help America Vote Act of 2002 (52 U.S.C. 21062(a)) is amended by striking “; except that” and all that follows and inserting a period.
Section 301(a) of the Help America Vote Act of 2002 (52 U.S.C. 21081(a)) is amended by adding at the end the following new paragraph:
“(7) DURABILITY AND READABILITY REQUIREMENTS FOR BALLOTS.—
“(A) DURABILITY REQUIREMENTS FOR PAPER BALLOTS.—
“(i) IN GENERAL.—All voter-verified paper ballots required to be used under this Act shall be marked or printed on durable paper.
“(ii) DEFINITION.—For purposes of this Act, paper is ‘durable’ if it is capable of withstanding multiple counts and recounts by hand without compromising the fundamental integrity of the ballots, and capable of retaining the information marked or printed on them for the full duration of a retention and preservation period of 22 months.
“(B) READABILITY REQUIREMENTS FOR PAPER BALLOTS MARKED BY BALLOT MARKING DEVICE.—All voter-verified paper ballots completed by the voter through the use of a ballot marking device shall be clearly readable by the voter without assistance (other than eyeglasses or other personal vision enhancing devices) and by an optical character recognition device or other device equipped for individuals with disabilities.”.
(a) Requiring paper ballots To be printed on recycled paper manufactured in United States.—Section 301(a) of the Help America Vote Act of 2002 (52 U.S.C. 21081(a)), as amended by section 104, is amended by adding at the end the following new paragraph:
“(8) PRINTING REQUIREMENTS FOR BALLOTS.—All paper ballots used in an election for Federal office shall be printed in the United States on recycled paper manufactured in the United States.”.
(b) Effective date.—The amendment made by subsection (a) shall apply with respect to elections occurring on or after January 1, 2021.
(a) Study.—The Election Assistance Commission shall conduct a study of the best ways to design ballots used in elections for public office, including paper ballots and electronic or digital ballots, to minimize confusion and user errors.
(b) Report.—Not later than January 1, 2020, the Election Assistance Commission shall submit to Congress a report on the study conducted under subsection (a).
Section 301(d) of the Help America Vote Act of 2002 (52 U.S.C. 21081(d)) is amended to read as follows:
“(1) IN GENERAL.—Except as provided in paragraph (2), each State and jurisdiction shall be required to comply with the requirements of this section on and after January 1, 2006.
“(2) SPECIAL RULE FOR CERTAIN REQUIREMENTS.—
“(A) IN GENERAL.—Except as provided in section 105(b) of the Election Security Act of 2019 and subparagraphs (B) and (C), the requirements of this section which are first imposed on a State and jurisdiction pursuant to the amendments made by the Voter Confidence and Increased Accessibility Act of 2019 shall apply with respect to voting systems used for any election for Federal office held in 2020 or any succeeding year.
“(B) DELAY FOR JURISDICTIONS USING CERTAIN PAPER RECORD PRINTERS OR CERTAIN SYSTEMS USING OR PRODUCING VOTER-VERIFIABLE PAPER RECORDS IN 2018.—
“(i) DELAY.—In the case of a jurisdiction described in clause (ii), subparagraph (A) shall apply to a voting system in the jurisdiction as if the reference in such subparagraph to ‘2020’ were a reference to ‘2022’, but only with respect to the following requirements of this section:
“(I) Paragraph (2)(A)(i)(I) of subsection (a) (relating to the use of voter-verified paper ballots).
“(II) Paragraph (3)(B)(ii)(I) and (II) of subsection (a) (relating to access to verification from and casting of the durable paper ballot).
“(III) Paragraph (7) of subsection (a) (relating to durability and readability requirements for ballots).
“(ii) JURISDICTIONS DESCRIBED.—A jurisdiction described in this clause is a jurisdiction—
“(I) which used voter verifiable paper record printers attached to direct recording electronic voting machines, or which used other voting systems that used or produced paper records of the vote verifiable by voters but that are not in compliance with paragraphs (2)(A)(i)(I), (3)(B)(iii)(I) and (II), and (7) of subsection (a) (as amended or added by the Voter Confidence and Increased Accessibility Act of 2019), for the administration of the regularly scheduled general election for Federal office held in November 2018; and
“(II) which will continue to use such printers or systems for the administration of elections for Federal office held in years before 2022.
“(iii) MANDATORY AVAILABILITY OF PAPER BALLOTS AT POLLING PLACES USING GRANDFATHERED PRINTERS AND SYSTEMS.—
“(I) REQUIRING BALLOTS TO BE OFFERED AND PROVIDED.—The appropriate election official at each polling place that uses a printer or system described in clause (ii)(I) for the administration of elections for Federal office shall offer each individual who is eligible to cast a vote in the election at the polling place the opportunity to cast the vote using a blank pre-printed paper ballot which the individual may mark by hand and which is not produced by the direct recording electronic voting machine or other such system. The official shall provide the individual with the ballot and the supplies necessary to mark the ballot, and shall ensure (to the greatest extent practicable) that the waiting period for the individual to cast a vote is the lesser of 30 minutes or the average waiting period for an individual who does not agree to cast the vote using such a paper ballot under this clause.
“(II) TREATMENT OF BALLOT.—Any paper ballot which is cast by an individual under this clause shall be counted and otherwise treated as a regular ballot for all purposes (including by incorporating it into the final unofficial vote count (as defined by the State) for the precinct) and not as a provisional ballot, unless the individual casting the ballot would have otherwise been required to cast a provisional ballot.
“(III) POSTING OF NOTICE.—The appropriate election official shall ensure there is prominently displayed at each polling place a notice that describes the obligation of the official to offer individuals the opportunity to cast votes using a pre-printed blank paper ballot.
“(IV) TRAINING OF ELECTION OFFICIALS.—The chief State election official shall ensure that election officials at polling places in the State are aware of the requirements of this clause, including the requirement to display a notice under subclause (III), and are aware that it is a violation of the requirements of this title for an election official to fail to offer an individual the opportunity to cast a vote using a blank pre-printed paper ballot.
“(V) PERIOD OF APPLICABILITY.—The requirements of this clause apply only during the period in which the delay is in effect under clause (i).
“(C) SPECIAL RULE FOR JURISDICTIONS USING CERTAIN NONTABULATING BALLOT MARKING DEVICES.—In the case of a jurisdiction which uses a nontabulating ballot marking device which automatically deposits the ballot into a privacy sleeve, subparagraph (A) shall apply to a voting system in the jurisdiction as if the reference in such subparagraph to ‘any election for Federal office held in 2020 or any succeeding year’ were a reference to ‘elections for Federal office occurring held in 2022 or each succeeding year’, but only with respect to paragraph (3)(B)(iii)(II) of subsection (a) (relating to nonmanual casting of the durable paper ballot).”.
(a) Availability of grants.—Subtitle D of title II of the Help America Vote Act of 2002 (52 U.S.C. 21001 et seq.) is amended by adding at the end the following new part:
“(a) Availability and use of grant.—The Commission shall make a grant to each eligible State—
“(1) to replace a voting system—
“(A) which does not meet the requirements which are first imposed on the State pursuant to the amendments made by the Voter Confidence and Increased Accessibility Act of 2019 with a voting system which does meet such requirements, for use in the regularly scheduled general elections for Federal office held in November 2020, or
“(B) which does meet such requirements but which is not in compliance with the most recent voluntary voting system guidelines issued by the Commission prior to the regularly scheduled general election for Federal office held in November 2020 with another system which does meet such requirements and is in compliance with such guidelines;
“(2) to carry out voting system security improvements described in section 297A with respect to the regularly scheduled general elections for Federal office held in November 2020 and each succeeding election for Federal office; and
“(3) to implement and model best practices for ballot design, ballot instructions, and the testing of ballots.
“(b) Amount of grant.—The amount of a grant made to a State under this section shall be such amount as the Commission determines to be appropriate, except that such amount may not be less than the product of $1 and the average of the number of individuals who cast votes in any of the two most recent regularly scheduled general elections for Federal office held in the State.
“(c) Pro rata reductions.—If the amount of funds appropriated for grants under this part is insufficient to ensure that each State receives the amount of the grant calculated under subsection (b), the Commission shall make such pro rata reductions in such amounts as may be necessary to ensure that the entire amount appropriated under this part is distributed to the States.
“(d) Surplus appropriations.—If the amount of funds appropriated for grants authorized under section 297D(a)(2) exceed the amount necessary to meet the requirements of subsection (b), the Commission shall consider the following in making a determination to award remaining funds to a State:
“(1) The record of the State in carrying out the following with respect to the administration of elections for Federal office:
“(A) Providing voting machines that are less than 10 years old.
“(B) Implementing strong chain of custody procedures for the physical security of voting equipment and paper records at all stages of the process.
“(C) Conducting pre-election testing on every voting machine and ensuring that paper ballots are available wherever electronic machines are used.
“(D) Maintaining offline backups of voter registration lists.
“(E) Providing a secure voter registration database that logs requests submitted to the database.
“(F) Publishing and enforcing a policy detailing use limitations and security safeguards to protect the personal information of voters in the voter registration process.
“(G) Providing secure processes and procedures for reporting vote tallies.
“(H) Providing a secure platform for disseminating vote totals.
“(2) Evidence of established conditions of innovation and reform in providing voting system security and the proposed plan of the State for implementing additional conditions.
“(3) Evidence of collaboration between relevant stakeholders, including local election officials, in developing the grant implementation plan described in section 297B.
“(4) The plan of the State to conduct a rigorous evaluation of the effectiveness of the activities carried out with the grant.
“(e) Ability of replacement systems To administer ranked choice elections.—To the greatest extent practicable, an eligible State which receives a grant to replace a voting system under this section shall ensure that the replacement system is capable of administering a system of ranked choice voting under which each voter shall rank the candidates for the office in the order of the voter’s preference.
“(a) Permitted uses.—A voting system security improvement described in this section is any of the following:
“(1) The acquisition of goods and services from qualified election infrastructure vendors by purchase, lease, or such other arrangements as may be appropriate.
“(2) Cyber and risk mitigation training.
“(3) A security risk and vulnerability assessment of the State’s election infrastructure which is carried out by a provider of cybersecurity services under a contract entered into between the chief State election official and the provider.
“(4) The maintenance of election infrastructure, including addressing risks and vulnerabilities which are identified under either of the security risk and vulnerability assessments described in paragraph (3), except that none of the funds provided under this part may be used to renovate or replace a building or facility which is used primarily for purposes other than the administration of elections for public office.
“(5) Providing increased technical support for any information technology infrastructure that the chief State election official deems to be part of the State’s election infrastructure or designates as critical to the operation of the State’s election infrastructure.
“(6) Enhancing the cybersecurity and operations of the information technology infrastructure described in paragraph (4).
“(7) Enhancing the cybersecurity of voter registration systems.
“(b) Qualified election infrastructure vendors described.—
“(1) IN GENERAL.—For purposes of this part, a ‘qualified election infrastructure vendor’ is any person who provides, supports, or maintains, or who seeks to provide, support, or maintain, election infrastructure on behalf of a State, unit of local government, or election agency (as defined in section 801 of the Election Security Act) who meets the criteria described in paragraph (2).
“(2) CRITERIA.—The criteria described in this paragraph are such criteria as the Chairman, in coordination with the Secretary of Homeland Security, shall establish and publish, and shall include each of the following requirements:
“(A) The vendor must be owned and controlled by a citizen or permanent resident of the United States.
“(B) The vendor must disclose to the Chairman and the Secretary, and to the chief State election official of any State to which the vendor provides any goods and services with funds provided under this part, of any sourcing outside the United States for parts of the election infrastructure.
“(C) The vendor agrees to ensure that the election infrastructure will be developed and maintained in a manner that is consistent with the cybersecurity best practices issued by the Technical Guidelines Development Committee.
“(D) The vendor agrees to maintain its information technology infrastructure in a manner that is consistent with the cybersecurity best practices issued by the Technical Guidelines Development Committee.
“(E) The vendor agrees to meet the requirements of paragraph (3) with respect to any known or suspected cybersecurity incidents involving any of the goods and services provided by the vendor pursuant to a grant under this part.
“(F) The vendor agrees to permit independent security testing by the Commission (in accordance with section 231(a)) and by the Secretary of the goods and services provided by the vendor pursuant to a grant under this part.
“(3) CYBERSECURITY INCIDENT REPORTING REQUIREMENTS.—
“(A) IN GENERAL.—A vendor meets the requirements of this paragraph if, upon becoming aware of the possibility that an election cybersecurity incident has occurred involving any of the goods and services provided by the vendor pursuant to a grant under this part—
“(i) the vendor promptly assesses whether or not such an incident occurred, and submits a notification meeting the requirements of subparagraph (B) to the Secretary and the Chairman of the assessment as soon as practicable (but in no case later than 3 days after the vendor first becomes aware of the possibility that the incident occurred);
“(ii) if the incident involves goods or services provided to an election agency, the vendor submits a notification meeting the requirements of subparagraph (B) to the agency as soon as practicable (but in no case later than 3 days after the vendor first becomes aware of the possibility that the incident occurred), and cooperates with the agency in providing any other necessary notifications relating to the incident; and
“(iii) the vendor provides all necessary updates to any notification submitted under clause (i) or clause (ii).
“(B) CONTENTS OF NOTIFICATIONS.—Each notification submitted under clause (i) or clause (ii) of subparagraph (A) shall contain the following information with respect to any election cybersecurity incident covered by the notification:
“(i) The date, time, and time zone when the election cybersecurity incident began, if known.
“(ii) The date, time, and time zone when the election cybersecurity incident was detected.
“(iii) The date, time, and duration of the election cybersecurity incident.
“(iv) The circumstances of the election cybersecurity incident, including the specific election infrastructure systems believed to have been accessed and information acquired, if any.
“(v) Any planned and implemented technical measures to respond to and recover from the incident.
“(vi) In the case of any notification which is an update to a prior notification, any additional material information relating to the incident, including technical data, as it becomes available.
“A State is eligible to receive a grant under this part if the State submits to the Commission, at such time and in such form as the Commission may require, an application containing—
“(1) a description of how the State will use the grant to carry out the activities authorized under this part;
“(2) a certification and assurance that, not later than 5 years after receiving the grant, the State will carry out risk-limiting audits and will carry out voting system security improvements, as described in section 297A; and
“(3) such other information and assurances as the Commission may require.
“Not later than 90 days after the end of each fiscal year, the Commission shall submit a report to the appropriate congressional committees, including the Committees on Homeland Security, House Administration, and the Judiciary of the House of Representatives and the Committees on Homeland Security and Governmental Affairs, the Judiciary, and Rules and Administration of the Senate, on the activities carried out with the funds provided under this part.
“(a) Authorization.—There are authorized to be appropriated for grants under this part—
“(1) $1,000,000,000 for fiscal year 2019; and
“(2) $175,000,000 for each of the fiscal years 2020, 2022, 2024, and 2026.
“(b) Continuing availability of amounts.—Any amounts appropriated pursuant to the authorization of this section shall remain available until expended.”.
(b) Clerical amendment.—The table of contents of such Act is amended by adding at the end of the items relating to subtitle D of title II the following:
“Sec. 297. Grants for obtaining compliant paper ballot voting systems and carrying out voting system security improvements.
“Sec. 297A. Voting system security improvements described.
“Sec. 297B. Eligibility of States.
“Sec. 297C. Reports to Congress.
“Sec. 297D. Authorization of appropriations.
(a) Duties of Election Assistance Commission.—Section 202 of the Help America Vote Act of 2002 (52 U.S.C. 20922) is amended in the matter preceding paragraph (1) by striking “by” and inserting “and the security of election infrastructure by”.
(b) Membership of Secretary of Homeland Security on Board of Advisors of Election Assistance Commission.—Section 214(a) of such Act (52 U.S.C. 20944(a)) is amended—
(1) by striking “37 members” and inserting “38 members”; and
(2) by adding at the end the following new paragraph:
“(17) The Secretary of Homeland Security or the Secretary’s designee.”.
(c) Representative of Department of Homeland Security on Technical Guidelines Development Committee.—Section 221(c)(1) of such Act (52 U.S.C. 20961(c)(1)) is amended—
(1) by redesignating subparagraph (E) as subparagraph (F); and
(2) by inserting after subparagraph (D) the following new subparagraph:
“(E) A representative of the Department of Homeland Security.”.
(d) Goals of periodic studies of election administration issues; consultation with Secretary of Homeland Security.—Section 241(a) of such Act (52 U.S.C. 20981(a)) is amended—
(1) in the matter preceding paragraph (1), by striking “the Commission shall” and inserting “the Commission, in consultation with the Secretary of Homeland Security (as appropriate), shall”;
(2) by striking “and” at the end of paragraph (3);
(3) by redesignating paragraph (4) as paragraph (5); and
(4) by inserting after paragraph (3) the following new paragraph:
“(4) will be secure against attempts to undermine the integrity of election systems by cyber or other means; and”.
(1) USE OF PAYMENTS FOR VOTING SYSTEM SECURITY IMPROVEMENTS.—Section 251(b) of such Act (52 U.S.C. 21001(b)) is amended by adding at the end the following new paragraph:
“(4) PERMITTING USE OF PAYMENTS FOR VOTING SYSTEM SECURITY IMPROVEMENTS.—A State may use a requirements payment to carry out any of the following activities:
“(A) Cyber and risk mitigation training.
“(B) Providing increased technical support for any information technology infrastructure that the chief State election official deems to be part of the State’s election infrastructure or designates as critical to the operation of the State’s election infrastructure.
“(C) Enhancing the cybersecurity and operations of the information technology infrastructure described in subparagraph (B).
“(D) Enhancing the security of voter registration databases.”.
(2) INCORPORATION OF ELECTION INFRASTRUCTURE PROTECTION IN STATE PLANS FOR USE OF PAYMENTS.—Section 254(a)(1) of such Act (52 U.S.C. 21004(a)(1)) is amended by striking the period at the end and inserting “, including the protection of election infrastructure.”.
(3) COMPOSITION OF COMMITTEE RESPONSIBLE FOR DEVELOPING STATE PLAN FOR USE OF PAYMENTS.—Section 255 of such Act (52 U.S.C. 21005) is amended—
(A) by redesignating subsection (b) as subsection (c); and
(B) by inserting after subsection (a) the following new subsection:
“(b) Geographic representation.—The members of the committee shall be a representative group of individuals from the State’s counties, cities, towns, and Indian tribes, and shall represent the needs of rural as well as urban areas of the State, as the case may be.”.
(f) Ensuring protection of computerized Statewide voter registration list.—Section 303(a)(3) of such Act (52 U.S.C. 21083(a)(3)) is amended by striking the period at the end and inserting “, as well as other measures to prevent and deter cybersecurity incidents, as identified by the Commission, the Secretary of Homeland Security, and the Technical Guidelines Development Committee.”.
(a) In general.—Section 901 of the Help America Vote Act of 2002 (52 U.S.C. 21141) is amended to read as follows:
“In this Act, the following definitions apply:
“(1) The term ‘cybersecurity incident’ has the meaning given the term ‘incident’ in section 227 of the Homeland Security Act of 2002 (6 U.S.C. 148).
“(2) The term ‘election infrastructure’ has the meaning given such term in section 3501 of the Election Security Act.
“(3) The term ‘State’ means each of the several States, the District of Columbia, the Commonwealth of Puerto Rico, Guam, American Samoa, the United States Virgin Islands, and the Commonwealth of the Northern Mariana Islands.”.
(b) Clerical amendment.—The table of contents of such Act is amended by amending the item relating to section 901 to read as follows:
“Sec. 901. Definitions.”.
(a) Availability of grants.—Subtitle D of title II of the Help America Vote Act of 2002 (52 U.S.C. 21001 et seq.), as amended by section 111(a), is amended by adding at the end the following new part:
“(a) Availability of grants.—The Commission shall make a grant to each eligible State to conduct risk-limiting audits as described in subsection (b) with respect to the regularly scheduled general elections for Federal office held in November 2020 and each succeeding election for Federal office.
“(b) Risk-Limiting audits described.—In this part, a ‘risk-limiting audit’ is a post-election process—
“(1) which is conducted in accordance with rules and procedures established by the chief State election official of the State which meet the requirements of subsection (c); and
“(2) under which, if the reported outcome of the election is incorrect, there is at least a predetermined percentage chance that the audit will replace the incorrect outcome with the correct outcome as determined by a full, hand-to-eye tabulation of all votes validly cast in that election that ascertains voter intent manually and directly from voter-verifiable paper records.
“(c) Requirements for rules and procedures.—The rules and procedures established for conducting a risk-limiting audit shall include the following elements:
“(1) Rules for ensuring the security of ballots and documenting that prescribed procedures were followed.
“(2) Rules and procedures for ensuring the accuracy of ballot manifests produced by election agencies.
“(3) Rules and procedures for governing the format of ballot manifests, cast vote records, and other data involved in the audit.
“(4) Methods to ensure that any cast vote records used in the audit are those used by the voting system to tally the election results sent to the chief State election official and made public.
“(5) Procedures for the random selection of ballots to be inspected manually during each audit.
“(6) Rules for the calculations and other methods to be used in the audit and to determine whether and when the audit of an election is complete.
“(7) Procedures and requirements for testing any software used to conduct risk-limiting audits.
“(d) Definitions.—In this part, the following definitions apply:
“(1) The term ‘ballot manifest’ means a record maintained by each election agency that meets each of the following requirements:
“(A) The record is created without reliance on any part of the voting system used to tabulate votes.
“(B) The record functions as a sampling frame for conducting a risk-limiting audit.
“(C) The record contains the following information with respect to the ballots cast and counted in the election:
“(i) The total number of ballots cast and counted by the agency (including undervotes, overvotes, and other invalid votes).
“(ii) The total number of ballots cast in each election administered by the agency (including undervotes, overvotes, and other invalid votes).
“(iii) A precise description of the manner in which the ballots are physically stored, including the total number of physical groups of ballots, the numbering system for each group, a unique label for each group, and the number of ballots in each such group.
“(2) The term ‘incorrect outcome’ means an outcome that differs from the outcome that would be determined by a full tabulation of all votes validly cast in the election, determining voter intent manually, directly from voter-verifiable paper records.
“(3) The term ‘outcome’ means the winner of an election, whether a candidate or a position.
“(4) The term ‘reported outcome’ means the outcome of an election which is determined according to the canvass and which will become the official, certified outcome unless it is revised by an audit, recount, or other legal process.
“A State is eligible to receive a grant under this part if the State submits to the Commission, at such time and in such form as the Commission may require, an application containing—
“(1) a certification that, not later than 5 years after receiving the grant, the State will conduct risk-limiting audits of the results of elections for Federal office held in the State as described in section 298;
“(2) a certification that, not later than one year after the date of the enactment of this section, the chief State election official of the State has established or will establish the rules and procedures for conducting the audits which meet the requirements of section 298(c);
“(3) a certification that the audit shall be completed not later than the date on which the State certifies the results of the election;
“(4) a certification that, after completing the audit, the State shall publish a report on the results of the audit, together with such information as necessary to confirm that the audit was conducted properly;
“(5) a certification that, if a risk-limiting audit conducted under this part leads to a full manual tally of an election, State law requires that the State or election agency shall use the results of the full manual tally as the official results of the election; and
“(6) such other information and assurances as the Commission may require.
“There are authorized to be appropriated for grants under this part $20,000,000 for fiscal year 2019, to remain available until expended.”.
(b) Clerical amendment.—The table of contents of such Act, as amended by section 111(b), is further amended by adding at the end of the items relating to subtitle D of title II the following:
“Sec. 298. Grants for conducting risk-limiting audits of results of elections.
“Sec. 298A. Eligibility of States.
“Sec. 298B. Authorization of appropriations.
(a) Analysis.—Not later than 6 months after the first election for Federal office is held after grants are first awarded to States for conducting risk-limiting audits under part 8 of subtitle D of title II of the Help America Vote Act of 2002 (as added by section 121) for conducting risk-limiting audits of elections for Federal office, the Comptroller General of the United States shall conduct an analysis of the extent to which such audits have improved the administration of such elections and the security of election infrastructure in the States receiving such grants.
(b) Report.—The Comptroller General of the United States shall submit a report on the analysis conducted under subsection (a) to the appropriate congressional committees.
(a) In general.—Title III of the Homeland Security Act of 2002 (6 U.S.C. 181 et seq.) is amended—
(1) by redesignating the second section 319 (relating to EMP and GMD mitigation research and development) as section 320; and
(2) by adding at the end the following new section:
“SEC. 321. Election infrastructure innovation grant program.
“(a) Establishment.—The Secretary, acting through the Under Secretary for Science and Technology, in coordination with the Chairman of the Election Assistance Commission (established pursuant to the Help America Vote Act of 2002) and in consultation with the Director of the National Science Foundation and the Director of the National Institute of Standards and Technology, shall establish a competitive grant program to award grants to eligible entities, on a competitive basis, for purposes of research and development that are determined to have the potential to significantly improve the security (including cybersecurity), quality, reliability, accuracy, accessibility, and affordability of election infrastructure, and increase voter participation.
“(b) Report to Congress.—Not later than 90 days after the conclusion of each fiscal year for which grants are awarded under this section, the Secretary shall submit to the Committee on Homeland Security and the Committee on House Administration of the House of Representatives and the Committee on Homeland Security and Governmental Affairs and the Committee on Rules and Administration of the Senate a report describing such grants and analyzing the impact, if any, of such grants on the security and operation of election infrastructure, and on voter participation.
“(c) Authorization of appropriations.—There is authorized to be appropriated to the Secretary $20,000,000 for each of fiscal years 2019 through 2027 for purposes of carrying out this section.
“(d) Eligible entity defined.—In this section, the term ‘eligible entity’ means—
“(1) an institution of higher education (as defined in section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), including an institution of higher education that is a historically Black college or university (which has the meaning given the term “part B institution” in section 322 of such Act (20 U.S.C. 1061)) or other minority-serving institution listed in section 371(a) of such Act (20 U.S.C. 1067q(a));
“(2) an organization described in section 501(c)(3) of the Internal Revenue Code of 1986 and exempt from tax under section 501(a) of such Code; or
“(3) an organization, association, or a for-profit company, including a small business concern (as such term is defined under section 3 of the Small Business Act (15 U.S.C. 632)), including a small business concern owned and controlled by socially and economically disadvantaged individuals as defined under section 8(d)(3)(C) of the Small Business Act (15 U.S.C. 637(d)(3)(C)).”.
(b) Definition.—Section 2 of the Homeland Security Act of 2002 (6 U.S.C. 101) is amended—
(1) by redesignating paragraphs (6) through (20) as paragraphs (7) through (21), respectively; and
(2) by inserting after paragraph (5) the following new paragraph:
“(6) ELECTION INFRASTRUCTURE.—The term ‘election infrastructure’ means storage facilities, polling places, and centralized vote tabulation locations used to support the administration of elections for public office, as well as related information and communications technology, including voter registration databases, voting machines, electronic mail and other communications systems (including electronic mail and other systems of vendors who have entered into contracts with election agencies to support the administration of elections, manage the election process, and report and display election results), and other systems used to manage the election process and to report and display election results on behalf of an election agency.”.
(c) Clerical amendment.—The table of contents in section 1(b) of the Homeland Security Act of 2002 is amended by striking both items relating to section 319 and the item relating to section 318 and inserting the following new items:
“Sec. 318. Social media working group.
“Sec. 319. Transparency in research and development.
“Sec. 320. EMP and GMD mitigation research and development.
“Sec. 321. Election infrastructure innovation grant program.”.
Subparagraph (J) of section 2001(3) of the Homeland Security Act of 2002 (6 U.S.C. 601(3)) is amended by inserting “, including election infrastructure” before the period at the end.
Subsection (d) of section 201 of the Homeland Security Act of 2002 (6 U.S.C. 121) is amended by adding at the end the following new paragraph:
“(24) To provide timely threat information regarding election infrastructure to the chief State election official of the State with respect to which such information pertains.”.
In order to promote the timely sharing of information on threats to election infrastructure, the Secretary may—
(1) help expedite a security clearance for the chief State election official and other appropriate State personnel involved in the administration of elections, as designated by the chief State election official;
(2) sponsor a security clearance for the chief State election official and other appropriate State personnel involved in the administration of elections, as designated by the chief State election official; and
(3) facilitate the issuance of a temporary clearance to the chief State election official and other appropriate State personnel involved in the administration of elections, as designated by the chief State election official, if the Secretary determines classified information to be timely and relevant to the election infrastructure of the State at issue.
(a) In general.—Paragraph (6) of section 2209(c) of the Homeland Security Act of 2002 (6 U.S.C. 659(c)) is amended by inserting “(including by carrying out a security risk and vulnerability assessment)” after “risk management support”.
(b) Prioritization To enhance election security.—
(1) IN GENERAL.—Not later than 90 days after receiving a written request from a chief State election official, the Secretary shall, to the extent practicable, commence a security risk and vulnerability assessment (pursuant to paragraph (6) of section 2209(c) of the Homeland Security Act of 2002, as amended by subsection (a)) on election infrastructure in the State at issue.
(2) NOTIFICATION.—If the Secretary, upon receipt of a request described in paragraph (1), determines that a security risk and vulnerability assessment cannot be commenced within 90 days, the Secretary shall expeditiously notify the chief State election official who submitted such request.
(a) Reports on assistance and assessments.—Not later than one year after the date of the enactment of this Act and annually thereafter through 2026, the Secretary shall submit to the appropriate congressional committees—
(1) efforts to carry out section 203 during the prior year, including specific information on which States were helped, how many officials have been helped in each State, how many security clearances have been sponsored in each State, and how many temporary clearances have been issued in each State; and
(2) efforts to carry out section 204 during the prior year, including specific information on which States were helped, the dates on which the Secretary received a request for a security risk and vulnerability assessment pursuant to such section, the dates on which the Secretary commenced each such request, and the dates on which the Secretary transmitted a notification in accordance with subsection (b)(2) of such section.
(b) Reports on foreign threats.—Not later than 90 days after the end of each fiscal year (beginning with fiscal year 2019), the Secretary and the Director of National Intelligence, in coordination with the heads of appropriate offices of the Federal government, shall submit a joint report to the appropriate congressional committees on foreign threats to elections in the United States, including physical and cybersecurity threats.
(c) Information from States.—For purposes of preparing the reports required under this section, the Secretary shall solicit and consider information and comments from States and election agencies, except that the provision of such information and comments by a State or election agency shall be voluntary and at the discretion of the State or agency.
(a) Submission of assessment by DNI.—Not later than 180 days before the date of each regularly scheduled general election for Federal office, the Director of National Intelligence shall submit an assessment of the full scope of threats to election infrastructure, including cybersecurity threats posed by state actors and terrorist groups, and recommendations to address or mitigate the threats, as developed by the Secretary and Chairman, to—
(1) the chief State election official of each State;
(2) the Committees on Homeland Security and House Administration of the House of Representatives and the Committees on Homeland Security and Governmental Affairs and Rules and Administration of the Senate; and
(3) any other appropriate congressional committees.
(b) Updates to initial assessments.—If, at any time after submitting an assessment with respect to an election under subsection (a), the Director of National Intelligence determines that the assessment should be updated to reflect new information regarding the threats involved, the Director shall submit a revised assessment under such subsection.
(c) Definitions.—In this section, the following definitions apply:
(1) The term “Chairman” means the chair of the Election Assistance Commission.
(2) The term “chief State election official” means, with respect to a State, the individual designated by the State under section 10 of the National Voter Registration Act of 1993 (52 U.S.C. 20509) to be responsible for coordination of the State’s responsibilities under such Act.
(3) The term “election infrastructure” means storage facilities, polling places, and centralized vote tabulation locations used to support the administration of elections for public office, as well as related information and communications technology, including voter registration databases, voting machines, electronic mail and other communications systems (including electronic mail and other systems of vendors who have entered into contracts with election agencies to support the administration of elections, manage the election process, and report and display election results), and other systems used to manage the election process and to report and display election results on behalf of an election agency.
(4) The term “Secretary” means the Secretary of Homeland Security.
(5) The term “State” has the meaning given such term in section 901 of the Help America Vote Act of 2002 (52 U.S.C. 21141).
(d) Effective date.—This title shall apply with respect to the regularly scheduled general election for Federal office held in November 2020 and each succeeding regularly scheduled general election for Federal office.
(a) In general.—Not later than one year after the date of the enactment of this Act, the President, acting through the Secretary, in consultation with the Chairman, the Secretary of Defense, the Secretary of State, the Attorney General, the Secretary of Education, the Director of National Intelligence, the Chairman of the Federal Election Commission, and the heads of any other appropriate Federal agencies, shall issue a national strategy to protect against cyber attacks, influence operations, disinformation campaigns, and other activities that could undermine the security and integrity of United States democratic institutions.
(b) Considerations.—The national strategy required under subsection (a) shall include consideration of the following:
(1) The threat of a foreign state actor, foreign terrorist organization (as designated pursuant to section 219 of the Immigration and Nationality Act (8 U.S.C. 1189)), or a domestic actor carrying out a cyber attack, influence operation, disinformation campaign, or other activity aimed at undermining the security and integrity of United States democratic institutions.
(2) The extent to which United States democratic institutions are vulnerable to a cyber attack, influence operation, disinformation campaign, or other activity aimed at undermining the security and integrity of such democratic institutions.
(3) Potential consequences, such as an erosion of public trust or an undermining of the rule of law, that could result from a successful cyber attack, influence operation, disinformation campaign, or other activity aimed at undermining the security and integrity of United States democratic institutions.
(4) Lessons learned from other Western governments the institutions of which were subject to a cyber attack, influence operation, disinformation campaign, or other activity aimed at undermining the security and integrity of such institutions, as well as actions that could be taken by the United States Government to bolster collaboration with foreign partners to detect, deter, prevent, and counter such activities.
(5) Potential impacts such as an erosion of public trust in democratic institutions as could be associated with a successful cyber breach or other activity negatively-affecting election infrastructure.
(6) Roles and responsibilities of the Secretary, the Chairman, and the heads of other Federal entities and non-Federal entities, including chief State election officials and representatives of multi-state information sharing and analysis center.
(7) Any findings, conclusions, and recommendations to strengthen protections for United States democratic institutions that have been agreed to by a majority of Commission members on the National Commission to Protect United States Democratic Institutions, authorized pursuant to section 302.
(c) Implementation plan.—Not later than 90 days after the issuance of the national strategy required under subsection (a), the President, acting through the Secretary, in coordination with the Chairman, shall issue an implementation plan for Federal efforts to implement such strategy that includes the following:
(1) Strategic objectives and corresponding tasks.
(2) Projected timelines and costs for the tasks referred to in paragraph (1).
(3) Metrics to evaluate performance of such tasks.
(d) Classification.—The national strategy required under subsection (a) shall be in unclassified form.
(e) Civil rights review.—Not later than 60 days after the issuance of the national strategy required under subsection (a), and not later than 60 days after the issuance of the implementation plan required under subsection (c), the Privacy and Civil Liberties Oversight Board (established under section 1061 of the Intelligence Reform and Terrorism Prevention Act of 2004 (42 U.S.C. 2000ee)) shall submit a report to Congress on any potential privacy and civil liberties impacts of such strategy and implementation plan, respectively.
(a) Establishment.—There is established within the legislative branch the National Commission to Protect United States Democratic Institutions (hereafter in this section referred to as the “Commission”).
(b) Purpose.—The purpose of the Commission is to counter efforts to undermine democratic institutions within the United States.
(1) MEMBERSHIP.—The Commission shall be composed of 10 members appointed for the life of the Commission as follows:
(A) One member shall be appointed by the Secretary.
(B) One member shall be appointed by the Chairman.
(C) Two members shall be appointed by the majority leader of the Senate, in consultation with the Chairman of the Committee on Homeland Security and Governmental Affairs, the Chairman of the Committee on the Judiciary, and the Chairman of the Committee on Rules and Administration.
(D) Two members shall be appointed by the minority leader of the Senate, in consultation with the ranking minority member of the Committee on Homeland Security and Governmental Affairs, the ranking minority member of the Committee on the Judiciary, and the ranking minority member of the Committee on Rules and Administration.
(E) Two members shall be appointed by the Speaker of the House of Representatives, in consultation with the Chairman of the Committee on Homeland Security, the Chairman of the Committee on House Administration, and the Chairman of the Committee on the Judiciary.
(F) Two members shall be appointed by the minority leader of the House of Representatives, in consultation with the ranking minority member of the Committee on Homeland Security, the ranking minority member of the Committee on the Judiciary, and the ranking minority member of the Committee on House Administration.
(2) QUALIFICATIONS.—Individuals shall be selected for appointment to the Commission solely on the basis of their professional qualifications, achievements, public stature, experience, and expertise in relevant fields, including, but not limited to cybersecurity, national security, and the Constitution of the United States.
(3) NO COMPENSATION FOR SERVICE.—Members shall not receive compensation for service on the Commission, but shall receive travel expenses, including per diem in lieu of subsistence, in accordance with chapter 57 of title 5, United States Code.
(4) DEADLINE FOR APPOINTMENT.—All members of the Commission shall be appointed no later than 60 days after the date of the enactment of this Act.
(5) VACANCIES.—A vacancy on the Commission shall not affect its powers and shall be filled in the manner in which the original appointment was made. The appointment of the replacement member shall be made not later than 60 days after the date on which the vacancy occurs.
(d) Chair and Vice Chair.—The Commission shall elect a Chair and Vice Chair from among its members.
(1) QUORUM.—The Commission shall meet and begin the operations of the Commission not later than 30 days after the date on which all members have been appointed or, if such meeting cannot be mutually agreed upon, on a date designated by the Speaker of the House of Representatives and the President pro Tempore of the Senate. Each subsequent meeting shall occur upon the call of the Chair or a majority of its members. A majority of the members of the Commission shall constitute a quorum, but a lesser number may hold meetings.
(2) AUTHORITY OF INDIVIDUALS TO ACT FOR COMMISSION.—Any member of the Commission may, if authorized by the Commission, take any action that the Commission is authorized to take under this section.
(1) HEARINGS AND EVIDENCE.—The Commission (or, on the authority of the Commission, any subcommittee or member thereof) may, for the purpose of carrying out this section, hold hearings and sit and act at such times and places, take such testimony, receive such evidence, and administer such oaths as the Commission considers advisable to carry out its duties.
(2) CONTRACTING.—The Commission may, to such extent and in such amounts as are provided in appropriation Acts, enter into contracts to enable the Commission to discharge its duties under this section.
(g) Assistance from Federal agencies.—
(1) GENERAL SERVICES ADMINISTRATION.—The Administrator of General Services shall provide to the Commission on a reimbursable basis administrative support and other services for the performance of the Commission’s functions.
(2) OTHER DEPARTMENTS AND AGENCIES.—In addition to the assistance provided under paragraph (1), the Department of Homeland Security, the Election Assistance Commission, and other appropriate departments and agencies of the United States shall provide to the Commission such services, funds, facilities, and staff as they may determine advisable and as may be authorized by law.
(h) Public meetings.—Any public meetings of the Commission shall be conducted in a manner consistent with the protection of information provided to or developed for or by the Commission as required by any applicable statute, regulation, or Executive order.
(1) IN GENERAL.—The heads of appropriate departments and agencies of the executive branch shall cooperate with the Commission to expeditiously provide Commission members and staff with appropriate security clearances to the extent possible under applicable procedures and requirements.
(2) PREFERENCES.—In appointing staff, obtaining detailees, and entering into contracts for the provision of services for the Commission, the Commission shall give preference to individuals otherwise who have active security clearances.
(1) INTERIM REPORTS.—At any time prior to the submission of the final report under paragraph (2), the Commission may submit interim reports to the President and Congress such findings, conclusions, and recommendations to strengthen protections for democratic institutions in the United States as have been agreed to by a majority of the members of the Commission.
(2) FINAL REPORT.—Not later than 18 months after the date of the first meeting of the Commission, the Commission shall submit to the President and Congress a final report containing such findings, conclusions, and recommendations to strengthen protections for democratic institutions in the United States as have been agreed to by a majority of the members of the Commission.
(1) IN GENERAL.—The Commission shall terminate upon the expiration of the 60-day period which begins on the date on which the Commission submits the final report required under subsection (j)(2).
(2) ADMINISTRATIVE ACTIVITIES PRIOR TO TERMINATION.—During the 60-day period described in paragraph (2), the Commission may carry out such administrative activities as may be required to conclude its work, including providing testimony to committees of Congress concerning the final report and disseminating the final report.
(a) Requiring testing of existing voting systems.—
(1) IN GENERAL.—Section 231(a) of the Help America Vote Act of 2002 (52 U.S.C. 20971(a)) is amended by adding at the end the following new paragraph:
“(3) TESTING TO ENSURE COMPLIANCE WITH GUIDELINES.—
“(A) TESTING.—Not later than 9 months before the date of each regularly scheduled general election for Federal office, the Commission shall provide for the testing by accredited laboratories under this section of the voting system hardware and software which was certified for use in the most recent such election, on the basis of the most recent voting system guidelines applicable to such hardware or software (including election cybersecurity guidelines) issued under this Act.
“(B) DECERTIFICATION OF HARDWARE OR SOFTWARE FAILING TO MEET GUIDELINES.—If, on the basis of the testing described in subparagraph (A), the Commission determines that any voting system hardware or software does not meet the most recent guidelines applicable to such hardware or software issued under this Act, the Commission shall decertify such hardware or software.”.
(2) EFFECTIVE DATE.—The amendment made by paragraph (1) shall apply with respect to the regularly scheduled general election for Federal office held in November 2020 and each succeeding regularly scheduled general election for Federal office.
(b) Issuance of cybersecurity guidelines by Technical Guidelines Development Committee.—Section 221(b) of the Help America Vote Act of 2002 (52 U.S.C. 20961(b)) is amended by adding at the end the following new paragraph:
“(3) ELECTION CYBERSECURITY GUIDELINES.—Not later than 6 months after the date of the enactment of this paragraph, the Development Committee shall issue election cybersecurity guidelines, including standards and best practices for procuring, maintaining, testing, operating, and updating election systems to prevent and deter cybersecurity incidents.”.
(a) Inclusion in definition of voting system.—Section 301(b) of the Help America Vote Act of 2002 (52 U.S.C. 21081(b)) is amended—
(1) in the matter preceding paragraph (1), by striking “this section” and inserting “this Act”;
(2) by striking “and” at the end of paragraph (1);
(3) by redesignating paragraph (2) as paragraph (3); and
(4) by inserting after paragraph (1) the following new paragraph:
“(2) any electronic poll book used with respect to the election; and”.
(b) Definition.—Section 301 of such Act (52 U.S.C. 21081) is amended—
(1) by redesignating subsections (c) and (d) as subsections (d) and (e); and
(2) by inserting after subsection (b) the following new subsection:
“(c) Electronic poll book defined.—In this Act, the term ‘electronic poll book’ means the total combination of mechanical, electromechanical, or electronic equipment (including the software, firmware, and documentation required to program, control, and support the equipment) that is used—
“(1) to retain the list of registered voters at a polling location, or vote center, or other location at which voters cast votes in an election for Federal office; and
“(2) to identify registered voters who are eligible to vote in an election.”.
(c) Effective date.—Section 301(e) of such Act (52 U.S.C. 21081(e)), as redesignated by subsection (b), is amended by striking the period at the end and inserting the following: “, or, with respect to any requirements relating to electronic poll books, on and after January 1, 2020.”.
(a) Requiring States To submit reports.—Title III of the Help America Vote Act of 2002 (52 U.S.C. 21081 et seq.) is amended by inserting after section 301 the following new section:
“SEC. 301A. Pre-election reports on voting system usage.
“(a) Requiring States To submit reports.—Not later than 120 days before the date of each regularly scheduled general election for Federal office, the chief State election official of a State shall submit a report to the Commission containing a detailed voting system usage plan for each jurisdiction in the State which will administer the election, including a detailed plan for the usage of electronic poll books and other equipment and components of such system.
“(b) Effective date.—Subsection (a) shall apply with respect to the regularly scheduled general election for Federal office held in November 2020 and each succeeding regularly scheduled general election for Federal office.”.
(b) Conforming amendment relating to enforcement.—Section 401 of such Act (52 U.S.C. 21111) is amended by striking “sections 301, 302, and 303” and inserting “subtitle A of title III”.
(c) Clerical amendment.—The table of contents of such Act is amended by inserting after the item relating to section 301 the following new item:
“Sec. 301A. Pre-election reports on voting system usage.”.
Section 202 of the Help America Vote Act of 2002 (52 U.S.C. 20922) is amended—
(1) by striking “The Commission” and inserting “(a) In general.—The Commission”; and
(2) by adding at the end the following new subsection:
“(b) Waiver of certain requirements.—Subchapter I of chapter 35 of title 44, United States Code, shall not apply to the collection of information for purposes of maintaining the clearinghouse described in paragraph (1) of subsection (a).”.
This title may be cited as the “Prevent Election Hacking Act of 2019”.
(a) Establishment.—Not later than 1 year after the date of the enactment of this Act, the Secretary shall establish a program to be known as the “Election Security Bug Bounty Program” (hereafter in this subtitle referred to as the “Program”) to improve the cybersecurity of the systems used to administer elections for Federal office by facilitating and encouraging assessments by independent technical experts, in cooperation with State and local election officials and election service providers, to identify and report election cybersecurity vulnerabilities.
(b) Voluntary participation by election officials and election service providers.—
(1) NO REQUIREMENT TO PARTICIPATE IN PROGRAM.—Participation in the Program shall be entirely voluntary for State and local election officials and election service providers.
(2) ENCOURAGING PARTICIPATION AND INPUT FROM ELECTION OFFICIALS.—In developing the Program, the Secretary shall solicit input from, and encourage participation by, State and local election officials.
(c) Activities funded.—In establishing and carrying out the Program, the Secretary shall—
(1) establish a process for State and local election officials and election service providers to voluntarily participate in the Program;
(2) designate appropriate information systems to be included in the Program;
(3) provide compensation to eligible individuals, organizations, and companies for reports of previously unidentified security vulnerabilities within the information systems designated under subparagraph (A) and establish criteria for individuals, organizations, and companies to be considered eligible for such compensation in compliance with Federal laws;
(4) consult with the Attorney General on how to ensure that approved individuals, organizations, or companies that comply with the requirements of the Program are protected from prosecution under section 1030 of title 18, United States Code, and similar provisions of law, and from liability under civil actions for specific activities authorized under the Program;
(5) consult with the Secretary of Defense and the heads of other departments and agencies that have implemented programs to provide compensation for reports of previously undisclosed vulnerabilities in information systems, regarding lessons that may be applied from such programs;
(6) develop an expeditious process by which an individual, organization, or company can register with the Department, submit to a background check as determined by the Department, and receive a determination as to eligibility for participation in the Program; and
(7) engage qualified interested persons, including representatives of private entities, about the structure of the Program and, to the extent practicable, establish a recurring competition for independent technical experts to assess election systems for the purpose of identifying and reporting election cybersecurity vulnerabilities.
(d) Use of service providers.—The Secretary may award competitive contracts as necessary to manage the Program.
In this title, the following definitions apply:
(1) The terms “election” and “Federal office” have the meanings given such terms in section 301 of the Federal Election Campaign Act of 1971 (52 U.S.C. 30101).
(2) The term “election cybersecurity vulnerability” means any security vulnerability (as defined in section 102 of the Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 1501)) that affects an election system.
(3) The term “election service provider” means any person providing, supporting, or maintaining an election system on behalf of a State or local election official, such as a contractor or vendor.
(4) The term “election system” means any information system (as defined in section 3502 of title 44, United States Code) which is part of an election infrastructure.
(5) The term “Secretary” means the Secretary of Homeland Security, or, upon designation by the Secretary of Homeland Security, the Deputy Secretary of Homeland Security, the Director of Cybersecurity and Infrastructure Security of the Department of Homeland Security, or a Senate-confirmed official that reports to the Director.
(6) The term “State” means each of the several States, the District of Columbia, the Commonwealth of Puerto Rico, Guam, American Samoa, the Commonwealth of Northern Mariana Islands, and the United States Virgin Islands.
(7) The term “voting system” has the meaning given such term in section 301(b) of the Help America Vote Act of 2002 (52 U.S.C. 21081(b)).
(a) In general.—Subtitle A of title II of the Help America Vote Act of 2002 (52 U.S.C. 20921 et seq.) is amended by adding at the end the following:
“SEC. 225. Election security grants advisory committee.
“(a) Establishment.—There is hereby established an advisory committee (hereinafter in this part referred to as the ‘Committee’) to assist the Commission with respect to the award of grants to States under this Act for the purpose of election security.
“(1) IN GENERAL.—The Committee shall, with respect to an application for a grant received by the Commission—
“(A) review such application; and
“(B) recommend to the Commission whether to award the grant to the applicant.
“(2) CONSIDERATIONS.—In reviewing an application pursuant to paragraph (1)(A), the Committee shall consider—
“(A) the record of the applicant with respect to—
“(i) compliance of the applicant with the requirements under subtitle A of title III; and
“(ii) adoption of voluntary guidelines issued by the Commission under subtitle B of title III; and
“(B) the goals and requirements of election security as described in title III of the For the People Act of 2019.
“(c) Membership.—The Committee shall be composed of 15 individuals appointed by the Executive Director of the Commission with experience and expertise in election security.
“(d) No compensation for service.—Members of the Committee shall not receive any compensation for their service, but shall be paid travel expenses, including per diem in lieu of subsistence, at rates authorized for employees of agencies under subchapter I of chapter 57 of title 5, United States Code, while away from their homes or regular places of business in the performance of services for the Committee.”.
(b) Effective date.—The amendments made by this section shall take effect 1 year after the date of enactment of this Act.
Section 301(a) of the Help America Vote Act of 2002 (52 U.S.C. 21081(a)), as amended by section 104 and section 105, is amended by adding at the end the following new paragraph:
“(9) VOTING MACHINE REQUIREMENTS.—By not later than the date of the regularly scheduled general election for Federal office occurring in November 2022, each State shall seek to ensure that any voting machine used in such election and in any subsequent election for Federal office is manufactured in the United States.”.
Except as provided in section 503, in this Act, the following definitions apply:
(1) The term “Chairman” means the chair of the Election Assistance Commission.
(2) The term “appropriate congressional committees” means the Committees on Homeland Security and House Administration of the House of Representatives and the Committees on Homeland Security and Governmental Affairs and Rules and Administration of the Senate.
(3) The term “chief State election official” means, with respect to a State, the individual designated by the State under section 10 of the National Voter Registration Act of 1993 (52 U.S.C. 20509) to be responsible for coordination of the State’s responsibilities under such Act.
(4) The term “Commission” means the Election Assistance Commission.
(5) The term “democratic institutions” means the diverse range of institutions that are essential to ensuring an independent judiciary, free and fair elections, and rule of law.
(6) The term “election agency” means any component of a State, or any component of a unit of local government in a State, which is responsible for the administration of elections for Federal office in the State.
(7) The term “election infrastructure” means storage facilities, polling places, and centralized vote tabulation locations used to support the administration of elections for public office, as well as related information and communications technology, including voter registration databases, voting machines, electronic mail and other communications systems (including electronic mail and other systems of vendors who have entered into contracts with election agencies to support the administration of elections, manage the election process, and report and display election results), and other systems used to manage the election process and to report and display election results on behalf of an election agency.
(8) The term “Secretary” means the Secretary of Homeland Security.
(9) The term “State” has the meaning given such term in section 901 of the Help America Vote Act of 2002 (52 U.S.C. 21141).
Not later than 120 days after enactment of this Act, the Chairman and the Secretary shall submit a report to the appropriate committees of Congress, including the Committees on Homeland Security and House Administration of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate, analyzing the adequacy of the funding, resources, and personnel available to carry out this Act and the amendments made by this Act.
If any provision of this Act or amendment made by this Act, or the application of a provision or amendment to any person or circumstance, is held to be unconstitutional, the remainder of this Act and amendments made by this Act, and the application of the provisions and amendment to any person or circumstance, shall not be affected by the holding.