Protect Election Systems from Foreign Control Act

Summary: Protect Election Systems from Foreign Control Act This bill amends the Help America Vote Act of 2002 to require state and local governments to ensure that vendors who provide, support, or maintain any component of a voting system used in a federal election are solely owned and controlled by citizens, unless the Department of Homeland Security (DHS) grants the vendor a waiver. Vendors must disclose any sourcing of parts from outside the United States or material changes in ownership or control.  The Federal Election Commission and DHS shall publish cybersecurity best practices for vendors. Voting systems and vendor information technology infrastructure must be developed and maintained in a manner consistent with the best practices. Vendors must report suspected security incidents.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Protect Election Systems from 
Foreign Control Act''.

SEC. 2. ENSURING NO FOREIGN OWNERSHIP OR INFLUENCE ON VOTING SYSTEMS.

    (a) In General.--Title III of the Help America Vote Act of 2002 (52 
U.S.C. 21083 et seq.) is amended--
            (1) by redesignating sections 304 and 305 as sections 305 
        and 306; and
            (2) by inserting after section 303 the following new 
        section:

``SEC. 304. ENSURING NO FOREIGN OWNERSHIP OR CONTROL OVER VOTING 
              SYSTEMS.

    ``(a) Requiring Vendors To Be Qualified.--Each State, unit of local 
government, or component of a State or unit of local government which 
is responsible for the administration of an election for Federal office 
shall ensure that each vendor who provides, supports, or maintains any 
component of a voting system used in the administration of the election 
is a qualified voting systems vendor.
    ``(b) Annual Evaluation To Ensure Compliance.--Each State, unit of 
local government, or component of a State or unit of local government 
which is responsible for the administration of an election for Federal 
office shall, not less frequently than once each calendar year, 
evaluate each of the vendors who provide, support, or maintain any 
component of a voting system used in the administration of the election 
to ensure that the vendor is a qualified voting system vendor.
    ``(c) Cybersecurity Best Practices.--Not later than 90 days after 
the date of the enactment of this section, the Chair of the Commission 
and the Secretary of Homeland Security shall establish and publish 
cybersecurity best practices for vendors who provide, support, or 
maintain voting systems, and shall establish and publish updates to 
such best practices at such times as the Chair and the Secretary 
consider appropriate.
    ``(d) Guidance and Technical Assistance.--
            ``(1) In general.--The Chair of the Commission and the 
        Secretary of Homeland Security may provide such guidance and 
        technical assistance as may be appropriate to assist each 
        State, unit of local government, or component of a State or 
        unit of local government which is responsible for the 
        administration of an election for Federal office with its 
        obligations under this section.
            ``(2) Database of qualified vendors.--As part of providing 
        guidance and technical assistance under this subsection, the 
        Commission shall establish and maintain a database in which 
        each State, unit of local government, or component of a State 
        or unit of local government which is responsible for the 
        administration of an election for Federal office can verify 
        whether a vendor is a qualified voting systems vendor.
    ``(e) Qualified Voting Systems Vendor Defined.--
            ``(1) In general.--In this section, the term `qualified 
        voting system vendor' means a person who provides, supports, or 
        maintains, or seeks to provide, support, or maintain, a voting 
        system used in the administration of an election for Federal 
        office who meets each of the following criteria, as established 
        and published by the Chair of the Commission in coordination 
        with the Secretary of Homeland Security:
                    ``(A) Except as provided in paragraph (2), the 
                person is solely owned and controlled by a citizen or 
                citizens of the United States.
                    ``(B) The person discloses any sourcing outside the 
                United States for any parts of the voting system to the 
                Chair of the Commission, the Secretary of Homeland 
                Security, and the chief State election official of any 
                State in which the vendor provides or seeks to provide 
                goods or services with respect to the voting system.
                    ``(C) The person discloses any material change in 
                its ownership or control to the Chair of the 
                Commission, the Secretary of Homeland Security, and the 
                chief State election official of any State in which the 
                vendor provides goods or services with respect to the 
                voting system.
                    ``(D) The person agrees to ensure that the voting 
                systems will be developed and maintained in a manner 
                that is consistent with the cybersecurity best 
                practices established under subsection (c).
                    ``(E) The person agrees to maintain its information 
                technology infrastructure in a manner that is 
                consistent with the cybersecurity best practices 
                established under subsection (c).
                    ``(F) The vendor shall report any known or 
                suspected security incidents involving voting systems 
                to the chief State election official of the State 
                involved or the official's designee, the Chair, and the 
                Secretary.
            ``(2) Permitting waiver of domestic ownership requirement 
        for certain subsidiaries.--The Secretary of Homeland Security 
        may waive the requirement of subparagraph (A) of paragraph (1) 
        with respect to a person who is a United States subsidiary of a 
        parent company which has implemented a foreign ownership, 
        control, or influence mitigation plan that has been approved by 
        the Secretary. Such plan shall ensure that the parent company 
        cannot control, influence, or direct the subsidiary in any 
        manner that would compromise or influence, or give the 
        appearance of compromising or influencing, the independence and 
        integrity of an election.
    ``(f) Voting System Defined.--In this section, the term `voting 
system' has the meaning given such term in section 301(b).''.
    (b) Conforming Amendment Relating to Enforcement.--Section 401 of 
such Act (52 U.S.C. 21111) is amended by striking ``and 303'' and 
inserting ``303, and 304''.
    (c) Clerical Amendments.--The table of contents of such Act is 
amended--
            (1) by redesignating the items relating to sections 304 and 
        305 as relating to sections 305 and 306; and
            (2) by inserting after the item relating to section 303 the 
        following new item:

``Sec. 304. Ensuring no foreign ownership or control over voting 
                            systems.''.
    (d) Effective Date.--The amendments made by this section shall 
apply with respect to elections for Federal office held in 2020 or any 
succeeding year.