Election Vendor Security Act

To amend the Help America Vote Act of 2002 to prohibit States from entering into agreements with vendors for the provision, support, or maintenance of election systems if the vendors are owned or controlled by persons who are not citizens, nationals, or permanent residents of the United States or do not meet cybersecurity best practices, and for other purposes. 1. Short title This Act may be cited as the Election Vendor Security Act 2. Prohibiting agreements with vendors for operation of election systems who are foreign nationals or who fail to meet cybersecurity best practices (a) Prohibition Title III of the Help America Vote Act of 2002 ( 52 U.S.C. 21083 (1) by redesignating sections 304 and 305 as sections 305 and 306; and (2) by inserting after section 303 the following new section: 304. Requirements for vendors of election systems (a) Prohibiting agreements with vendors failing To meet requirements A State, unit of local government, or any component of a State or unit of local government which is responsible for the administration of an election for Federal office may not enter into an agreement with a vendor to provide, support, or maintain any component of the election system unless the vendor meets the criteria described in subsection (b). (b) Criteria for vendors The criteria described in this subsection with respect to a vendor are as follows, as established and published by the Chair of the Commission in coordination with the Secretary of Homeland Security: (1) The vendor shall certify that it is owned and controlled by a citizen, national, or permanent resident of the United States, and that none of its activities are directed, supervised, controlled, subsidized, or financed, and none of its policies are determined by, any foreign principal (as defined in section 1(b) of the Foreign Agents Registration Act of 1938 ( 22 U.S.C. 611(b) (2) The vendor shall disclose to the Chair and the Secretary, and to the chief State election official of any State in which the vendor provides, supports, or maintains any component of an election system, any sourcing outside the United States for parts of the system. (3) The vendor shall ensure that the election system will be developed and maintained in a manner that is consistent with the cybersecurity best practices established under subsection (c). (4) The vendor shall maintain its information technology infrastructure in a manner that is consistent with the cybersecurity best practices established under subsection (c). (5) The vendor shall report any known or suspected security incidents involving election systems to the chief State election official of the State involved or the official’s designee, the Chair, and the Secretary not later than 10 days after the vendor first knows or suspects that the incident occurred. (c) Cybersecurity best practices Not later than 90 days after the date of the enactment of this section, the Chair and the Secretary of Homeland Security shall establish and publish cybersecurity best practices for vendors who provide, support, or maintain election systems, and shall establish and publish updates to such best practices at such times as the Chair and the Secretary consider appropriate. (d) Availability of list of participating vendors (1) Submission of list to Commission Not later than 90 days before the date of each regularly scheduled general election for Federal office (beginning with the election held in November 2018), each State shall submit to the Commission a list of all vendors who will be providing, supporting, or maintaining any component of any election system which will be used to carry out such election in the State. (2) Posting by Commission Upon receiving a list from a State under paragraph (1), the Commission shall post the list on the official public website of the Commission. (e) Election system defined In this section, the term election system . (b) Conforming amendment relating to enforcement Section 401 of such Act ( 52 U.S.C. 21111 and 303 303, and 304 (c) Clerical amendments The table of contents of such Act is amended— (1) by redesignating the items relating to sections 304 and 305 as relating to sections 305 and 306; and (2) by inserting after the item relating to section 303 the following new item: Sec. 304. Requirements for vendors of election systems. . (d) Effective date The amendments made by this section shall apply with respect to the regularly scheduled general election for Federal office held in November 2018 and each succeeding election for Federal office.

Summary: Election Vendor Security Act This bill prohibits state and local governmental entities that are responsible for administering an election for federal office from entering into an agreement with a vendor who is a foreign national or who fails to meet current best practices for cybersecurity established by the U.S. Election Assistance Commission and the Department of Homeland Security. Before each regularly scheduled general election for federal office (beginning with the November 2018 election), each state shall submit to the commission a list of all vendors who will be providing, supporting, or maintaining any components of an election system in such state.