108 
(iv) actively encourage participation 
from a range of demographic categories, es-
pecially from categories with consistently 
low participation. 
SEC. 1408. EXAMINATION AND ORAL ASSESSMENT FOR THE 
FOREIGN SERVICE. 
(a) SENSE OF CONGRESS.—It is the sense of Congress 
that the Department of State should offer both the Foreign 
Service written examination and oral assessment in more 
locations throughout the United States. Doing so would ease 
the financial burden on potential candidates who do not 
currently reside in and must travel at their own expense 
to one of the few locations where these assessments are of-
fered. 
(b) 
FOREIGN
SERVICE
EXAMINATIONS.—Section 
301(b) of the Foreign Service Act of 1980 (22 U.S.C. 3941) 
is amended— 
(1) by striking ‘‘The Secretary’’ and inserting: 
‘‘(1) The Secretary’’; and 
(2) by adding at the end the following new para-
graph: 
‘‘(2) The Secretary shall ensure that the Board of Ex-
aminers for the Foreign Service annually offers the oral as-
sessment examinations described in paragraph (1) in cities, 
VerDate Sep 11 2014 
21:54 May 13, 2021
Jkt 019200
PO 00000
Frm 00108
Fmt 6652
Sfmt 6203
E:\BILLS\H1157.RH
H1157
kjohnson on DSK79L0C42PROD with BILLS
109 
chosen on a rotating basis, located in at least three different 
time zones across the United States.’’. 
SEC. 1409. PAYNE FELLOWSHIP AUTHORIZATION. 
(a) IN GENERAL.—Undergraduate and graduate com-
ponents of the Donald M. Payne International Development 
Fellowship Program may conduct outreach to attract out-
standing students with an interest in pursuing a Foreign 
Service career who represent diverse ethnic and socio-
economic backgrounds. 
(b) REVIEW OF PAST PROGRAMS.—The Secretary of 
State shall review past programs designed to increase mi-
nority representation in international affairs positions. 
SEC. 1410. VOLUNTARY PARTICIPATION. 
(a) IN GENERAL.—Nothing in this title should be con-
strued so as to compel any employee to participate in the 
collection of the data or divulge any personal information. 
Department of State employees shall be informed that their 
participation in the data collection contemplated by this 
title is voluntary. 
(b) PRIVACY PROTECTION.—Any data collected under 
this title shall be subject to the relevant privacy protection 
statutes and regulations applicable to Federal employees. 
VerDate Sep 11 2014 
21:54 May 13, 2021
Jkt 019200
PO 00000
Frm 00109
Fmt 6652
Sfmt 6203
E:\BILLS\H1157.RH
H1157
kjohnson on DSK79L0C42PROD with BILLS
110 
TITLE V—INFORMATION 
SECURITY 
SEC. 1501. DEFINITIONS. 
In this title: 
(1) INTELLIGENCE COMMUNITY.—The term ‘‘in-
telligence community’’ has the meaning given such 
term in section 3(4) of the National Security Act of 
1947 (50 U.S.C. 3003(4)). 
(2) RELEVANT CONGRESSIONAL COMMITTEES.— 
The 
term 
‘‘relevant 
congressional 
committees’’ 
means— 
(A) the appropriate congressional commit-
tees; 
(B) the Select Committee on Intelligence of 
the Senate; and 
(C) the Permanent Select Committee on In-
telligence of the House of Representatives. 
SEC. 1502. LIST OF CERTAIN TELECOMMUNICATIONS PRO-
VIDERS. 
(a) LIST OF COVERED CONTRACTORS.—Not later than 
30 days after the date of the enactment of this Act, the Sec-
retary of State, in consultation with the Director of Na-
tional Intelligence, shall develop or maintain, as the case 
may be, and update as frequently as the Secretary deter-
mines appropriate, a list of covered contractors with respect 
VerDate Sep 11 2014 
21:54 May 13, 2021
Jkt 019200
PO 00000
Frm 00110
Fmt 6652
Sfmt 6203
E:\BILLS\H1157.RH
H1157
kjohnson on DSK79L0C42PROD with BILLS
111 
to which the Department should seek to avoid entering into 
contracts. Not later than 30 days after the initial develop-
ment of the list under this subsection, any update thereto, 
and annually thereafter for five years after such initial 30 
day period, the Secretary shall submit to the appropriate 
congressional committees a copy of such list. 
(b) COVERED CONTRACTOR DEFINED.—In this section, 
the term ‘‘covered contractor’’ means a provider of tele-
communications, telecommunications equipment, or infor-
mation technology equipment, including hardware, soft-
ware, or services, that has knowingly assisted or facilitated 
a cyber attack or conducted surveillance, including passive 
or active monitoring, carried out against— 
(1) the United States by, or on behalf of, any 
government, or persons associated with such govern-
ment, listed as a cyber threat actor in the intelligence 
community’s 2017 assessment of worldwide threats to 
United States national security or any subsequent 
worldwide threat assessment of the intelligence com-
munity; or 
(2) individuals, including activists, journalists, 
opposition politicians, or other individuals for the 
purposes of suppressing dissent or intimidating crit-
ics, on behalf of a country included in the annual 
country reports on human rights practices of the De-
VerDate Sep 11 2014 
21:54 May 13, 2021
Jkt 019200
PO 00000
Frm 00111
Fmt 6652
Sfmt 6203
E:\BILLS\H1157.RH
H1157
kjohnson on DSK79L0C42PROD with BILLS
112 
partment for systematic acts of political repression, 
including arbitrary arrest or detention, torture, 
extrajudicial or politically motivated killing, or other 
gross violations of human rights. 
SEC. 1503. PRESERVING RECORDS OF ELECTRONIC COMMU-
NICATIONS CONDUCTED RELATED TO OFFI-
CIAL DUTIES OF POSITIONS IN THE PUBLIC 
TRUST OF THE AMERICAN PEOPLE. 
(a) SENSE OF CONGRESS.—It is the sense of Congress 
that, as a matter of rule of law and transparency in a 
democratic government, all officers and employees of the De-
partment of State and the United States Agency for Inter-
national Development must preserve all records of commu-
nications conducted in their official capacities or related 
to their official duties with entities outside of the United 
States Government. It is further the sense of Congress that 
such practice should include foreign government officials or 
other foreign entities which may seek to influence United 
States Government policies and actions. 
(b) PUBLICATION.—Not later than 180 days after the 
date of the enactment of this Act, the Secretary of State 
shall publish in the Foreign Affairs Manual guidance im-
plementing chapter 31 of title 44, United States Code (com-
monly referred to as the ‘‘Federal Records Act’’), to treat 
electronic messaging systems, software, and applications as 
VerDate Sep 11 2014 
21:54 May 13, 2021
Jkt 019200
PO 00000
Frm 00112
Fmt 6652
Sfmt 6203
E:\BILLS\H1157.RH
H1157
kjohnson on DSK79L0C42PROD with BILLS
113 
equivalent to electronic mail for the purpose of identifying 
Federal records, and shall also publish in the Foreign Af-
fairs Manual the statutory penalties for failure to comply 
with such guidance. Beginning on the date that is 180 days 
after the date of the enactment of this Act, no funds are 
authorized to be appropriated or made available to the De-
partment of State under any Act to support the use or es-
tablishment of accounts on third-party messaging applica-
tions or other non-Government online communication tools 
if the Secretary does not certify to the relevant congressional 
committees that the Secretary has carried out this section. 
The prohibition described in this subsection shall not apply 
to warden or embassy security messages. 
SEC. 1504. FOREIGN RELATIONS OF THE UNITED STATES 
(FRUS) SERIES AND DECLASSIFICATION. 
The State Department Basic Authorities Act of 1956 
is amended— 
(1) in section 402(a)(2) (22 U.S.C. 4352(a)(2)), 
by striking ‘‘26’’ and inserting ‘‘20’’; and 
(2) in section 404 (22 U.S.C. 4354)— 
(A) in subsection (a)(1), by striking 
‘‘30’’and inserting ‘‘25’’; and 
(B) in subsection (c)(1)(C), by striking 
‘‘30’’ and inserting ‘‘25’’. 
VerDate Sep 11 2014 
21:54 May 13, 2021
Jkt 019200
PO 00000
Frm 00113
Fmt 6652
Sfmt 6203
E:\BILLS\H1157.RH
H1157
kjohnson on DSK79L0C42PROD with BILLS
114 
SEC. 1505. VULNERABILITY DISCLOSURE POLICY AND BUG 
BOUNTY PILOT PROGRAM. 
(a) DEFINITIONS.—In this section: 
(1) BUG
BOUNTY
PROGRAM.—The term ‘‘bug 
bounty program’’ means a program under which an 
approved individual, organization, or company is 
temporarily authorized to identify and report 
vulnerabilities of internet-facing information tech-
nology of the Department of State in exchange for 
compensation. 
(2) INFORMATION TECHNOLOGY.—The term ‘‘in-
formation technology’’ has the meaning given such 
term in section 11101 of title 40, United States Code. 
(b) VULNERABILITY DISCLOSURE PROCESS.— 
(1) IN GENERAL.—Not later than 180 days after 
the date of the enactment of this Act, the Secretary of 
State shall design, establish, and make publicly 
known a Vulnerability Disclosure Process (VDP) to 
improve Department of State cybersecurity by— 
(A) providing security researchers with 
clear guidelines for— 
(i) conducting vulnerability discovery 
activities directed at Department informa-
tion technology; and 
(ii) submitting discovered security 
vulnerabilities to the Department; and 
VerDate Sep 11 2014 
21:54 May 13, 2021
Jkt 019200
PO 00000
Frm 00114
Fmt 6652
Sfmt 6203
E:\BILLS\H1157.RH
H1157
kjohnson on DSK79L0C42PROD with BILLS
115 
(B) creating Department procedures and 
infrastructure to receive and fix discovered 
vulnerabilities. 
(2) REQUIREMENTS.—In establishing the VDP 
pursuant to paragraph (1), the Secretary of State 
shall— 
(A) identify which Department of State in-
formation technology should be included in the 
process; 
(B) determine whether the process should 
differentiate among and specify the types of secu-
rity vulnerabilities that may be targeted; 
(C) provide a readily available means of re-
porting discovered security vulnerabilities and 
the form in which such vulnerabilities should be 
reported; 
(D) identify which Department offices and 
positions will be responsible for receiving, 
prioritizing, and addressing security vulner-
ability disclosure reports; 
(E) consult with the Attorney General re-
garding how to ensure that individuals, organi-
zations, and companies that comply with the re-
quirements of the process are protected from 
prosecution under section 1030 of title 18, 
VerDate Sep 11 2014 
21:54 May 13, 2021
Jkt 019200
PO 00000
Frm 00115
Fmt 6652
Sfmt 6203
E:\BILLS\H1157.RH
H1157
kjohnson on DSK79L0C42PROD with BILLS
116 
United States Code, and similar provisions of 
law for specific activities authorized under the 
process; 
(F) consult with the relevant offices at the 
Department of Defense that were responsible for 
launching the 2016 Vulnerability Disclosure Pro-
gram, ‘‘Hack the Pentagon’’, and subsequent De-
partment of Defense bug bounty programs; 
(G) engage qualified interested persons, in-
cluding nongovernmental sector representatives, 
about the structure of the process as constructive 
and to the extent practicable; and 
(H) award contracts to entities, as nec-
essary, to manage the process and implement the 
remediation 
of 
discovered 
security 
vulnerabilities. 
(3) ANNUAL REPORTS.—Not later than 180 days 
after the establishment of the VDP under paragraph 
(1) and annually thereafter for the next five years, the 
Secretary of State shall submit to the Committee on 
Foreign Affairs of the House of Representatives and 
the Committee on Foreign Relations of the Senate a 
report on the VDP, including information relating to 
the following: 
VerDate Sep 11 2014 
21:54 May 13, 2021
Jkt 019200
PO 00000
Frm 00116
Fmt 6652
Sfmt 6203
E:\BILLS\H1157.RH
H1157
kjohnson on DSK79L0C42PROD with BILLS
117 
(A) The number and severity of all security 
vulnerabilities reported. 
(B) The number of previously unidentified 
security vulnerabilities remediated as a result. 
(C) The current number of outstanding pre-
viously unidentified security vulnerabilities and 
Department of State remediation plans. 
(D) The average length of time between the 
reporting of security vulnerabilities and remedi-
ation of such vulnerabilities. 
(E) The resources, surge staffing, roles, and 
responsibilities within the Department used to 
implement the VDP and complete security vul-
nerability remediation. 
(F) Any other information the Secretary de-
termines relevant. 
(c) BUG BOUNTY PILOT PROGRAM.— 
(1) IN GENERAL.—Not later than one year after 
the date of the enactment of this Act, the Secretary of 
State shall establish a bug bounty pilot program to 
minimize security vulnerabilities of internet-facing 
information technology of the Department of State. 
(2) REQUIREMENTS.—In establishing the pilot 
program described in paragraph (1), the Secretary of 
State shall— 
VerDate Sep 11 2014 
21:54 May 13, 2021
Jkt 019200
PO 00000
Frm 00117
Fmt 6652
Sfmt 6203
E:\BILLS\H1157.RH
H1157
kjohnson on DSK79L0C42PROD with BILLS