114 
such initial 30 day period, the Secretary shall submit to 
the appropriate congressional committees a copy of such 
list. 
(b) COVERED CONTRACTOR DEFINED.—In this sec-
tion, the term ‘‘covered contractor’’ means a provider of 
telecommunications, telecommunications equipment, or in-
formation technology equipment, including hardware, soft-
ware, or services, that has knowingly assisted or facilitated 
a cyber attack or conducted surveillance, including passive 
or active monitoring, carried out against— 
(1) the United States by, or on behalf of, any 
government, or persons associated with such govern-
ment, listed as a cyber threat actor in the intel-
ligence community’s 2017 assessment of worldwide 
threats to United States national security or any 
subsequent worldwide threat assessment of the intel-
ligence community; or 
(2) individuals, including activists, journalists, 
opposition politicians, or other individuals for the 
purposes of suppressing dissent or intimidating crit-
ics, on behalf of a country included in the annual 
country reports on human rights practices of the 
Department for systematic acts of political repres-
sion, including arbitrary arrest or detention, torture,
115 
extrajudicial or politically motivated killing, or other 
gross violations of human rights. 
SEC. 1503. PRESERVING RECORDS OF ELECTRONIC COM-
MUNICATIONS CONDUCTED RELATED TO OF-
FICIAL DUTIES OF POSITIONS IN THE PUBLIC 
TRUST OF THE AMERICAN PEOPLE. 
(a) SENSE OF CONGRESS.—It is the sense of Con-
gress that all officers and employees of the Department 
and the United States Agency for International Develop-
ment are obligated under chapter 31 of title 44, United 
States Code (popularly referred to as the Federal Records 
Act of 1950), to create and preserve records containing 
adequate and proper documentation of the organization, 
functions, policies, decisions, procedures, and essential 
transactions or operations of the Department and United 
States embassies, consulates, and missions abroad, includ-
ing records of official communications with foreign govern-
ment officials or other foreign entities. 
(b) CERTIFICATION.—Not later than 180 days after 
the date of the enactment of this Act, the Secretary shall 
submit to the appropriate congressional committees a cer-
tification in unclassified form that Secretary has commu-
nicated to all Department personnel, including the Sec-
retary of State and all political appointees, that such per-
sonnel are obligated under chapter 31 of title 44, United
116 
States Code, to treat electronic messaging systems, soft-
ware, and applications as equivalent to electronic mail for 
the purpose of identifying Federal records. 
SEC. 1504. FOREIGN RELATIONS OF THE UNITED STATES 
(FRUS) SERIES AND DECLASSIFICATION. 
The State Department Basic Authorities Act of 1956 
is amended— 
(1) 
in 
section 
402(a)(2) 
(22 
U.S.C. 
4352(a)(2)), by striking ‘‘26’’ and inserting ‘‘20’’; 
and 
(2) in section 404 (22 U.S.C. 4354)— 
(A) in subsection (a)(1), by striking 
‘‘30’’and inserting ‘‘25’’; and 
(B) in subsection (c)(1)(C), by striking 
‘‘30’’ and inserting ‘‘25’’. 
SEC. 1505. VULNERABILITY DISCLOSURE POLICY AND BUG 
BOUNTY PILOT PROGRAM. 
(a) DEFINITIONS.—In this section: 
(1) BUG BOUNTY PROGRAM.—The term ‘‘bug 
bounty program’’ means a program under which an 
approved individual, organization, or company is 
temporarily authorized to identify and report 
vulnerabilities of internet-facing information tech-
nology of the Department of State in exchange for 
compensation.
117 
(2) INFORMATION
TECHNOLOGY.—The term 
‘‘information technology’’ has the meaning given 
such term in section 11101 of title 40, United 
States Code. 
(b) VULNERABILITY DISCLOSURE PROCESS.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this Act, the Sec-
retary of State shall design, establish, and make 
publicly known a Vulnerability Disclosure Process 
(VDP) to improve Department of State cybersecu-
rity by— 
(A) providing security researchers with 
clear guidelines for— 
(i) conducting vulnerability discovery 
activities directed at Department informa-
tion technology; and 
(ii) submitting discovered security 
vulnerabilities to the Department; and 
(B) creating Department procedures and 
infrastructure to receive and fix discovered 
vulnerabilities. 
(2) REQUIREMENTS.—In establishing the VDP 
pursuant to paragraph (1), the Secretary of State 
shall—
118 
(A) identify which Department of State in-
formation technology should be included in the 
process; 
(B) determine whether the process should 
differentiate among and specify the types of se-
curity vulnerabilities that may be targeted; 
(C) provide a readily available means of re-
porting discovered security vulnerabilities and 
the form in which such vulnerabilities should be 
reported; 
(D) identify which Department offices and 
positions will be responsible for receiving, 
prioritizing, and addressing security vulner-
ability disclosure reports; 
(E) consult with the Attorney General re-
garding how to ensure that individuals, organi-
zations, and companies that comply with the re-
quirements of the process are protected from 
prosecution under section 1030 of title 18, 
United States Code, and similar provisions of 
law for specific activities authorized under the 
process; 
(F) consult with the relevant offices at the 
Department of Defense that were responsible 
for launching the 2016 Vulnerability Disclosure
119 
Program, ‘‘Hack the Pentagon’’, and subse-
quent Department of Defense bug bounty pro-
grams; 
(G) engage qualified interested persons, in-
cluding nongovernmental sector representatives, 
about the structure of the process as construc-
tive and to the extent practicable; and 
(H) award contracts to entities, as nec-
essary, to manage the process and implement 
the 
remediation 
of 
discovered 
security 
vulnerabilities. 
(3) ANNUAL
REPORTS.—Not later than 180 
days after the establishment of the VDP under para-
graph (1) and annually thereafter for the next five 
years, the Secretary of State shall submit to the 
Committee on Foreign Affairs of the House of Rep-
resentatives and the Committee on Foreign Rela-
tions of the Senate a report on the VDP, including 
information relating to the following: 
(A) The number and severity of all secu-
rity vulnerabilities reported. 
(B) The number of previously unidentified 
security vulnerabilities remediated as a result.