IIB 
116TH CONGRESS 
1ST SESSION 
H. R. 328 
IN THE SENATE OF THE UNITED STATES 
JANUARY 23 (legislative day, JANUARY 22), 2019 
Received; read twice and referred to the Committee on Foreign Relations 
AN ACT 
To require the Secretary of State to design and establish 
a Vulnerability Disclosure Process (VDP) to improve De-
partment of State cybersecurity and a bug bounty pro-
gram to identify and report vulnerabilities of internet- 
facing information technology of the Department of 
State, and for other purposes. 
VerDate Sep 11 2014 
20:37 Jan 23, 2019
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H328.RFS
H328
pamtmann on DSKBFK8HB2PROD with BILLS
HR 328 RFS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Hack Your State De-
partment Act’’. 
SEC. 2. DEFINITIONS. 
In this Act: 
(1) BUG BOUNTY PROGRAM.—The term ‘‘bug 
bounty program’’ means a program under which an 
approved individual, organization, or company is 
temporarily authorized to identify and report 
vulnerabilities of internet-facing information tech-
nology of the Department in exchange for compensa-
tion. 
(2) DEPARTMENT.—The term ‘‘Department’’ 
means the Department of State. 
(3) INFORMATION
TECHNOLOGY.—The term 
‘‘information technology’’ has the meaning given 
such term in section 11101 of title 40, United 
States Code. 
(4) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of State. 
VerDate Sep 11 2014 
20:37 Jan 23, 2019
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H328.RFS
H328
pamtmann on DSKBFK8HB2PROD with BILLS
HR 328 RFS
SEC. 3. DEPARTMENT OF STATE VULNERABILITY DISCLO-
SURE PROCESS. 
(a) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act, the Secretary shall de-
sign, establish, and make publicly known a Vulnerability 
Disclosure Process (VDP) to improve Department cyber-
security by— 
(1) providing security researchers with clear 
guidelines for— 
(A) conducting vulnerability discovery ac-
tivities directed at Department information 
technology; and 
(B) submitting discovered security vulnera-
bilities to the Department; and 
(2) creating Department procedures and infra-
structure to receive and fix discovered vulnerabili-
ties. 
(b) REQUIREMENTS.—In establishing the VDP pur-
suant to paragraph (1), the Secretary shall— 
(1) identify which Department information 
technology should be included in the process; 
(2) determine whether the process should dif-
ferentiate among and specify the types of security 
vulnerabilities that may be targeted; 
VerDate Sep 11 2014 
20:37 Jan 23, 2019
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H328.RFS
H328
pamtmann on DSKBFK8HB2PROD with BILLS
HR 328 RFS
(3) provide a readily available means of report-
ing discovered security vulnerabilities and the form 
in which such vulnerabilities should be reported; 
(4) identify which Department offices and posi-
tions will be responsible for receiving, prioritizing, 
and addressing security vulnerability disclosure re-
ports; 
(5) consult with the Attorney General regarding 
how to ensure that individuals, organizations, and 
companies that comply with the requirements of the 
process are protected from prosecution under section 
1030 of title 18, United States Code, and similar 
provisions of law for specific activities authorized 
under the process; 
(6) consult with the relevant offices at the De-
partment of Defense that were responsible for 
launching the 2016 Vulnerability Disclosure Pro-
gram, ‘‘Hack the Pentagon’’, and subsequent De-
partment of Defense bug bounty programs; 
(7) engage qualified interested persons, includ-
ing nongovernmental sector representatives, about 
the structure of the process as constructive and to 
the extent practicable; and 
VerDate Sep 11 2014 
20:37 Jan 23, 2019
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H328.RFS
H328
pamtmann on DSKBFK8HB2PROD with BILLS
HR 328 RFS
(8) award contracts to entities, as necessary, to 
manage the process and implement the remediation 
of discovered security vulnerabilities. 
(c) ANNUAL REPORTS.—Not later than 180 days 
after the establishment of the VDP under subsection (a) 
and annually thereafter for the next six years, the Sec-
retary of State shall submit to the Committee on Foreign 
Affairs of the House of Representatives and the Com-
mittee on Foreign Relations of the Senate a report on the 
VDP, including information relating to the following: 
(1) The number and severity, in accordance 
with the National Vulnerabilities Database of the 
National Institute of Standards and Technology, of 
security vulnerabilities reported. 
(2) The number of previously unidentified secu-
rity vulnerabilities remediated as a result. 
(3) The current number of outstanding pre-
viously unidentified security vulnerabilities and De-
partment of State remediation plans. 
(4) The average length of time between the re-
porting of security vulnerabilities and remediation of 
such vulnerabilities. 
(5) The resources, surge staffing, roles, and re-
sponsibilities within the Department used to imple-
VerDate Sep 11 2014 
20:37 Jan 23, 2019
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H328.RFS
H328
pamtmann on DSKBFK8HB2PROD with BILLS