The requirements for such accreditation shall be a 
subset of the requirements for accreditation of lab-
oratories under subsection (b) and shall only be 
based on consideration of an entity’s competence to 
conduct penetration testing under this subsection.’’. 
SEC. 3. INDEPENDENT SECURITY TESTING AND COORDI-
NATED 
CYBERSECURITY 
VULNERABILITY 
DISCLOSURE PROGRAM FOR ELECTION SYS-
TEMS. 
(a) IN GENERAL.—Subtitle D of title II of the Help 
America Vote Act of 2002 (42 U.S.C. 15401 et seq.) is 
amended by adding at the end the following new part: 
‘‘PART 7—INDEPENDENT SECURITY TESTING AND 
COORDINATED 
CYBERSECURITY 
VULNER-
ABILITY DISCLOSURE PILOT PROGRAM FOR 
ELECTION SYSTEMS 
‘‘SEC. 297. INDEPENDENT SECURITY TESTING AND COORDI-
NATED 
CYBERSECURITY 
VULNERABILITY 
DISCLOSURE PILOT PROGRAM FOR ELEC-
TION SYSTEMS. 
‘‘(a) ESTABLISHMENT.—The Commission, in con-
sultation with the Secretary, shall establish an Inde-
pendent Security Testing and Coordinated Vulnerability 
Disclosure Pilot Program for Election Systems (VDP–E) 
(in this section referred to as the ‘program’) in order to 
VerDate Sep 11 2014 
01:28 Feb 29, 2024
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H7447.IH
H7447
ssavage on LAPJG3WLY3PROD with BILLS
test for and disclose cybersecurity vulnerabilities in elec-
tion systems. 
‘‘(b) DURATION.—The program shall be conducted 
for a period of 5 years. 
‘‘(c) REQUIREMENTS.—In carrying out the program, 
the Commission, in consultation with the Secretary, 
shall— 
‘‘(1) establish a mechanism by which an elec-
tion systems vendor may make their election system 
(including voting machines and source code) avail-
able to cybersecurity researchers participating in the 
program; 
‘‘(2) provide for the vetting of cybersecurity re-
searchers prior to their participation in the program, 
including the conduct of background checks; 
‘‘(3) establish terms of participation that— 
‘‘(A) describe the scope of testing per-
mitted under the program; 
‘‘(B) require researchers to— 
‘‘(i) notify the vendor, the Commis-
sion, and the Secretary of any cybersecu-
rity vulnerability they identify with respect 
to an election system; and 
VerDate Sep 11 2014 
01:28 Feb 29, 2024
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H7447.IH
H7447
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(ii) otherwise keep such vulnerability 
confidential for 180 days after such notifi-
cation; 
‘‘(C) require the good faith participation of 
all participants in the program; and 
‘‘(D) require an election system vendor, 
after receiving notification of a critical or high 
vulnerability (as defined by the National Insti-
tute of Standards and Technology) in an elec-
tion system of the vendor, to— 
‘‘(i) send a patch or propound some 
other fix or mitigation for such vulner-
ability to the appropriate State and local 
election officials, in consultation with the 
researcher who discovered it; and 
‘‘(ii) notify the Commission and the 
Secretary that such patch has been sent to 
such officials; 
‘‘(4) in the case where a patch or fix to address 
a vulnerability disclosed under paragraph (3)(B)(i) 
is intended to be applied to a system certified by the 
Commission, provide— 
‘‘(A) for the expedited review of such patch 
or fix within 90 days after receipt by the Com-
mission; and 
VerDate Sep 11 2014 
01:28 Feb 29, 2024
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H7447.IH
H7447
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(B) if such review is not completed by the 
last day of such 90-day period, that such patch 
or fix shall be deemed to be certified by the 
Commission; and 
‘‘(5) 180 days after the disclosure of a vulner-
ability under paragraph (3)(B)(i), notify the Direc-
tor of the Cybersecurity and Infrastructure Security 
Agency of the vulnerability for inclusion in the data-
base of Common Vulnerabilities and Exposures. 
‘‘(d) VOLUNTARY PARTICIPATION; SAFE HARBOR.— 
‘‘(1) VOLUNTARY
PARTICIPATION.—Participa-
tion in the program shall be voluntary for election 
systems vendors and researchers. 
‘‘(2) 
SAFE
HARBOR.—Research 
conducted 
under the program, and any subsequent publication 
of such research, shall be treated as follows: 
‘‘(A) The research and publication shall be 
treated as authorized in accordance with section 
1030 of title 18, United States Code (commonly 
known as the ‘Computer Fraud and Abuse 
Act’), (and similar State laws), and the election 
system vendor will not initiate or support legal 
action against the researcher for accidental, 
good faith violations of the program. 
VerDate Sep 11 2014 
01:33 Feb 29, 2024
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H7447.IH
H7447
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(B) The research and publication shall be 
exempt from the anti-circumvention rule of sec-
tion 1201 of title 17, United States Code (com-
monly known as the ‘Digital Millennium Copy-
right Act’), and the election system vendor will 
not bring a claim against a researcher for cir-
cumvention of technology controls. 
‘‘(3) RULE
OF
CONSTRUCTION.—Nothing in 
this subsection may be construed to limit or other-
wise affect any exception to the general prohibition 
against the circumvention of technological measures 
under subparagraph (A) of section 1201(a)(1) of 
title 17, United States Code, including with respect 
to any use that is excepted from that general prohi-
bition by the Librarian of Congress under subpara-
graphs (B) through (D) of such section 1201(a)(1). 
‘‘(4) EXEMPT FROM DISCLOSURE.—Cybersecu-
rity vulnerabilities discovered under the program 
shall be exempt from section 552 of title 5, United 
States Code (commonly referred to as the Freedom 
of Information Act). 
‘‘(e) DEFINITIONS.—In this section: 
‘‘(1) CYBERSECURITY
VULNERABILITY.—The 
term ‘cybersecurity vulnerability’ means, with re-
VerDate Sep 11 2014 
01:28 Feb 29, 2024
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H7447.IH
H7447
ssavage on LAPJG3WLY3PROD with BILLS
spect to an election system, any security vulner-
ability that affects the election system. 
‘‘(2) ELECTION INFRASTRUCTURE.—The term 
‘election infrastructure’ means— 
‘‘(A) storage facilities, polling places, and 
centralized vote tabulation locations used to 
support the administration of elections for pub-
lic office; and 
‘‘(B) related information and communica-
tions technology, including— 
‘‘(i) voter registration databases; 
‘‘(ii) election management systems; 
‘‘(iii) voting machines; 
‘‘(iv) electronic mail and other com-
munications systems (including electronic 
mail and other systems of vendors who 
have entered into contracts with election 
agencies to support the administration of 
elections, manage the election process, and 
report and display election results); and 
‘‘(v) other systems used to manage 
the election process and to report and dis-
play election results on behalf of an elec-
tion agency. 
VerDate Sep 11 2014 
01:28 Feb 29, 2024
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H7447.IH
H7447
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(3) ELECTION
SYSTEM.—The term ‘election 
system’ means any information system that is part 
of an election infrastructure, including any related 
information and communications technology de-
scribed in paragraph (2)(B). 
‘‘(4) ELECTION
SYSTEM
VENDOR.—The term 
‘election system vendor’ means any person providing, 
supporting, or maintaining an election system on be-
half of a State or local election official. 
‘‘(5) INFORMATION SYSTEM.—The term ‘infor-
mation system’ has the meaning given the term in 
section 3502 of title 44, United States Code. 
‘‘(6) SECRETARY.—The term ‘Secretary’ means 
the Secretary of Homeland Security. 
‘‘(7) SECURITY
VULNERABILITY.—The term 
‘security vulnerability’ has the meaning given the 
term in section 102 of the Cybersecurity Information 
Sharing Act of 2015 (6 U.S.C. 1501).’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
of such Act is amended by adding at the end of the items 
relating to subtitle D of title II the following: 
‘‘PART 7—INDEPENDENT SECURITY TESTING AND COORDINATED CYBERSE-
CURITY VULNERABILITY DISCLOSURE PROGRAM FOR ELECTION SYSTEMS 
‘‘Sec. 297. Independent security testing and coordinated cybersecurity vulner-
ability disclosure program for election systems.’’. 
Æ 
VerDate Sep 11 2014 
01:28 Feb 29, 2024
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6301
E:\BILLS\H7447.IH
H7447
ssavage on LAPJG3WLY3PROD with BILLS