Title: Election Vendor Security Act
Policy area: Government Operations and Politics

Summary:
Election Vendor Security Act
This bill prohibits state and local governmental entities that are responsible for administering an election for federal office from entering into an agreement with a vendor who is a foreign national or who fails to meet current best practices for cybersecurity established by the U.S. Election Assistance Commission and the Department of Homeland Security.
Before each regularly scheduled general election for federal office (beginning with the November 2018 election), each state shall submit to the commission a list of all vendors who will be providing, supporting, or maintaining any components of an election system in such state.

[Congressional Bills 115th Congress]
[From the U.S. Government Publishing Office]
[H.R. 6435 Introduced in House (IH)]

<DOC>






115th CONGRESS
  2d Session
                                H. R. 6435

  To amend the Help America Vote Act of 2002 to prohibit States from 
 entering into agreements with vendors for the provision, support, or 
maintenance of election systems if the vendors are owned or controlled 
 by persons who are not citizens, nationals, or permanent residents of 
the United States or do not meet cybersecurity best practices, and for 
                            other purposes.


_______________________________________________________________________


                    IN THE HOUSE OF REPRESENTATIVES

                             July 18, 2018

    Mr. Raskin (for himself, Mr. Hoyer, Mr. Sarbanes, Mr. Brady of 
 Pennsylvania, Ms. Lofgren, Mr. Cummings, Mr. Ruppersberger, Mr. Brown 
  of Maryland, and Ms. Meng) introduced the following bill; which was 
           referred to the Committee on House Administration

_______________________________________________________________________

                                 A BILL


 
  To amend the Help America Vote Act of 2002 to prohibit States from 
 entering into agreements with vendors for the provision, support, or 
maintenance of election systems if the vendors are owned or controlled 
 by persons who are not citizens, nationals, or permanent residents of 
the United States or do not meet cybersecurity best practices, and for 
                            other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Election Vendor Security Act''.

SEC. 2. PROHIBITING AGREEMENTS WITH VENDORS FOR OPERATION OF ELECTION 
              SYSTEMS WHO ARE FOREIGN NATIONALS OR WHO FAIL TO MEET 
              CYBERSECURITY BEST PRACTICES.

    (a) Prohibition.--Title III of the Help America Vote Act of 2002 
(52 U.S.C. 21083 et seq.) is amended--
            (1) by redesignating sections 304 and 305 as sections 305 
        and 306; and
            (2) by inserting after section 303 the following new 
        section:

``SEC. 304. REQUIREMENTS FOR VENDORS OF ELECTION SYSTEMS.

    ``(a) Prohibiting Agreements With Vendors Failing To Meet 
Requirements.--A State, unit of local government, or any component of a 
State or unit of local government which is responsible for the 
administration of an election for Federal office may not enter into an 
agreement with a vendor to provide, support, or maintain any component 
of the election system unless the vendor meets the criteria described 
in subsection (b).
    ``(b) Criteria for Vendors.--The criteria described in this 
subsection with respect to a vendor are as follows, as established and 
published by the Chair of the Commission in coordination with the 
Secretary of Homeland Security:
            ``(1) The vendor shall certify that it is owned and 
        controlled by a citizen, national, or permanent resident of the 
        United States, and that none of its activities are directed, 
        supervised, controlled, subsidized, or financed, and none of 
        its policies are determined by, any foreign principal (as 
        defined in section 1(b) of the Foreign Agents Registration Act 
        of 1938 (22 U.S.C. 611(b)), or by any agent of a foreign 
        principal required to register under such Act.
            ``(2) The vendor shall disclose to the Chair and the 
        Secretary, and to the chief State election official of any 
        State in which the vendor provides, supports, or maintains any 
        component of an election system, any sourcing outside the 
        United States for parts of the system.
            ``(3) The vendor shall ensure that the election system will 
        be developed and maintained in a manner that is consistent with 
        the cybersecurity best practices established under subsection 
        (c).
            ``(4) The vendor shall maintain its information technology 
        infrastructure in a manner that is consistent with the 
        cybersecurity best practices established under subsection (c).
            ``(5) The vendor shall report any known or suspected 
        security incidents involving election systems to the chief 
        State election official of the State involved or the official's 
        designee, the Chair, and the Secretary not later than 10 days 
        after the vendor first knows or suspects that the incident 
        occurred.
    ``(c) Cybersecurity Best Practices.--Not later than 90 days after 
the date of the enactment of this section, the Chair and the Secretary 
of Homeland Security shall establish and publish cybersecurity best 
practices for vendors who provide, support, or maintain election 
systems, and shall establish and publish updates to such best practices 
at such times as the Chair and the Secretary consider appropriate.
    ``(d) Availability of List of Participating Vendors.--
            ``(1) Submission of list to commission.--Not later than 90 
        days before the date of each regularly scheduled general 
        election for Federal office (beginning with the election held 
        in November 2018), each State shall submit to the Commission a 
        list of all vendors who will be providing, supporting, or 
        maintaining any component of any election system which will be 
        used to carry out such election in the State.
            ``(2) Posting by commission.--Upon receiving a list from a 
        State under paragraph (1), the Commission shall post the list 
        on the official public website of the Commission.
    ``(e) Election System Defined.--In this section, the term `election 
system' means any system used in the administration of elections for 
Federal office, as well as related information and communications 
technology, including voter registration databases, voting machines, 
electronic mail and other communications systems (including electronic 
mail and other systems of vendors who have entered into contracts with 
election agencies to support the administration of elections, manage 
the election process, and report and display election results), and 
other systems used to manage the election process and to report and 
display election results on behalf of a State or unit of local 
government.''.
    (b) Conforming Amendment Relating to Enforcement.--Section 401 of 
such Act (52 U.S.C. 21111) is amended by striking ``and 303'' and 
inserting ``303, and 304''.
    (c) Clerical Amendments.--The table of contents of such Act is 
amended--
            (1) by redesignating the items relating to sections 304 and 
        305 as relating to sections 305 and 306; and
            (2) by inserting after the item relating to section 303 the 
        following new item:

``Sec. 304. Requirements for vendors of election systems.''.
    (d) Effective Date.--The amendments made by this section shall 
apply with respect to the regularly scheduled general election for 
Federal office held in November 2018 and each succeeding election for 
Federal office.
                                 <all>