Title II — S. 2053 (Introduced in Senate)

Sec. 201 Voting system cybersecurity requirements

(a)

Ballot tabulating devices— Section 301(a) of the Help America Vote Act of 2002 (52 U.S.C. 21081(a)), as amended by section 104 and section 105, is further amended by adding at the end the following new paragraph:

“(9) Ballot tabulating methods

“(A) In general—The voting system tabulates ballots by hand or through the use of an optical scanning device that meets the requirements of subparagraph (B).

“(B) Requirements for optical scanning devices—Except as provided in subparagraph (C), the requirements of this subparagraph are as follows:

“(i) The device is designed and built in a manner in which it is mechanically impossible for the device to add or change the vote selections on a printed or marked ballot.

“(ii) The device is capable of exporting its data (including vote tally data sets and cast vote records) in a machine-readable, open data standard format required by the Commission, in consultation with the Director of the National Institute of Standards and Technology.

“(iii) The device consists of hardware that demonstrably conforms to a hardware component manifest describing point-of-origin information (including upstream hardware supply chain information for each component) that—

“(I) has been provided to the Commission, the Director of Cybersecurity and Infrastructure Security, and the chief State election official for each State in which the device is used; and

“(II) may be shared by any entity to whom it has been provided under subclause (I) with independent experts for cybersecurity analysis.

“(iv) The device utilizes technology that prevents the operation of the device if any hardware components do not meet the requirements of clause (iii).

“(v) The device operates using software for which the source code, system build tools, and compilation parameters—

“(I) have been provided to the Commission, the Director of Cybersecurity and Infrastructure Security, and the chief State election official for each State in which the device is used; and

“(II) may be shared by any entity to whom it has been provided under subclause (I) with independent experts for cybersecurity analysis.

“(vi) The device utilizes technology that prevents the running of software on the device that does not meet the requirements of clause (v).

“(vii) The device utilizes technology that enables election officials, cybersecurity researchers, and voters to verify that the software running on the device—

“(I) was built from a specific, untampered version of the code that is described in clause (v); and

“(II) uses the system build tools and compilation parameters that are described in clause (v).

“(viii) The device contains such other security requirements as the Director of Cybersecurity and Infrastructure Security requires.

“(C) Waiver

“(i) In general—The Director of Cybersecurity and Infrastructure Security, in consultation with the Director of the National Institute of Standards and Technology, may waive one or more of the requirements of subparagraph (B) (other than the requirement of clause (i) thereof) with respect to any device for a period of not to exceed 2 years.

“(ii) Publication—Information relating to any waiver granted under clause (i) shall be made publicly available on the internet.

“(D) Effective date—Each State and jurisdiction shall be required to comply with the requirements of this paragraph for the regularly scheduled election for Federal office in November 2024, and for each subsequent election for Federal office.”

(b)

Other cybersecurity requirements— Section 301(a) of such Act (52 U.S.C. 21081(a)), as amended by section 104, section 105, and subsection (a), is further amended by adding at the end the following new paragraphs:

“(10) Prohibition of use of wireless communications devices in systems or devices

“(A) In general—No system or device upon which ballot marking devices or optical scanners are configured, upon which ballots are marked by voters (except as necessary for individuals with disabilities to use ballot marking devices that meet the accessibility requirements of paragraph (3)), or upon which votes are cast, tabulated, or aggregated shall contain, use, or be accessible by any wireless, power-line, or concealed communication device.

“(B) Effective date—Each State and jurisdiction shall be required to comply with the requirements of this paragraph for the regularly scheduled election for Federal office in November 2020, and for each subsequent election for Federal office.

“(11) Prohibiting connection of system to the internet

“(A) In general—No system or device upon which ballot marking devices or optical scanners are configured, upon which ballots are marked by voters, or upon which votes are cast, tabulated, or aggregated shall be connected to the internet or any non-local computer system via telephone or other communication network at any time.

“(B) Effective date—Each State and jurisdiction shall be required to comply with the requirements of this paragraph for the regularly scheduled election for Federal office in November 2020, and for each subsequent election for Federal office.”

(c)

Special cybersecurity rules for certain ballot marking devices—

(1)

In general— Section 301(a) of such Act (52 U.S.C. 21081(a)), as amended by section 104, section 105, and subsections (a) and (b), is further amended by adding at the end the following new paragraph:

“(12) Ballot marking devices

“(A) In general—In the case of a voting system that uses a ballot marking device, the ballot marking device shall be a device that—

“(i) is not capable of tabulating votes;

“(ii) except in the case of a ballot marking device used exclusively to comply with the requirements of paragraph (3), is certified in accordance with section 232 as meeting the requirements of subparagraph (B); and

“(iii) meets the requirements of clauses (iii) through (viii) of section 301(a)(9)(B).

“(B) Requirements

“(i) In general—A ballot marking device meets the requirements of this subparagraph if, during a double-masked test conducted by a qualified independent user experience research laboratory (as defined in section 232(b)(4)) of a simulated election scenario which meets the requirements of clause (ii), there is less than a 5 percent chance that an ordinary voter using the device would not detect and report any difference between the vote selection printed on the ballot by the ballot marking device and the vote selection indicated by the voter.

“(ii) Simulated election scenario—A simulated election scenario meets the requirements of this clause if it is conducted with—

“(I) a pool of subjects that are—

“(aa) diverse in age, gender, education, and physical limitations; and

“(bb) representative of the communities in which the voting system will be used; and

“(II) ballots that are representative of ballots ordinarily used in the communities in which the voting system will be used.

“(C) Effective date—Each State and jurisdiction shall be required to comply with the requirements of this paragraph for the regularly scheduled election for Federal office in November 2022, and for each subsequent election for Federal office.”

(2)

Procedure for testing—

(A)

In general— Subtitle B of title II of the Help America Vote Act of 2002 (52 U.S.C. 20971 et seq.) is amended by adding at the end the following new section:

“232. Testing and certification of ballot marking devices

“(a) In general—Any State or jurisdiction which intends to use a ballot marking device (other than a ballot marking device used exclusively to comply with the requirements of section 301(a)(3)) in an election for Federal office may submit an application to the Commission for testing and certification under this section.

“(b) Application, assignment, and testing

“(1) In general—An application under subsection (a) shall be submitted not later than 18 months before the date of the election for Federal office in which the ballot marking device is intended to be used and shall contain such information as the Commission requires.

“(2) Assignment—Upon receipt of an application for testing under this section, the Commission shall contract with a qualified independent user experience research laboratory for the testing of whether the ballot marking device intended to be used by the State or jurisdiction meets the requirements of section 301(a)(12)(B).

“(3) Requirements for testing—Any contract described in paragraph (2) shall require the qualified independent user experience research laboratory to—

“(A) not later than 30 days before testing begins, submit to the Commission for approval the protocol for the simulated election scenario used for testing the ballot marking device;

“(B) use only protocols approved by the Commission in conducting such testing; and

“(C) submit to the Commission a report on the results of the testing.

“(4) Qualified independent user experience research laboratory—For purposes of this section:

“(A) In general—The term qualified independent user experience research laboratory means a laboratory accredited under this subsection by the Election Assistance Commission in accordance with standards determined by the Commission, in consultation with the Director of the National Institute of Standards and Technology and the Secretary of Homeland Security.

“(B) Criteria—A laboratory shall not be accredited under this subsection unless such laboratory demonstrates that—

“(i) no employee of, or individual with an ownership in, such laboratory has, or has had during the 5 preceding years, any financial relationship with a manufacturer of voting systems; and

“(ii) any group of individuals conducting tests under this section collectively meet the following qualifications:

“(I) Experience designing and running user research studies and experiments using both qualitative and quantitative methodologies.

“(II) Experience with voting systems.

“(c) Review by independent board

“(1) In general—The Commission shall submit for approval to an independent review board established under paragraph (3) the following:

“(A) Any protocol submitted to the Commission under subsection (b)(3)(A).

“(B) Any report submitted to the Commission under subsection (b)(3)(C).

“(2) Final approval—Not later than the date that is 12 months before the date of the election for Federal office in which a State or jurisdiction intends to use the ballot marking device, the independent review board shall report to the Commission on whether it has approved a report submitted under paragraph (1)(B).

“(3) Independent review board

“(A) In general—An independent review board established under this paragraph shall be composed of five independent scientists appointed by the Commission, in consultation with the Director of the National Institute of Standards and Technology.

“(B) Qualifications—The members of the independent review board—

“(i) shall have expertise and relevant peer-reviewed publications in the following fields: cognitive psychology, experimental design, statistics, and user experience research and testing; and

“(ii) may not have, or have had during the 5 preceding years, any financial relationship with a manufacturer of voting systems.

“(4) Publication—The Commission shall make public—

“(A) any protocol approved under this subsection;

“(B) any report submitted under subsection (b)(3)(C); and

“(C) any determination made by an independent review board under paragraph (2).

“(d) Certification—If—

“(1) a ballot marking device is determined by the qualified independent user experience research laboratory to meet the requirements of section 301(a)(12); and

“(2) the report submitted under subsection (b)(3)(C) is approved by a majority of the members of the independent review board under subsection (d)(2),

“(e) Prohibition on fees—The Commission may not charge any fee to a State or jurisdiction, a developer or manufacturer of a ballot marking device, or any other person in connection with testing and certification under this section.”

(B)

Conforming amendments—

(i)

Section 202(2) of the Help America Vote Act of 2002 (52 U.S.C. 20922(2)) is amended by inserting “and ballot marking devices” after “hardware and software”).

(ii)

The heading for subtitle B of title II of such Act is amended by inserting at the end “; ballot marking devices”.

(iii)

The table of contents of such Act is amended—

(I)

by inserting “; Ballot Marking Devices” at the end of the item relating to subtitle B of title II; and

(II)

by inserting after the item related to section 231 the following:

Sec. 202 Testing of existing voting systems to ensure compliance with election cybersecurity guidelines and other guidelines

(a)

Requiring testing of existing voting systems—

(1)

In general— Section 231(a) of the Help America Vote Act of 2002 (52 U.S.C. 20971(a)) is amended by adding at the end the following new paragraph:

“(3) Testing to ensure compliance with guidelines

“(A) Testing—Not later than 9 months before the date of each regularly scheduled general election for Federal office, the Commission shall provide for the testing by accredited laboratories under this section of the voting system hardware and software which was certified for use in the most recent such election, on the basis of the most recent voting system guidelines applicable to such hardware or software (including election cybersecurity guidelines) issued under this Act.

“(B) Decertification of hardware or software failing to meet guidelines—If, on the basis of the testing described in subparagraph (A), the Commission determines that any voting system hardware or software does not meet the most recent guidelines applicable to such hardware or software issued under this Act, the Commission shall decertify such hardware or software.”

(2)

Effective date— The amendment made by paragraph (1) shall apply with respect to the regularly scheduled general election for Federal office held in November 2020 and each succeeding regularly scheduled general election for Federal office.

(b)

Issuance of cybersecurity guidelines by Technical Guidelines Development Committee— Section 221(b) of the Help America Vote Act of 2002 (52 U.S.C. 20961(b)) is amended by adding at the end the following new paragraph:

“(3) Election cybersecurity guidelines—Not later than 6 months after the date of the enactment of the Securing America’s Federal Elections Act, the Development Committee shall issue election cybersecurity guidelines, including standards and best practices for procuring, maintaining, testing, operating, and updating election systems to prevent and deter cybersecurity incidents.”

Sec. 203 Requiring use of software and hardware for which information is disclosed by manufacturer

(a)

Requirement— Section 301(a) of the Help America Vote Act of 2002 (52 U.S.C. 21081(a)), as amended by sections 104, 105, 201(a), 201(b), and 201(c), is amended by adding at the end the following new paragraph:

“(13) Requiring use of software and hardware for which information is disclosed by manufacturer

“(A) Requiring use of software for which source code is disclosed by manufacturer

“(i) In general—In the operation of voting systems in an election for Federal office, a State may only use software for which the manufacturer makes the source code (in the form in which will be used at the time of the election) publicly available online under a license that grants a worldwide, royalty-free, non-exclusive, perpetual, sub-licensable license to all intellectual property rights in such source code, except that the manufacturer may prohibit a person who obtains the software from using the software in a manner that is primarily intended for or directed toward commercial advantage or private monetary compensation that is unrelated to carrying out legitimate research or cybersecurity activity.

“(ii) Exceptions—Clause (i) does not apply with respect to—

“(I) widely used operating system software which is not specific to voting systems and for which the source code or baseline functionality is not altered; or

“(II) widely used cybersecurity software which is not specific to voting systems and for which the source code or baseline functionality is not altered.

“(B) Requiring use of hardware for which information is disclosed by manufacturer

“(i) Requiring disclosure of hardware—A State may not use a voting system in an election for Federal office unless the manufacturer of the system publicly discloses online the identification of the hardware used to operate the system.

“(ii) Additional disclosure requirements for custom or altered hardware—To the extent that the hardware used to operate a voting system or any component thereof is not widely used, or is widely used but is altered, the State may not use the system in an election for Federal office unless—

“(I) the manufacturer of the system publicly discloses online the components of the hardware, the design of such components, and how such components are connected in the operation of the system; and

“(II) the manufacturer makes the design (in the form which will be used at the time of the election) publicly available online under a license that grants a worldwide, royalty-free, non-exclusive, perpetual, sub-licensable license to all intellectual property rights in the design of the hardware or the component, except that the manufacturer may prohibit a person who obtains the design from using the design in a manner that is primarily intended for or directed toward commercial advantage or private monetary compensation that is unrelated to carrying out legitimate research or cybersecurity activity.”

(b)

Effective date— The amendment made by subsection (a) shall apply with respect to elections for Federal office held in 2020 or any succeeding year.

Sec. 204 Treatment of electronic poll books as part of voting systems

(a)

Inclusion in definition of voting system— Section 301(b) of the Help America Vote Act of 2002 (52 U.S.C. 21081(b)) is amended—

(1)

in the matter preceding paragraph (1), by striking “this section” and inserting “this Act”;

(2)

by striking “and” at the end of paragraph (1);

(3)

by redesignating paragraph (2) as paragraph (3); and

(4)

by inserting after paragraph (1) the following new paragraph:

“(2) any electronic poll book used with respect to the election; and”

(b)

Definition— Section 301 of such Act (52 U.S.C. 21081) is amended—

(1)

by redesignating subsections (c) and (d) as subsections (d) and (e); and

(2)

by inserting after subsection (b) the following new subsection:

“(c) Electronic poll book defined—In this Act, the term electronic poll book means the total combination of mechanical, electromechanical, or electronic equipment (including the software, firmware, and documentation required to program, control, and support the equipment) that is used—

“(1) to retain the list of registered voters at a polling location, or vote center, or other location at which voters cast votes in an election for Federal office; and

“(2) to identify registered voters who are eligible to vote in an election.”

(c)

Effective date— Section 301(e) of such Act (52 U.S.C. 21081(e)), as amended by section 107 and as redesignated by subsection (b), is amended—

(1)

in paragraph (1), by striking “paragraph (2)” and inserting “paragraphs (2) and (3)”; and

(2)

by adding at the end the following new paragraph:

“(3) Special rule for electronic poll books—In the case of the requirements of subsection (c) (relating to electronic poll books), each State and jurisdiction shall be required to comply with such requirements on or after January 1, 2020.”

Sec. 205 Pre-election reports on voting system usage

(a)

Requiring States To submit reports— Title III of the Help America Vote Act of 2002 (52 U.S.C. 21081 et seq.) is amended by inserting after section 301 the following new section:

“301A. Pre-election reports on voting system usage

“(a) Requiring States To submit reports—Not later than 120 days before the date of each regularly scheduled general election for Federal office, the chief State election official of a State shall submit a report to the Commission containing a detailed voting system usage plan for each jurisdiction in the State which will administer the election, including a detailed plan for the usage of electronic poll books and other equipment and components of such system.

“(b) Effective date—Subsection (a) shall apply with respect to the regularly scheduled general election for Federal office held in November 2020 and each succeeding regularly scheduled general election for Federal office.”

(b)

Clerical amendment— The table of contents of such Act is amended by inserting after the item relating to section 301 the following new item:

Sec. 206 Streamlining collection of election information

Section 202 of the Help America Vote Act of 2002 (52 U.S.C. 20922) is amended—

(1)

by striking “The Commission” and inserting “(a) In general.—The Commission”; and

(2)

by adding at the end the following new subsection:

“(b) Waiver of certain requirements—Subchapter I of chapter 35 of title 44, United States Code, shall not apply to the collection of information for purposes of maintaining the clearinghouse described in paragraph (1) of subsection (a).”

Title II — Promoting Cybersecurity Through Improvements in Election Administration

II Promoting Cybersecurity Through Improvements in Election Administration