Sec. 6. Cybersecurity requirements for and testing and certification of voting systems
638 words·~3 min read·
/bill/116/s/1472/is/section-6A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Subtitle A of title XXII of the Homeland Security Act of 2002 ( 6 U.S.C. 651 et seq.) is amended by adding at the end the following: Not later than 180 days after the date of enactment of Protecting American Votes and Elections Act of 2019 , the Secretary, acting through the Director, shall promulgate rules establishing minimum cybersecurity requirements for the use in Federal elections of— optical scanning devices (within the meaning of section 301(a)(7) of the Help America Vote Act of 2002); ballot marking devices (within the meaning of section 301(a)(10) of such Act); election management systems, including those systems used— to configure optical scanning devices and ballot marking devices; to aggregate election results; and to design paper ballots; electronic poll books; any government database, website, or associated information system used by voters or government agencies for voter registration (including the management of voter registration status); systems used to deliver or publish election results; and such other components of voting systems (as defined in section 301(b) of such Act) as is determined appropriate by the Director.
Any State or jurisdiction which intends to use a ballot marking device or an optical scanning device in an election for Federal office may submit an application to the Director for cybersecurity testing and certification of the hardware and software of such device under this section. Upon receipt of an application for testing under this section, the Director, in consultation with the Director of the National Institute of Standards and Technology, shall contract with a qualified laboratory for the testing of whether the ballot marking device or optical scanning device intended to be used by the State or jurisdiction, as the case may be, meets the requirements of section 301(a)(7)(B) of the Help America Vote Act of 2002.
In the case of a ballot marking device or optical scanning device for which the source code has been published under an open source license, the contract under subparagraph
(A)shall also include, at the request of any State or jurisdiction, testing of whether such device meets any applicable requirements of the State or jurisdiction. Any contract described in paragraph
(1)shall require the qualified research laboratory to— not later than 30 days before testing begins, submit to the Director for approval the protocol for the simulated election scenario used for testing the security of the ballot marking device or optical scanning device, as the case may be; use only protocols approved by the Director in conducting such security testing; and submit to the Director a report on the results of the security testing. For purposes of this section, the term qualified research laboratory means a laboratory accredited under this subsection by the Director, in consultation with the Director of the National Institute of Standards and Technology. The Director shall— publish on the website of the Cybersecurity and Infrastructure Security Agency the results of the testing conducted under subsection (b); and certify a ballot marking device or optical scanning device if the ballot marking device or optical scanning device, as the case may be, is determined by the qualified research laboratory to meet the requirements of section 301(a)(7)(B) of the Help America Vote Act of 2002. The Director may not charge any fee to a State or jurisdiction, a developer or manufacturer of a ballot marking device or optical scanning device, or any other person in connection with testing and certification under this section (including any testing conducted under subsection (b)(1)(B)). . The table of contents in section 1(b) of the Homeland Security Act of 2002 ( Public Law 107–296 ; 116 Stat. 2135) is amended by inserting after the item relating to section 2214 the following: Sec. 2215. Mandatory cybersecurity requirements for systems used in Federal elections. Sec. 2216. Testing and certification of ballot marking and optical scanning device cybersecurity. .
Connectionstraces to 1
Traces to 1 document
U.S. Code
2 references not yet in our index
- Pub. L. 107-296
- 116 Stat. 2135
Citation graph
cites case law
Sec. 6
Cybersecurity requirements for and testing and certification of voting systems
Pub. L.Pub. L. 107-296
Stat.116 Stat. 2135
Cites 3Cited by 0 across 0 sources