H.R. 6315 — SECURE IT Act

This section requires the Election Assistance Commission (EAC) to provide for penetration testing (i.e., simulated cyberattacks to identify security vulnerabilities) as part of the testing, certification, decertification, and recertification of voting system hardware and software by accredited laboratories, not later than 180 days after enactment. It further directs the Director of the National Institute of Standards and Technology (NIST) to recommend entities for accreditation by the EAC to conduct such testing and certify compliance with related guidelines, with accreditation requirements constituting a subset of those for testing laboratories under existing law and based solely on penetration testing competence.

This section establishes a five-year Independent Security Testing and Coordinated Vulnerability Disclosure Pilot Program for Election Systems (VDP-E) within the U.S. Election Assistance Commission (EAC), in consultation with the Secretary of Homeland Security. The program requires the EAC to (1) enable voluntary vendor provision of election systems (including voting machines and source code) to vetted cybersecurity researchers; (2) set participation terms mandating researcher notification of vulnerabilities to vendors, EAC, and the Secretary, with 180-day confidentiality; (3) obligate vendors to provide patches or mitigations for critical or high vulnerabilities (per NIST standards) to state and local officials, with EAC notification; (4) expedite EAC review of patches for certified systems to 90 days (deeming approval if not completed); and (5) notify CISA of disclosed vulnerabilities after 180 days for inclusion in the Common Vulnerabilities and Exposures database. Participation is voluntary, with safe harbors treating authorized researcher testing and publication as compliant with the Computer Fraud and Abuse Act (18 U.S.C. 1030) and exempt from DMCA anti-circumvention prohibitions (17 U.S.C. 1201(a)(1)(A)); vulnerabilities are also FOIA-exempt (5 U.S.C. 552). (Thus, the program facilitates good-faith security research on election infrastructure—i.e., voting machines, voter databases, tabulation systems—without legal liability for participants, while requiring timely fixes.)