Review – HR 6315 Introduced – Election System Pentests

Earlier this month Rep Valadao (R,CA) introduced HR 6315, the Strengthening Election Cybersecurity to Uphold Respect for Elections through Independent Testing (SECURE IT) Act. The bill would amend the Help America Vote Act of 2002, by adding to the existing election system certification system a requirement to conduct 3^rd party penetration testing of such systems. It would also establish a voluntary elections system vulnerability disclosure program. No new funding is authorized by the legislation.

HR 6315 is essentially the same as HR 7447, the Strengthening Election Cybersecurity to Uphold Respect for Elections through Independent Testing (SECURE IT) Act, that was introduced by Rep Spanberger (D,VA) in February 2024; Valadao was a cosponsor of that bill. No further action was taken on that bill in the 118^th Congress.

Moving Forward

Neither Valadao, nor his sole cosponsor {Rep Deluzio (D,PA)}, are members of the House Administration Committee to which this bill was assigned for primary consideration. This means that there is not sufficient influence to see the bill considered in Committee. I suspect that there would be some level of bipartisan support for the bill were it to be considered. What is not clear is if there would be enough to see the bill considered by the full House under the suspension of the rules process.

Commentary

While the proposed §231(e) uses the term ‘penetration testing’ it does not provide a definition of that term. I would suggest using the definition of that term found in NIST SP 800-115, Technical Guide to Information Security Testing and Assessment (pg F1):

“Security testing in which evaluators mimic real-world attacks in an attempt to identify ways to circumvent the security features of an application, system, or network. Penetration testing often involves issuing real attacks on real systems and data, using the same tools and techniques used by actual attackers. Most penetration tests involve looking for combinations of vulnerabilities on a single system or multiple systems that can be used to gain more access than could be achieved through a single vulnerability.”

 

For more details about the provisions of the bill, including additional commentary on the definition of penetration testing, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-6315-introduced-election-system - subscription required.

Review - HR 7447 Introduced – Election System Pentests

Last month, Rep Spanberger (D,VA) introduced HR 7447, the Strengthening Election Cybersecurity to Uphold Respect for Elections through Independent Testing (SECURE IT) Act. The bill would amend the Help America Vote Act of 2002, by adding to the existing election system certification system a requirement to conduct 3^rd party penetration testing of such systems. It would also establish a voluntary vulnerability disclosure program. No new funding is authorized by the legislation.

Moving Forward

Neither Spanberger nor her two cosponsors {Rep Deluzio (D,PA) and Rep Valadao (R,CA)} are members of the House Administration Committee to which this bill was assigned for primary consideration, nor the House Science, Space, and Technology Committee to which the bill was assigned for secondary consideration. This means that there is practically no chance that the bill will be considered by either committee. I see nothing in the bill that would engender any organized opposition. I suspect that it would receive some level of bipartisan support were it considered.

Commentary

While the term ‘penetration testing’ is used in the legislation, it is never defined. I would suggest using the definition of that term found in NIST 800-95 (pg C-3):

“A method of testing where testers target individual binary components or the application as a whole to determine whether intra or intercomponent vulnerabilities can be exploited to compromise the application, its data, or its environment resources.”

 

For more details about the provisions of this legislation, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-7447-introduced - subscription required.

Bills Introduced – 2-23-24

Yesterday, with the House and Senate meeting in pro forma session, there were 27 bills introduced. One of those bills will receive additional coverage in this blog:

HR 7447 To amend the Help America Vote Act of 2002 to require the Election Assistance Commission to provide for the conduct of penetration testing as part of the testing and certification of voting systems and to provide for the establishment of an Independent Security Testing and Coordinated Vulnerability Disclosure Pilot Program for Election Systems. Spanberger, Abigail Davis [Rep.-D-VA-7] 

Mention in Passing

Periodically, it looks like a legislative topic will strike the interest of multiple congressional staffs at the same time, resulting with multiple bills addressing the same topic. Normally, the legislative topic is a partisan issue with members wishing to make a political statement, but periodically an issue comes up that crosses party lines. Yesterday, one such bipartisan issue apparently struck a cord in the House; transnational repression. Three bills were introduced on the topic:

HR 7433 To amend the Homeland Security Act of 2002 to establish a transnational repression hotline and conduct a transnational repression public service announcement campaign, and for other purposes. D'Esposito, Anthony [Rep.-R-NY-4]

HR 7439 To amend the Homeland Security Act of 2002 to require the Secretary of Homeland Security to prioritize strengthening of State and local law enforcement capabilities to combat transnational repression and related terrorism threats, and for other purposes. Magaziner, Seth [Rep.-D-RI-2] 

HR 7443 To authorize a dedicated transnational repression office within the Department of Homeland Security's Homeland Security Investigations to analyze and monitor transnational repression and related terrorism threats and require Homeland Security Investigations to take actions to prevent transnational repression. Pfluger, August [Rep.-R-TX-11]