SECURE IT Act would require testing of voting system hardware against cyberattack

The Election Assistance Commission (EAC) is required by the Help America Vote Act to provide for the testing and certification, decertification and recertification of voting system hardware and software by accredited laboratories.

However, the legislation does not explicitly require penetration testing of voting systems.

The Strengthening Election Cybersecurity to Uphold Respect for Elections through Independent Testing (SECURE IT) Act would direct the EPA to require that systems seeking certification undergo penetration testing. The testing allows researchers to search for vulnerabilities by attempting to attack a system with the same tools and techniques used by cybercriminals.

The SECURE IT Act was introduced by U.S. Sens. Mark R. Warner of Virginia and Susan Collins of Maine to strengthen the security of U.S. election infrastructure by requiring that voting systems undergo simulated attacks as part of the standard certification process.

“If we’re going to defeat our adversaries, we have to be able to think like they do. The SECURE IT Act would allow researchers to step into the shoes of cybercriminals and uncover vulnerabilities and weaknesses that might not be found otherwise,” Warner said. “As foreign and domestic adversaries continue to target U.S. democracy, I’m proud to introduce legislation to harness a critical cybersecurity practice that will help safeguard our elections infrastructure.”

This legislation would direct the EAC and the National Institute of Standards and Technology (NIST) to accredit entities that can perform penetration testing to fulfill the aforementioned requirement. Additionally, the EAC would be directed to create a voluntary Coordinated Vulnerability Disclosure Program for election systems. Vetted researchers would be given access to voting systems voluntarily provided by manufacturers in order to discover vulnerabilities and disclose them to the manufacturer and EAC.

“This bipartisan legislation will strengthen the integrity of our election process by ensuring that voting systems are safe and secure,” Collins said. “It will help protect and bolster public confidence in our elections.”