HF 2250 (LSB 6053YH (2) 88)

HOUSE FILE 2250

BY  MASCHER

A BILL FOR

An Act relating to election systems security.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  ELECTION SYSTEMS SECURITY.
   1.  The state commissioner of elections shall adopt rules requiring each county commissioner of elections to do all of the following:
   a.  Become or remain a member of the election infrastructure information sharing and analysis center.
   b.  Use the following services provided by the United States department of homeland security:
   (1)  Phishing campaign assessment.
   (2)  Vulnerability scanning.
   (3)  Risk and vulnerability assessment.
   (4)  Remote penetration testing.
   (5)  Validated architectural design review.
   (6)  Cyber threat hunt.
   (7)  Tabletop exercise.
   (8)  Physical security assessment.
   c.  Review the elections infrastructure playbook of the center for internet security and create an elections infrastructure security assessment.
   d.  Use transport layer security or secure socket layer certificates for all publicly facing and internal web-based applications.
   e.  Consider participating in the cloudflare athenian project.
   f.  Consider using google project shield.
   g.  Use a domain name ending in “.gov” or “.us” for each elections-related internet site and all elections-related official electronic mail communications. 
   h.  Conduct annual training on election cybersecurity and physical security.
   i.  Require each employee, vendor, and contractor that performs services that require access to personal information relates to computer networks, information systems, databases, or secure facilities of the commissioner or the state commissioner of elections under circumstances that would permit modifications to such systems, or involve unsupervised access to secure facilities, to undergo a criminal background check.
   j.  Comply with the center for internet security guide for ensuring security in elections technical procurements.
   k.  Use domain-based message authentication, reporting, and conformance to prevent electronic mail spoofing.
   2.  The state commissioner of elections shall do all of the following:
   a.  Ensure that all computers used by the state commissioner of elections and employees are fully updated.
   b.  Modernize the software used to operate the statewide voter registration database.
   c.  Implement multifactor authentication for all web-based applications available to election officials.
   d.  Provide albert intrusion detection devices to all counties that do not currently use such a device or a substantially similar device.
   e.  Provide security information and event management services for elections-related computer and network systems.
    Sec. 2.  IMPLEMENTATION OF ACT.  Section 25B.2, subsection 3, shall not apply to this Act.
EXPLANATION
The inclusion of this explanation does not constitute agreement with
the explanation’s substance by the members of the general assembly.
   This bill relates to election systems security. The bill requires the state commissioner of elections to adopt rules requiring county commissioners of elections to take certain actions relating to election security, including using services provided by the United States department of homeland security, using certain third-party security services and guides, and requiring background checks for certain employees and contractors.
   The bill requires the state commissioner of elections to ensure that all computers used by the state commissioner of elections and employees are fully updated, modernize the software used to operate the statewide voter registration database, implement multifactor authentication for all web-based applications available to election officials, provide albert intrusion detection devices to all counties that do not currently use such a device or a substantially similar device, and provide security information and event management services for elections-related computer and network systems.
   The bill may include a state mandate as defined in Code section 25B.3. The bill makes inapplicable Code section 25B.2, subsection 3, which would relieve a political subdivision from complying with a state mandate if funding for the cost of the state mandate is not provided or specified. Therefore, political subdivisions are required to comply with any state mandate included in the bill.