1.1 	A bill for an act
1.2 	relating to elections; providing for election technology and cybersecurity 
1.3 	assessment, maintenance, and enhancement; requiring certain election security 
1.4 	notifications;amending Minnesota Statutes 2018, sections 201.022, subdivision 
1.5 	1; 204B.27, subdivisions 5, 10; 206.57, subdivision 6; proposing coding for new 
1.6 	law in Minnesota Statutes, chapters 5; 209.
1.7 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.8 	Section 1. [5.42] TECHNOLOGY AND CYBERSECURITY FUND.
1.9 		Subdivision 1.Definitions. For the purposes of this section, the terms defined in this 
1.10 	subdivision have the meanings given them:
1.11 	(1) "information and telecommunications technology systems and services" has the 
1.12 	meaning given in section 16E.03, subdivision 1, paragraph (b); and
1.13 	(2) "cybersecurity" has the meaning given in section 16E.03, subdivision 1, paragraph 
1.14 	(e).
1.15 		Subd. 2.Special revenue fund. (a) The secretary of state may retain two percent of all 
1.16 	statutory fees collected by the secretary of state for costs to maintain and enhance the 
1.17 	secretary of state's information and telecommunications technology systems and services 
1.18 	and for cybersecurity.
1.19 	(b) Money received under this subdivision must be deposited in an account in the special 
1.20 	revenue fund and is appropriated to the secretary of state for purposes of this subdivision.

2.1 	Sec. 2. Minnesota Statutes 2018, section 201.022, subdivision 1, is amended to read:
2.2 		Subdivision 1.Establishment. The secretary of state shall maintain a statewide voter 
2.3 	registration system to facilitate voter registration and to provide a central database containing 
2.4 	voter registration information from around the state. The system must be accessible to the
2.5 	any county auditor of each county in the state who has completed any required training 
2.6 	established under section 204B.27, subdivision 10. The system must also:
2.7 	(1) provide for voters to submit their voter registration applications to any county auditor, 
2.8 	the secretary of state, or the Department of Public Safety;
2.9 	(2) provide for the definition, establishment, and maintenance of a central database for 
2.10 	all voter registration information;
2.11 	(3) provide for entering data into the statewide registration system;
2.12 	(4) provide for electronic transfer of completed voter registration applications from the 
2.13 	Department of Public Safety to the secretary of state or the county auditor;
2.14 	(5) assign a unique identifier to each legally registered voter in the state;
2.15 	(6) provide for the acceptance of the Minnesota driver's license number, Minnesota state 
2.16 	identification number, and last four digits of the Social Security number for each voter 
2.17 	record;
2.18 	(7) coordinate with other agency databases within the state;
2.19 	(8) allow county auditors and the secretary of state to add or modify information in the 
2.20 	system to provide for accurate and up-to-date records;
2.21 	(9) allow county auditors, municipal and school district clerks, and the secretary of state 
2.22 	to have electronic access to the statewide registration system for review and search 
2.23 	capabilities;
2.24 	(10) provide security and protection of all information in the statewide registration 
2.25 	system and ensure that unauthorized access is not allowed;
2.26 	(11) provide access to municipal clerks to use the system;
2.27 	(12) provide a system for each county to identify the precinct to which a voter should 
2.28 	be assigned for voting purposes;
2.29 	(13) provide daily reports accessible by county auditors on the driver's license numbers, 
2.30 	state identification numbers, or last four digits of the Social Security numbers submitted on 
3.1 	voter registration applications that have been verified as accurate by the secretary of state; 
3.2 	and
3.3 	(14) provide reports on the number of absentee ballots transmitted to and returned and 
3.4 	cast by voters under section 203B.16.; and
3.5 	(15) require all users to use a multifactor authentication method approved by the secretary 
3.6 	of state to access the system.
3.7 	The appropriate state or local official shall provide security measures to prevent 
3.8 	unauthorized access to the computerized list established under section 201.021.

3.9 	Sec. 3. Minnesota Statutes 2018, section 204B.27, subdivision 5, is amended to read:
3.10 		Subd. 5.Conferences for county auditors. Before each state primary the secretary of 
3.11 	state shall conduct conferences with county auditors to instruct them on the administration 
3.12 	of election laws, election security and best practices, and the training of local election 
3.13 	officials and election judges.

3.14 	Sec. 4. Minnesota Statutes 2018, section 204B.27, subdivision 10, is amended to read:
3.15 		Subd. 10.Training for county auditors; training materials. The secretary of state 
3.16 	shall develop a training program in election administration for county auditors and shall 
3.17 	certify each county auditor who successfully completes the training program. The secretary 
3.18 	of state shall provide each county auditor with materials for use in training local election 
3.19 	officials and election judges. The training program and materials for use in training local 
3.20 	election officials must include training on election security and best practices. The secretary 
3.21 	of state may require additional training for an election official before providing the election 
3.22 	official access to the statewide voter registration system.

3.23 	Sec. 5. Minnesota Statutes 2018, section 206.57, subdivision 6, is amended to read:
3.24 		Subd. 6.Required certification testing. (a) In addition to the requirements in subdivision 
3.25 	1, a voting system must be certified by an independent testing authority accredited by the 
3.26 	Election Assistance Commission or appropriate federal agency responsible for testing and 
3.27 	certification of compliance with the federal voting systems guidelines at the time of 
3.28 	submission of the application required by subdivision 1 to be in conformity with voluntary 
3.29 	voting system guidelines issued by the Election Assistance Commission or other previously 
3.30 	referenced agency. The application must be accompanied by the certification report of the 
3.31 	voting systems test laboratory. A certification under this section from an independent testing 
4.1 	authority accredited by the Election Assistance Commission or other previously referenced 
4.2 	agency meets the requirement of Minnesota Rules, part 8220.0350, item L.
4.3 	(b) A vendor must provide a copy of the source code for the voting system to the secretary 
4.4 	of state. The secretary of state may facilitate assessments of the voting system, the source 
4.5 	code, and the voting system's cybersecurity protections by an independent third-party 
4.6 	evaluator, in cooperation with the vendor, to identify and report election security 
4.7 	vulnerabilities. An independent technical expert must promptly notify the secretary of state 
4.8 	and vendor about any relevant cybersecurity vulnerabilities discovered through the assessment 
4.9 	and provide technical assistance in remedying the vulnerabilities.
4.10 	(c) A chair of a major political party or the secretary of state may select, in consultation 
4.11 	with the vendor, an independent third-party evaluator to examine the source code to ensure 
4.12 	that it functions as represented by the vendor and that the code is free from defects. A major 
4.13 	political party that elects to have the source code examined must pay for the examination.
4.14 	(d) Except as provided by this subdivision, a source code that is trade secret information 
4.15 	must be treated as nonpublic information, according to section 13.37. A third-party evaluator 
4.16 	must not disclose the source code to anyone else.
4.17 	(e) Before completing a purchase agreement for a voting system with a county or 
4.18 	municipality, a vendor must provide the county or municipality with end-of-life and 
4.19 	end-of-support dates for systems, devices, or products containing software or upgradable 
4.20 	firmware. The vendor must provide timely security updates to a voting system provided to 
4.21 	a county or municipality during the agreed-upon period for use of the voting system to 
4.22 	maintain the voting system's certification under this section.

4.23 	Sec. 6. [209.96] VENDOR NOTIFICATIONS.
4.24 		Subdivision 1.Definitions. (a) For the purposes of this section, the terms defined in this 
4.25 	subdivision have the meanings given.
4.26 	(b) "Cybersecurity incident" means an event that may indicate that an organization's 
4.27 	systems or data have been compromised or that measures put in place to protect them have 
4.28 	failed.
4.29 	(c) "Information security incident" means a targeted attempt or successful unauthorized 
4.30 	access, use, disclosure, modification, or destruction of information or interference with 
4.31 	system operations in an information system.
4.32 	(d) "Vendor" means any person or entity that provides, programs, supports, or maintains 
4.33 	election services or infrastructure on behalf of the state or unit of local government.
5.1 		Subd. 2.Cybersecurity and information security incidents. (a) If a vendor becomes 
5.2 	aware of the possibility of an election cybersecurity incident, including breaches of 
5.3 	component suppliers, the vendor must promptly assess whether an election cybersecurity 
5.4 	incident has occurred.
5.5 	(b) If a vendor has reason to believe that an election cybersecurity incident may have 
5.6 	occurred, or that an information security incident related to the role of the vendor as an 
5.7 	election service provider may have occurred, including breaches of component suppliers, 
5.8 	the vendor must notify the secretary of state of the incident in the most expedient time 
5.9 	possible and without reasonable delay but in no event may the notice be provided to the 
5.10 	secretary of state more than three calendar days after discovery of the possible incident.
5.11 	(c) If a local election official becomes aware of the possibility of an election cybersecurity 
5.12 	incident or information security incident that impacts election data, systems, or infrastructure, 
5.13 	the election official must immediately notify the secretary of state.
5.14 		Subd. 3.Ownership. A vendor must notify the secretary of state of any foreign national 
5.15 	that directly or indirectly owns or controls a vendor, as well as any material change in 
5.16 	ownership resulting in ownership or control by a foreign national.

5.17 	Sec. 7. SECURITY EXPERT.
 5.18 	The secretary of state must engage a security expert to conduct an assessment of the 
5.19 	secretary of state's data exchange partnerships with counties, cities, the Department of Public 
5.20 	Safety, the Social Security Administration, the State Court Administrator's Office, and 
5.21 	organizations governed by Minnesota Statutes, section 201.13, subdivision 3, paragraph 
5.22 	(d). The security expert must notify the secretary of state of the assessment's findings and 
5.23 	recommend any necessary improvements to increase security and accuracy of data being 
5.24 	exchanged.