Congress mandates independent hacking of voting machines to find flaws

What it does

This bill creates a 5-year pilot program requiring voting machine manufacturers to allow independent cybersecurity researchers to test their systems for vulnerabilities, with a coordinated process for reporting and fixing security flaws. Researchers get legal protection from lawsuits and copyright claims when conducting authorized testing, and critical vulnerabilities must be patched and sent to election officials within defined timelines.

Why we flagged it

The bill's core function is to mandate independent penetration testing and vulnerability disclosure for voting systems as a condition of certification. It is a regulatory requirement, not a subsidy or carve-out, and directly addresses election infrastructure security.

What the text implies

• Vendors may face increased compliance costs and operational burden to support researcher access and expedited patch review, potentially raising barriers to entry for smaller vendors.
• The 180-day confidentiality window before public disclosure to CISA may delay awareness of critical vulnerabilities in deployed systems, creating a window where flaws remain unfixed in live elections.
• FOIA exemption for discovered vulnerabilities may reduce public transparency about the scope and severity of election system weaknesses, limiting voter and official awareness.
• Voluntary vendor participation means non-compliant vendors can avoid the program entirely, creating a two-tier security landscape where some systems receive independent testing and others do not.

Who it affects

Ordinary citizens benefit from stronger election security oversight and transparency. The bill mandates independent testing of voting systems—infrastructure that directly affects democratic integrity—and creates accountability mechanisms for vendors to fix vulnerabilities. The safe harbor for researchers removes barriers to finding and disclosing election security flaws that could otherwise remain hidden.

Who stands to gain

• cybersecurity testing firms and laboratories
• election system vendors (through expedited certification pathways)
• IT security consultancies

Named in the bill

Election Assistance Commission (EAC), National Institute of Standards and Technology (NIST), Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), Help America Vote Act of 2002 (HAVA), Computer Fraud and Abuse Act (CFAA), Digital Millennium Copyright Act (DMCA), Freedom of Information Act (FOIA), Common Vulnerabilities and Exposures (CVE) database

Where it stands

1 cosponsor: 1 Democrats.

• Nov 25, 2025 — Introduced · Congress.gov: “Introduced in House”
• Nov 25, 2025 — Referred to House Committee on Science, Space, and Technology and House Committee on House Administration · Congress.gov: “Referred to the Committee on House Administration, and in addition to the Committee on Science, Space, and…”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

1 lobbying clients named this bill on 2 disclosure filings across 2 quarters, Dec 2025 to Jun 2026. Those filings disclosed $140,000 in lobbying spend. A filing names 1 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 0% of bills with at least one filing.

David Valadao, the sponsor, reported $2,024,902 in PAC receipts in the 2026 cycle.

• Election Systems & Software, LLC — $140,000 on 2 filings

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.