S. 3707Senate115th Congress (2017-2019)In Committee

Public-Private Cybersecurity Cooperation Act

A bill to direct the Secretary of Homeland Security to establish a vulnerability disclosure policy for Department of Homeland Security internet websites, and for other purposes.

AI-Generated Summary

Updated April 16, 2026 at 12:24 AM UTC

The Public‑Private Cybersecurity Cooperation Act requires the Department of Homeland Security to set up a clear, publicly available process for reporting and fixing security weaknesses on its websites. It outlines how researchers and companies can disclose flaws, how DHS will handle and remediate them, and mandates regular reporting to Congress on the program’s effectiveness. The bill mainly affects DHS, security researchers, and any private entities that discover vulnerabilities on DHS systems.

Key Provisions

The Secretary of Homeland Security must create a formal policy that tells how individuals, companies, and other organizations can find and report security flaws on DHS internet sites.
The policy must specify which DHS systems are covered, the rules for discovering and reporting flaws, how the Department will communicate with reporters, and how it will publicly disclose the findings.
DHS must also set up a process to fix or mitigate any reported vulnerabilities.
In developing the policy, DHS must consult the Attorney General (to protect reporters from prosecution), the Secretary of Defense and the GSA Administrator (for lessons from existing policies), and non‑government security researchers.
The completed policy and remediation process must be made publicly available and sent to Congress within 90 days of the law’s enactment.
Within one year of establishing the policy, DHS must report to Congress on the policy’s operation and provide annual briefings for the next three years, including statistics on reported and fixed vulnerabilities and response times.

Legislative Activity

Stay on top of the latest movement without scrolling through every action

1 earlier action

SenateIntro Referral Latest Action

Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

Homeland Security and Governmental Affairs Committee

December 5, 2018

View full timeline

SenateIntro Referral

Introduced in Senate

December 5, 2018

SenateIntro Referral

Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

Homeland Security and Governmental Affairs Committee

December 5, 2018

Floor Debate

3 members

What members said about S. 3707 on the floor

2 Republicans1 Democrat

Rep. Will HurdR-TX-23 · Dec 19, 2018

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 7327) to require the Secretary of Homeland Security to establish a security vulnerability disclosure policy, to establish a bug bounty program for the Department of Homeland Security, to amend title 41, United States Code, to provide for Federal acquisition supply chain security, and for other purposes.

Mr. Speaker, I ask unanimous consent that all Members may have 5 days in which to revise and extend their remarks and include extraneous material on the bill under consideration.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I rise today in support of the SECURE Technology Act. This is a bill that I introduced with the majority leader, Kevin McCarthy, and Representatives Ratcliffe, Lieu, Vela, and Langevin.

This bill includes two bipartisan proposals to strengthen Homeland Security. First, it requires a vulnerability disclosure policy and establishes a bug bounty program at the Department of Homeland Security. Second, it establishes requirements for supply chain security in products purchased by the Federal Government.

Title I of the bill incorporates H.R. 6735, which is the Public- Private Cybersecurity Cooperation Act, which was introduced by Leader McCarthy and passed by a voice vote by this House in September. It is cosponsored by myself and Representatives Ratcliffe, Langevin, and Khanna.

Senator Portman introduced the Senate companion to this bill, S. 3707, with Senator Hassan.

This title seeks to protect the information systems of the Department of Homeland Security by establishing a program to report security vulnerabilities discovered on these systems. This program allows DHS to learn about security risks from private-sector experts and requires DHS to fix these at-risk systems.

DHS operates many of the systems and services other agencies use to protect their networks, so DHS should set the example for securing its own information systems.

Title I also includes S. 1281, the Hack the Department of Homeland Security Act of 2018, which was introduced by Senator Hassan with Senators Portman, McCaskill, Harris, and Gardner.

Representative Lieu introduced the House companion to this bill, H.R. 2774, with Representative Taylor. It is cosponsored by Representatives Meehan, Khanna, Jayapal, Kilmer, Kelly, and Evans. The bill authorizes DHS to create a bug bounty pilot program to compensate people who report security vulnerabilities to DHS.

Bug bounties are widely seen as an effective and inexpensive way to identify vulnerabilities in IT systems.

Title II of this bill incorporates S. 3085, the Federal Acquisition Supply Chain Security Act of 2018, which was introduced by Senator McCaskill and cosponsored by Senators Lankford and Johnson.

This bill passed the Senate by unanimous consent last night. This title helps ensure the integrity of information technology and communications equipment purchased by the Federal Government by addressing supply chain risks that are government-wide.

The bill sets up an interagency council to identify products that pose unacceptable risk to these systems and to set policy on information sharing and risk mitigation in Federal IT systems.

The bill recognizes the need to move away from an ad hoc approach to dealing with unacceptable products offered to the Federal Government by companies such as Kaspersky, ZTE, and Huawei. It also authorizes exclusion and removal orders for products found to pose an unacceptable risk to these Federal IT systems.

This legislation provides for due process, including judicial review, and certainty about how lawsuits will be handled in the future.

Mr. Speaker, I want to thank the numerous Members in the House and Senate who worked tirelessly on these two pieces of legislation, especially Leader McCarthy, members of the House Committee on Oversight and Government Reform and Committee on Homeland Security, and members of the Senate Homeland Security and Governmental Affairs Committee.

Mr. Speaker, I want to urge my colleagues to support the SECURE Technology Act, and I reserve the balance of my time.

Mr. Speaker, I make my friend, the gentlewoman from the District of Columbia, whom I always take every opportunity to work with, aware that I have no further speakers, and I am prepared to close.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, this is another example of how we can actually get things done up here in Washington, D.C., if we work together. This is a piece of legislation that is going to help secure our networks, make sure we are protecting the American people, and I urge the adoption of this bill.

Mr. Speaker, I yield back the balance of my time.

Rep. Eleanor Holmes NortonD-DC · Dec 19, 2018

Mr. Speaker, I yield myself such time as I may consume Mr. Speaker, I thank my good friend, Representative Hurd, for his leadership in introducing this commonsense legislation. The bill before us…

Mr. Speaker, I yield myself such time as I may consume

Mr. Speaker, I thank my good friend, Representative Hurd, for his leadership in introducing this commonsense legislation. The bill before us today includes a number of different measures.

The bill includes a measure originally introduced by Senator McCaskill to deal with information technology threats to the Federal acquisition supply chain. The bill would address the serious cybersecurity risks that recently came to light after the discovery of Kaspersky products had been installed on many government computers.

The bill would establish the Federal Acquisition Security Council to facilitate information sharing among Federal agencies regarding supply chain risks when purchasing information technology products and create procedures for evaluating such risks.

The bill would give agencies the authority to mitigate supply chain IT risks and authorizes the Council to recommend excluding suppliers, if warranted.

The bill also would establish a judicial review process and reporting requirements to ensure fairness and accountability if companies are excluded in the future.

In addition, the bill includes several provisions to improve cybersecurity at the Department of Homeland Security, one which was originally authored by Senator Hassan of New Hampshire. It would create a pilot program through which the Department would be authorized to provide a financial reward to those who legitimately come forward to report vulnerabilities on DHS websites and software to prevent exploitation by cyber terrorists, State actors, and criminal organizations.

So-called white hat hackers are an enormous pool of talent that the Federal Government has largely failed to leverage. The bill would also require DHS to put in place policies to ensure that civic-minded hackers can identify and report bugs found on the Department's information systems without breaking the law.

I ask my colleagues to join me in supporting the SECURE Technology Act, and I reserve the balance of my time.

Mr. Speaker, I thank my good friend especially for his work on this bill and for his friendship and for our continuing work together.

Mr. Speaker, I have no further speakers, and I yield back the balance of my time.

Rep. Thomas MassieR-KY-4 · Dec 19, 2018

Mr. Speaker, I object to the vote on the ground that a quorum is not present and make the point of order that a quorum is not present.

Bill Text

Latest available legislative text

Reading Mode

Raw Text PDF XML

Introduced in SenateIssued December 5, 2018

115th CONGRESS

2d Session

S. 3707

IN THE SENATE OF THE UNITED STATES

December 5, 2018

Mr. Portman (for himself and Ms. Hassan) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs

A BILL

To direct the Secretary of Homeland Security to establish a vulnerability disclosure policy for Department of Homeland Security internet websites, and for other purposes.

Short title

This Act may be cited as the Public-Private Cybersecurity Cooperation Act.

Department of Homeland Security disclosure of security vulnerabilities

(a)

Definitions

In this section:

(1)

Appropriate information system

The term appropriate information system means an information system that the Secretary of Homeland Security selects for inclusion under the vulnerability disclosure policy required by subsection (b).

(2)

Department

The term Department means the Department of Homeland Security.

(3)

Information system

The term information system has the meaning given that term by section 3502(12) of title 44, United States Code.

(4)

Secretary

The term Secretary means the Secretary of Homeland Security.

(5)

Security vulnerability

The term security vulnerability has the meaning given that term in section 102(17) of the Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 1501(17)), in information technology.

(b)

Vulnerability disclosure policy

The Secretary shall establish a policy applicable to individuals, organizations, and companies that report security vulnerabilities on appropriate information systems of Department. Such policy shall include each of the following:

(1)

The appropriate information systems of the Department that individuals, organizations, and companies may use to discover and report security vulnerabilities on appropriate information systems.

(2)

The conditions and criteria under which individuals, organizations, and companies may operate to discover and report security vulnerabilities.

(3)

How individuals, organizations, and companies may disclose to the Department security vulnerabilities discovered on appropriate information systems of the Department.

(4)

The ways in which the Department may communicate with individuals, organizations, and companies that report security vulnerabilities.

(5)

The process the Department shall use for public disclosure of reported security vulnerabilities.

(c)

Remediation process

The Secretary shall develop a process for the Department to address the mitigation or remediation of the security vulnerabilities reported through the policy developed in subsection (b).

(d)

Consultation

(1)

In general

In developing the security vulnerability disclosure policy under subsection (b), the Secretary shall consult with each of the following:

(A)

The Attorney General regarding how to ensure that individuals, organizations, and companies that comply with the requirements of the policy developed under subsection (b) are protected from prosecution under section 1030 of title 18, United States Code, civil lawsuits, and similar provisions of law with respect to specific activities authorized under the policy.

(B)

The Secretary of Defense and the Administrator of General Services regarding lessons that may be applied from existing vulnerability disclosure policies.

(C)

Non-governmental security researchers.

(2)

Nonapplicability of FACA

The Federal Advisory Committee Act (5 U.S.C. App.) shall not apply to any consultation under this section.

(e)

Public availability

The Secretary shall make the policy developed under subsection (b) publicly available.

(f)

Submission to Congress

(1)

Disclosure policy and remediation process

Not later than 90 days after the date of enactment of this Act, the Secretary shall submit to Congress a copy of the policy required under subsection (b) and the remediation process required under subsection (c).

(2)

Report and briefing

(A)

Report

Not later than 1 year after establishing the policy required under subsection (b), the Secretary shall submit to Congress a report on such policy and the remediation process required under subsection (c).

(B)

Annual briefings

One year after the date of the submission of the report under subparagraph (A), and annually thereafter for each of the next 3 years, the Secretary shall provide to Congress a briefing on the policy required under subsection (b) and the process required under subsection (c).

(C)

Matters for inclusion

The report required under subparagraph (A) and the briefings required under subparagraph (B) shall include each of the following with respect to the policy required under subsection (b) and the process required under subsection (c) for the period covered by the report or briefing, as the case may be:

(i)

The number of unique security vulnerabilities reported.

(ii)

The number of previously unknown security vulnerabilities mitigated or remediated.

(iii)

The number of unique individuals, organizations, and companies that reported security vulnerabilities.

(iv)

The average length of time between the reporting of security vulnerabilities and mitigation or remediation of such vulnerabilities.