Senate Election Law and Municipal Affairs Committee
Jessica Bourque 271-2104
HB 626, directing the secretary of state to implement a vulnerability disclosure program for certain election systems.
Hearing Date: April 15, 2025
Time Opened: 10:31 a.m. Time Closed:10:45 a.m.
Members of the Committee Present:Senators Gray, Rochefort, Perkins Kwoka and Long
Members of the Committee Absent: Senator Lang
Bill Analysis: This bill directs the secretary of state to implement a vulnerability disclosure program for certain election systems and gives the cyber security committee oversight therefor.
Sponsors:
Rep. McFarlane | Rep. Kuttab | Rep. Spillane |
Rep. Popovici-Muller | Sen. Murphy |
|
________________________________________________________________________________
Who supports the bill: Representative Ross Berry, Representative McFarlane, Olivia Zink, Open Democracy
Who opposes the bill: No one
Who is neutral on the bill: David Scanlan, NH Secretary of State
Summary of testimony presented:
Representative Donald McFarlane, Prime Sponsor, Strafford-District 4
- This bill allows security researchers to assess vulnerabilities in our voting systems and ensures that any findings are transparently reported.
- This would bolster public trust and prevent bad actors from exploiting weaknesses.
- This is a bipartisan bill.
- The National Secretaries of State recommend this.
- NH has been a leader in election integrity for a long time. NH had 75% of eligible voters vote in the last election, proving public trust in NH elections.
- This bill does not assert any current deficiencies but instead ensures continued trust.
Senator Gray asked if he had seen the amendment #1590s
- Rep. McFarlane supports the committee amendment, but has not seen the amendment Senator Gray referred to.
David Scanlan, NH Secretary of State
- Three states are currently doing something similar: Ohio, Iowa, and Minnesota.
- They developed these programs independently as their best practice; they are not codified into law.
- These states limit the types of electronic systems that apply; None apply to their voter registration database.
- After speaking with the states who have this type of program, he thinks NH should consider the same limits.
- The replacement for the Legacy voter registration database has not been fully implemented yet, it might not be ready for this kind of activity.
- The bill references working with the NH Department of Information Technology and the Cybersecurity Oversight Committee. He is okay with working with the Cybersecurity Oversight Committee but is concerned about the committee making decisions about releasing any vulnerabilities to the public. As the constitutional officer elected to oversee elections, ultimately, he is the one who is solely responsible.
- Does not want a third party, such as the Cybersecurity Committee, to have a say when they have no direct involvement or authority over the election process.
Senator Perkins Kwoka said, as she understands it, researchers would go into our systems to try to identify vulnerabilities, then report privately to Secretary Scanlan. This would eventually become public information. She asked if there are other states that are doing this.
- Secretary Scanlan said that no other states are currently doing this, but he’s sure others are considering it.
Senator Perkins Kwoka followed up and asked if this is new or if it has been ongoing in the other states.
- The implemented programs are relatively new but ongoing.
Representative McFarlane came back to the table after reviewing amendment #1590s.
- Is amenable to all of the language in the amendment.
- Noted that the amendment excludes the scope of the voter registration database, which he feels is a critical component.
Representative Ross Berry, Hillsborough-District 4
- Explained that the House Committee added section 3 to the bill because the SOS needs time to rectify the situation if a vulnerability is discovered before the public is notified.
jab
Date Hearing Report completed: April 18, 2025