{"id":35742,"date":"2020-10-01T10:38:37","date_gmt":"2020-10-01T14:38:37","guid":{"rendered":"https:\/\/statescoop.com\/?p=35742"},"modified":"2021-09-03T08:36:55","modified_gmt":"2021-09-03T12:36:55","slug":"iowa-launches-vulnerability-disclosure-program-for-election-related-sites","status":"publish","type":"post","link":"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/","title":{"rendered":"Iowa launches vulnerability disclosure program for election-related sites"},"content":{"rendered":"

Iowa Secretary of State Paul Pate announced Thursday that his office is launching a new program allowing outside security experts to find and patch weaknesses in its websites, including those related to elections.<\/p>\n

With the new vulnerability disclosure program<\/a>, Iowa becomes the second state, following Ohio<\/a>, to give legal liability protections to researchers hunting for bugs that could leave its networks susceptible to attacks if left unaddressed. Pate’s office is working with Bugcrowd, an ethical-hacking firm that crowdsources cybersecurity professionals to look for flaws in its clients’ systems.<\/p>\n

\u201cWe already have a strong infrastructure in place, but election cybersecurity is a race without a finish line,\u201d Pate said in a press release. \u201cWe are bolstering our cyber maturity by allowing responsible testing and reporting of our systems to the private sector.\u201d<\/p>\n

While vulnerability disclosure programs are increasingly common with major corporations, very few state governments have implemented them. But states have been encouraged to use VDPs as part of their election security policies. In July, the Cybersecurity and Infrastructure Security Agency released a guidebook for election administrators<\/a> on how to set up a VDP. Vulnerability disclosures are also part of the core cybersecurity framework offered by the National Institute of Standards and Technology.<\/p>\n

Under Iowa’s new policy, Bugcrowd’s researchers will be able to report if they find any problems with websites operated by Pate’s office, including those hosting information about voter registration, absentee ballot tracking and election results. The policy also extends to sites relating to business filings and services for domestic abuse and sexual assault victims.<\/p>\n

For now, the program only covers public-facing websites; physical election equipment, such as voting machines and electronic pollbooks, is not covered by the policy, though earlier this year, Elections Systems & Software, the nation’s largest vendor of voting equipment, launched its own vulnerability disclosure program<\/a>.<\/p>\n

Jeff Franklin, the chief cybersecurity officer for Pate’s office, told StateScoop in a phone interview that Bugcrowd’s field of researchers already reported several vulnerabilities during a “controlled launch” period that began last month.<\/p>\n

“The security researcher community has a different perspective when they approach how an attacker thinks, and they add a different perspective than our day-to-day security team,” he said.<\/p>\n

None of the flaws reported so far were “high-level severity,” he added.<\/p>\n

Franklin also said that the VDP gives Pate’s office discretion over whether or not a vulnerability is publicly disclosed. Once a vulnerability is reported, Franklin said his team will aim to resolve it within 90 days, after which the secretary of state’s office can decide to go public.<\/p>\n

“Based on the severity, we\u2019ll make that call,” he said.<\/p>\n

For now, the vulnerability reporting is limited to the state level, though Franklin said that if it’s successful, the VDP could be extended to counties in future years. But the new policy is also, he said, a marker of how much progress Iowa’s made as a cybersecurity organization.<\/p>\n

“We were confident we were at a maturity level to engage the [security researcher] community,” Franklin said. “It\u2019s a win-win for everybody. It taps into a community that wants to help and make things better.”<\/p>\n","protected":false},"excerpt":{"rendered":"

Under the policy, security researchers can report flaws in websites run by the secretary of state, including voter registration and election results.<\/p>\n","protected":false},"author":200,"featured_media":30217,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"disable_grayscale_images":true,"grayscale_contrast":0,"sponsored_content":false,"display_author_bio":true,"story_type":"","footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[4677,20646],"tags":[125,450,3170,6185,10400,16536],"people":[],"special-report":[],"authors":[4697],"class_list":["post-35742","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-state","category-cybersecurity","tag-election-security","tag-iowa","tag-paul-pate","tag-jeff-franklin","tag-vulnerability-disclosure","tag-cybersecurity","author-benjamin-freed"],"yoast_head":"\nIowa launches vulnerability disclosure program for election-related sites | StateScoop<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Iowa launches vulnerability disclosure program for election-related sites | StateScoop\" \/>\n<meta property=\"og:description\" content=\"Under the policy, security researchers can report flaws in websites run by the secretary of state, including voter registration and election results.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/\" \/>\n<meta property=\"og:site_name\" content=\"StateScoop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/StateScoop\/\" \/>\n<meta property=\"article:published_time\" content=\"2020-10-01T14:38:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-09-03T12:36:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2020\/01\/iowa-state-capitol-building-in-des-moines.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2121\" \/>\n\t<meta property=\"og:image:height\" content=\"1414\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Benjamin Freed\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@brfreed\" \/>\n<meta name=\"twitter:site\" content=\"@State_Scoop\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/\",\"url\":\"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/\",\"name\":\"Iowa launches vulnerability disclosure program for election-related sites | StateScoop\",\"isPartOf\":{\"@id\":\"https:\/\/statescoop.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2020\/01\/iowa-state-capitol-building-in-des-moines.jpg\",\"datePublished\":\"2020-10-01T14:38:37+00:00\",\"dateModified\":\"2021-09-03T12:36:55+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/#primaryimage\",\"url\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2020\/01\/iowa-state-capitol-building-in-des-moines.jpg\",\"contentUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2020\/01\/iowa-state-capitol-building-in-des-moines.jpg\",\"width\":2121,\"height\":1414,\"caption\":\"State Capitol in Des Moines, Iowa (Getty Images)\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/statescoop.com\/#website\",\"url\":\"https:\/\/statescoop.com\/\",\"name\":\"StateScoop\",\"description\":\"Latest news and events in state and local government technology\",\"publisher\":{\"@id\":\"https:\/\/statescoop.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/statescoop.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/statescoop.com\/#organization\",\"name\":\"StateScoop\",\"url\":\"https:\/\/statescoop.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/statescoop.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png\",\"contentUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png\",\"width\":1470,\"height\":186,\"caption\":\"StateScoop\"},\"image\":{\"@id\":\"https:\/\/statescoop.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/StateScoop\/\",\"https:\/\/x.com\/State_Scoop\",\"https:\/\/www.linkedin.com\/company\/statescoop\/\",\"https:\/\/www.youtube.com\/@StateScoop\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Iowa launches vulnerability disclosure program for election-related sites | StateScoop","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/","og_locale":"en_US","og_type":"article","og_title":"Iowa launches vulnerability disclosure program for election-related sites | StateScoop","og_description":"Under the policy, security researchers can report flaws in websites run by the secretary of state, including voter registration and election results.","og_url":"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/","og_site_name":"StateScoop","article_publisher":"https:\/\/www.facebook.com\/StateScoop\/","article_published_time":"2020-10-01T14:38:37+00:00","article_modified_time":"2021-09-03T12:36:55+00:00","og_image":[{"width":2121,"height":1414,"url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2020\/01\/iowa-state-capitol-building-in-des-moines.jpg","type":"image\/jpeg"}],"author":"Benjamin Freed","twitter_card":"summary_large_image","twitter_creator":"@brfreed","twitter_site":"@State_Scoop","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/","url":"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/","name":"Iowa launches vulnerability disclosure program for election-related sites | StateScoop","isPartOf":{"@id":"https:\/\/statescoop.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/#primaryimage"},"image":{"@id":"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/#primaryimage"},"thumbnailUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2020\/01\/iowa-state-capitol-building-in-des-moines.jpg","datePublished":"2020-10-01T14:38:37+00:00","dateModified":"2021-09-03T12:36:55+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/#primaryimage","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2020\/01\/iowa-state-capitol-building-in-des-moines.jpg","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2020\/01\/iowa-state-capitol-building-in-des-moines.jpg","width":2121,"height":1414,"caption":"State Capitol in Des Moines, Iowa (Getty Images)"},{"@type":"WebSite","@id":"https:\/\/statescoop.com\/#website","url":"https:\/\/statescoop.com\/","name":"StateScoop","description":"Latest news and events in state and local government technology","publisher":{"@id":"https:\/\/statescoop.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/statescoop.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/statescoop.com\/#organization","name":"StateScoop","url":"https:\/\/statescoop.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/statescoop.com\/#\/schema\/logo\/image\/","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","width":1470,"height":186,"caption":"StateScoop"},"image":{"@id":"https:\/\/statescoop.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/StateScoop\/","https:\/\/x.com\/State_Scoop","https:\/\/www.linkedin.com\/company\/statescoop\/","https:\/\/www.youtube.com\/@StateScoop"]}]}},"parsely":{"version":"1.1.0","canonical_url":"https:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/","smart_links":{"inbound":0,"outbound":0},"traffic_boost_suggestions_count":0,"meta":{"@context":"https:\/\/schema.org","@type":"NewsArticle","headline":"Iowa launches vulnerability disclosure program for election-related sites","url":"http:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/","mainEntityOfPage":{"@type":"WebPage","@id":"http:\/\/statescoop.com\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\/"},"thumbnailUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2020\/01\/iowa-state-capitol-building-in-des-moines.jpg?w=150&h=150&crop=1","image":{"@type":"ImageObject","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2020\/01\/iowa-state-capitol-building-in-des-moines.jpg"},"articleSection":"State","author":[{"@type":"Person","name":"Benjamin Freed","url":"https:\/\/statescoop.com\/author\/benjamin-freed\/"}],"creator":["Benjamin Freed"],"publisher":{"@type":"Organization","name":"StateScoop","logo":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/cropped-ss_favicon.png"},"keywords":["cybersecurity","election security","iowa","jeff franklin","paul pate","vulnerability disclosure"],"dateCreated":"2020-10-01T14:38:37Z","datePublished":"2020-10-01T14:38:37Z","dateModified":"2021-09-03T12:36:55Z"},"rendered":"<script type=\"application\/ld+json\" class=\"wp-parsely-metadata\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"NewsArticle\",\"headline\":\"Iowa launches vulnerability disclosure program for election-related sites\",\"url\":\"http:\\\/\\\/statescoop.com\\\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\\\/\",\"mainEntityOfPage\":{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/statescoop.com\\\/iowa-launches-vulnerability-disclosure-program-for-election-related-sites\\\/\"},\"thumbnailUrl\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2020\\\/01\\\/iowa-state-capitol-building-in-des-moines.jpg?w=150&h=150&crop=1\",\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2020\\\/01\\\/iowa-state-capitol-building-in-des-moines.jpg\"},\"articleSection\":\"State\",\"author\":[{\"@type\":\"Person\",\"name\":\"Benjamin Freed\",\"url\":\"https:\\\/\\\/statescoop.com\\\/author\\\/benjamin-freed\\\/\"}],\"creator\":[\"Benjamin Freed\"],\"publisher\":{\"@type\":\"Organization\",\"name\":\"StateScoop\",\"logo\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2023\\\/01\\\/cropped-ss_favicon.png\"},\"keywords\":[\"cybersecurity\",\"election security\",\"iowa\",\"jeff franklin\",\"paul pate\",\"vulnerability disclosure\"],\"dateCreated\":\"2020-10-01T14:38:37Z\",\"datePublished\":\"2020-10-01T14:38:37Z\",\"dateModified\":\"2021-09-03T12:36:55Z\"}<\/script>","tracker_url":"https:\/\/cdn.parsely.com\/keys\/statescoop.com\/p.js"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2020\/01\/iowa-state-capitol-building-in-des-moines.jpg","distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"StateScoop","distributor_original_site_url":"https:\/\/statescoop.com","push-errors":false,"_links":{"self":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/35742","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/users\/200"}],"replies":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/comments?post=35742"}],"version-history":[{"count":4,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/35742\/revisions"}],"predecessor-version":[{"id":35751,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/35742\/revisions\/35751"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/media\/30217"}],"wp:attachment":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/media?parent=35742"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/categories?post=35742"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/tags?post=35742"},{"taxonomy":"people","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/people?post=35742"},{"taxonomy":"special-report","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/special-report?post=35742"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/authors?post=35742"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}