; (2) award competitors for the discovery of the most significant vulnerabilities of such systems; and (3) share all discovered vulnerabilities with the relevant vendors of the systems. 303. Safe harbor (a) In general Notwithstanding section 1030 of title 18, United States Code, and except as provided in subsection (b), it shall not be unlawful for a person acting in compliance with the Cooperative Hack the Election Program or a bug bounty program implemented under section 304 to take actions necessary to discover and report a cybersecurity vulnerability in a voting system if the person reports the cybersecurity vulnerability to the Secretary. (b) Limitation Subsection (a) shall not apply to any person that— (1) acts outside the scope of the Cooperative Hack the Election Program or a bug bounty program implemented under section 304, as the case may be; (2) exploits a cybersecurity vulnerability described in subsection (a); or (3) publicly exposes a cybersecurity vulnerability described in subsection (a) before reporting the cybersecurity vulnerability to the Secretary. 304. Bug bounty programs (a) In general Not later than 180 days after the date of the enactment of this Act, the Under Secretary for National Protection and Programs Directorate of the Department shall submit a strategic plan to implement bug bounty programs at appropriate agencies and departments of the United States to— (1) the Committee on Homeland Security and Governmental Affairs of the Senate; (2) the Select Committee on Intelligence of the Senate; (3) the Committee on Homeland Security of the House of Representatives; and (4) the Permanent Select Committee on Intelligence of the House of Representatives. (b) Assessment The plan under subsection (a) shall include— (1) an assessment on— (A) the effectiveness of the Hack the Pentagon pilot program carried out by the Department of Defense in 2016 and subsequent bug bounty programs in identifying and reporting vulnerabilities within the information systems of the Department of Defense