Public Hearing Transcripts

STATE OF CALIFORNIA SECRETARY OF STATE OFFICE OF VOTING SYSTEMS TECHNOLOGY ASSESSMENT In the Matter of: ) ) PUBLIC HEARING: ) ) DOMINION VOTING SYSTEMS ) ) IMAGECAST REMOTE 5.2 REMOTE ) ) ACCESSIBLE VOTE BY MAIL ) ) SYSTEM ) ______________________________) PUBLIC HEARING Secretary of State Building 1500 11th Street Sacramento, California April 27, 2018 9:00 A.M. Reported by: Peter Petty California Reporting, LLC (510) 313-0610 2 APPEARANCES STAFF Susan Lapsley, Administration NaKesha Robinson, OVSTA Rodney Rodriguez, OVTSA Todd Ross, OVTSA CONRACTORS/CONSULTANTS Mike Santos, SLI Compliance PUBLIC COMMENT Fred Nisen, Disability Rights California California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 3 1 APRIL 27, 2018, 9:03 A.M. 2 SACRAMENTO, CALIFORNIA 3 MS. LAPSLEY: All right. Good morning. Well, 4 it’s a couple minutes after nine. We’ll go ahead and get 5 started. I’d first like to introduce Staff, and then we’ll 6 kind of cover the ground rules of this public hearing. 7 Here on stage, we have Todd Ross, who is a member 8 of the Office of Voting Systems Technology Assessment, 9 OVTSA. I’ll let Mike -- we’ll hold off on Mike, because 10 you’re not a member of OVTSA. You don’t count as Staff. 11 NaKesha Robinson, also a member of OVTSA. And down here we 12 have Rodney Rodriguez, also with OVTSA. Rodney will be 13 handling the timing of public comments, as well as speaker 14 cards, and making sure that everything runs smoothly here 15 as far as sound and getting everyone what they need. 16 Just a few ground rules. There’s no food or 17 drink in the auditorium. We will be taking public comment 18 about the following -- about Dominion Voting Systems 19 ImageCast Remote 5.2, Remote Accessible Vote By Mail 20 System. RAVBM is the abbreviation of that. 21 The Staff Reports, consultant’s reports and other 22 tests are available on our website at 23 www.sos.ca.gov/elections/votingsystemsvendors/dominion. 24 For the system being heard, the Staff Report will be given, 25 then the consultant’s report. After that the vendor will California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 4 1 have an opportunity to respond, and then it will be open 2 for public comment. All those requesting to speak during 3 the public comment period for the system must complete a 4 speaker request card, which is available -- they are 5 available at the entrance. If you didn’t get one and would 6 like one, please raise your hand and let Rodney know and he 7 can run one to you. 8 Speaking time will be limited to three minutes. 9 The timekeeper will advise when 2 minutes 30 seconds has 10 elapsed, and then again when 3 minutes has elapsed. Rodney 11 wanted to use a big hook today, but we wouldn’t let him. 12 So he’ll let you know by holding up a notice card. A 13 speaker may use additional time that has been ceded to them 14 by a maximum of two other people who have signed a speaker 15 card request. If you wish to cede your time to another 16 speaker, please that person’s name in addition to your own 17 name on your speaker’s request card. 18 We have a small house today, so I won’t give my 19 normal comments about people coming a long ways and being 20 respectful. I assume, looking at the faces here, everyone 21 is very respectful, except for may Waldeep up there in the 22 corner, who has his drink in hand. 23 Please note that the court stenographer is taking 24 a transcription of the meeting today. This means that if 25 you speak, your name and your comments will be part of the California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 5 1 public record. They will be posted on our internet website 2 at some point, so please state your name clearly for the 3 stenographer prior to beginning. 4 The public hearing is also being videotaped, 5 which will also be part of the public record. 6 Written public comments on this item can be 7 submitted to Voting Systems at sos.ca.gov, or by U.S. Mail 8 to the Secretary of State’s Office, Attention: Voting 9 System Comments, at 1500 11th Street, 6th Floor, 10 Sacramento, California 95814. Any written comments 11 submitted to the Secretary of State, whether they be via 12 email or U.S. Postal, will become, also, part of the 13 record. 14 With that, we’ll go ahead and we will turn it 15 over to NaKesha to give the Staff Report. 16 MS. ROBINSON: All right. Good morning, 17 everyone. Dominion Voting Systems submitted an application 18 for the ImageCast Remote 5.2 System on September 5th, 2017. 19 ImageCast Remote 5.2 is a vendor-hosted application solely 20 for the purposes of ballot marking, pursuant to Elections 21 Code sections 303.3 and 19283. ImageCast Remote 5.2 was 22 evaluated against the applicable portions of the California 23 Voting Systems Standards, or CVSS. 24 Upon receipt of a completed application the 25 Secretary of State released a Request for Quote for California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 6 1 assistance with source code review, telecommunications and 2 security review, as well as usability, accessibility and 3 privacy testing. 4 Through a formal California contracting process 5 the Secretary of State awarded a contract to SLI 6 Compliance, a division of Gaming Laboratories 7 International, LLC, to assist with testing. 8 Dominion Voting Systems Remote 5.2 Remote 9 Accessible Vote By Mail System application is a web-based 10 interface. The voter can optionally use a screen reader to 11 navigate through the -- through the screens. After marking 12 their cast vote record and reviewing their selection, the 13 voter must print their selections. The printed paper-cast 14 record is returned to the local elections official, where 15 it will be remade into a ballot. The printed paper-cast 16 record and the ballot are kept together for auditing 17 purposes. 18 Accessibility and functional testing of the 19 system was conducted by SOS staff. The functional test was 20 conducted at the Secretary of State’s Office in Sacramento, 21 California during the month of November 2017. 22 End-user accessibility testing was conducted in 23 three waves. Wave one user accessibility testing was 24 performed by nine volunteers throughout the State of 25 California from November 30th to December 1st, 2017. Wave California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 7 1 two took place from December 4th to December 8th, 2017, 2 concluding with wave three from December 18th to December 3 22nd, 2017, where we had 29 volunteer testers. The 4 additional testing was conducted by SLI during the month of 5 March 2018. 6 For the functional test, the Secretary of State’s 7 Office provided Dominion with three test ballot data sets 8 of California elections: one, the State of California 9 Primary Election, which was comprised of a fictional 10 jurisdiction; two, a State of California General Election, 11 which was also a fictional jurisdiction; and last, a local 12 jurisdiction fictional ranked choice election. 13 The system was also exercised for under-votes, 14 over-votes and write-ins. The system successfully warned 15 users of under-votes and over-votes, as well with write-in 16 candidates, it does have a 50 character limit. 17 During accessibility, usability and privacy 18 testing, again, we conducted three waves. And, also, SLI 19 conducted accessibility, usability and privacy testing. 20 During the testing with the end-users that were 21 recruited statewide, the testers were asked to complete 22 pre-test and post-test surveys, documenting such 23 information as demographics, the technology that was used 24 for testing, and the testers post-test experience using the 25 system. The survey results of each are included in California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 8 1 Attachment A of the Staff Report. Please note that 2 personal identifying information has been redacted. 3 During the testing conducted with end-users, 4 there are approximately 15 technical issues that were 5 identified. Each has a response and/or mitigation, which 6 can be found in the Staff Report. 7 SLI conducted an additional accessibility, 8 usability and privacy test, as well. Phase one of SLI’s 9 testing was a review of the ImageCast Remote 5.2 10 documentation of usability and accessibility performed 11 during system development. Phase two included all 12 accessibility and usability testing. And phase three 13 included privacy testing. Additional details regarding 14 SLI’s testing can be found in the Staff Report, as well as 15 during the next presentation, Mike Santos will elaborate a 16 little bit further. 17 During usability testing, SLI identified one 18 requirement that was not met. That is CVSS 3.2.7.C.2. 19 Review of that requirement showed that navigation keys, up 20 and down arrows, tab did have repetitive effect. Dominion 21 will address that by adjusting their use procedures 22 accordingly. 23 During accessibility testing by SLI, additional 24 testing was also conducted against the applicable portions 25 of section 508. And during that testing, it was determined California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 9 1 that all requirements were satisfactorily met. 2 During privacy testing, SLI evaluated ImageCast 3 Remote for compliance with California Elections Code 4 requirements within an RAVBM system, in addition to the 5 applicable portions of the CVSS. During that testing, all 6 requirements were satisfactorily met and/or covered. 7 And next, during the security and 8 telecommunications testing, SLI conducted a documentation 9 review, functional security testing, and telecommunications 10 and data transmission testing. A summary of each of the 11 applicable standards, as well as whether those standards 12 were met, are covered within the Staff Report. 13 During the security and telecommunication’s 14 testing, SLI did identify two potentially high security 15 vulnerabilities, one being potential cross-sites scripting 16 opportunity and select components of the system. Dominion 17 has provided a vendor mitigation, as well as a response, 18 which can be found within the Staff Report. The second 19 issue, potential sequel injection vulnerabilities arise 20 when user-controllable data is incorporated into database 21 sequel queries in an unsafe manner. And again, Dominion 22 did provide a vendor response, as well as mitigation to 23 that vulnerability. 24 And then finally, during the software review 25 testing, the purpose of this testing was to review and California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 10 1 identify any discrepancies within the software code and 2 compliance with the California Voting System Standards. 3 During that testing, SLI discovered one discrepancy. There 4 were 180 source code requirements found to be at issue with 5 the RAVBMS source code base reviewed. As a result, 108 6 discrepancies were written against the code base. Dominion 7 did provide a mitigation in response to that, as well. 8 And one other item I’d like to go back to, during 9 our end-user testing, one of our test volunteers did 10 identify or make some comments that I did not get a chance 11 to address during the Staff Report, so I’d like to address 12 those now. It is regarding the PIN feature within 13 Dominion’s RAVBM system. 14 So the PIN is a feature that can be turned on and 15 off, just like the capture functionality. Depending upon 16 how the jurisdictions and/or the SOS provides guidance on 17 using those -- issuing PINs. The system also provides 18 options to have a PIN issued via telephone and/or a 19 postcard. And also to be very clear, the RAVBM cast vote 20 record will be remade into a ballot. And while we 21 understand Dominion does have the capability to read those 22 cast vote records directly within their voting system, we 23 must have an official ballot. So all the RAVBM cast vote 24 records will be remade. 25 And with that, that concludes my presentation of California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 11 1 the Staff Report. 2 Next up, we’ll have Mike Santo from SLI. 3 MR. SANTOS: Good morning. I am Mike Santos from 4 SLI Compliance. As NaKesha just mentioned, we were tasked 5 with doing source code review, security and vulnerability 6 testing, as well as accessibility, usability and privacy 7 testing. 8 In terms of source code review, there were 9 approximately 319,000 lines of source code and comments 10 that were subjected to review. Some of the criteria that 11 we were using for the review process was adherence to 12 applicable standards of the CVSS, adherence to other 13 applicable coding format conventions and standards, 14 including best practices for the coding languages being 15 used, analysis of the program logic and branching 16 structure, as well as evaluating whether the system is 17 designed in a way that allows meaningful analysis. 18 Also, as NaKesha mentioned, during the source 19 code review there were 180 source code discrepancies that 20 were found. They were -- they covered six different 21 requirements. 22 There were some 80 instances that were noted 23 where lines of source code exceeded more than 120 24 characters in length, 71 instances that were noted where 25 numbers were not set to a constant, 23 instances that were California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 12 1 noted where variable declarations were without comment, 10 2 instances were noted where no default case existed, 2 3 instances were noted where variable names were not 4 differing by more than one character were being utilized, 5 and there was 1 instance noted where inconsistent 6 indentation was implemented. So that was the findings from 7 the functional system source code review. 8 We also performed a vulnerability review on the 9 source code where we were searching for exposures to 10 commonly-exploited vulnerabilities, evaluating the use and 11 correct implementation of cryptography of key management, 12 evaluating the likelihood of security failures being 13 detected in terms of like audit mechanisms and where the 14 data could be subject to tampering, evaluating the risk 15 that a user can escalate their capabilities beyond those 16 authorized, evaluating the design and implementation to 17 ensure that sound generally-accepted engineering practices 18 are being followed and that the code is being written 19 defensively, evaluating for embedded exploitable code that 20 could be triggered to effect the system. 21 We evaluated the code for dynamic memory access 22 features which would permit the replacement of certified 23 executable code or control data or insertion of exploitable 24 code or data. And we also were evaluating the code for use 25 of runtime scripts, instructions or other control data that California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 13 1 can affect the operation of security-relative functions or 2 the integrity of the data itself. 3 So upon looking through those 319,000 lines of 4 code for those criteria, no vulnerabilities were found 5 within the system. And as a result, no findings were 6 written against the code base with regards to 7 vulnerability. 8 We were also tasked with a security review. We 9 looked at various aspects of security, including general 10 access control, access control identification, access 11 control authorization, and general access control. 12 Let’s see here, in terms of general access 13 control, we were looking for authentication that included 14 methods for both the voter-facing application, as well as 15 the administrative application. The security -- the 16 general access control security was tested on the 17 architecture pieces, client application, administrative 18 application, which were accessible remotely. 19 In terms of access control identification, the 20 system was determined to use a client server system to 21 authenticate registered users and serve up the correct 22 ballot for a particular voter using pre-defined ballot 23 rules and voters that can be imported by the jurisdiction. 24 Role-based access controls were determined to be in place 25 for administrative login purposes. California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 14 1 With regards to access control authorization, all 2 administrative access is controlled by username, password 3 combinations, and there is a role-based administrative 4 access in place. Also, the ability to assign voters to 5 different electoral groups or electoral districts, it gives 6 the ability to assign ballots to voters in accordance with 7 specific CVSS rules. 8 For access control analysis, we attempted XSX 9 (phonetic) attacks, sequel injection attacks, direct re- 10 listings, and scans attempting to pull directory file lists 11 scanned for default, http login pages. We scanned for 12 robot text files and pulled SSL certification information. 13 We performed a full vulnerability scan, as well. 14 Sorry. 15 For telecommunications and data transmission, the 16 system utilizes electrical transmissions, and the ballot is 17 sent by SSL. No receipt is utilized to verify the 18 transmission. The client generates a blank ballot which 19 does not contain voting selections, so once the ballot is 20 delivered and until the ballot package is saved there are 21 no external communications between the voter and the ballot 22 delivery system. All interactions remain local to the 23 voter’s environment. 24 In terms of security vulnerabilities, we were 25 tasked with determining, A, if there were security California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 15 1 vulnerabilities, and B, if there were, to try to indicate 2 the level of exploitation that the vulnerability would 3 require access by. 4 And those are broken down into four different 5 categories: a voter, who usually has low knowledge of the 6 voting machine and design and configuration; a poll worker, 7 who usually also has a low knowledge of the voting design 8 and configuration, but has more access to anything, which 9 in the case of an RAVBM system (indiscernible) going to 10 have poll workers; election official insiders who have a 11 wide range of knowledge of the voting design and 12 configuration and may have unrestricted access to the 13 machine for long periods of time; as well as a fourth 14 category of a vendor insider that has great knowledge of 15 the voting machine design and configuration and have 16 unlimited access to the machine before it’s delivered to 17 the purchaser, and thereafter may have unrestricted access 18 with performing warranty and maintenance service, and when 19 providing election administrative services. 20 The ability to tamper with the client site 21 application is always present due to the fact that there 22 are no server site verifications or validations in place 23 after the ballot has been generated. So at that point, you 24 know, somebody can sit there for days on end and do 25 whatever they want to that ballot. In this context, California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 16 1 however, the ability to effect large numbers of ballots is 2 reliant upon server site compromise, which may also include 3 distributed denial (phonetic) of service attacks. 4 The voter is given the ability to proof and 5 confirm ballot selections within the system, as well as the 6 printed paper ballot, so there is a final confirmation 7 screen with the system. And then once you’ve printed your 8 paper ballot, you have that ability to do a final check of 9 that ballot prior to submitting it or being cast. 10 Security testing of the server site hosting 11 security included application scanning and vulnerability 12 scanning. The results of the scanning revealed potential 13 vulnerabilities that is estimated would have a minimal 14 impact on the overall security of the application being 15 tested. And those were basically what NaKesha mentioned a 16 few minutes ago and, I guess, is in the final reports on 17 the website. 18 The third area that we were tasked with reviewing 19 was the usability and accessibility testing, as well as 20 privacy testing. 21 In terms of usability and accessibility testing, 22 some of the items that we were looking at were that the 23 system allows the voter, at the voter’s choice -- it’s kind 24 the basics of voting the ballot, that the system would 25 allow the voter, at the voter’s choice, to submit an under- California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 17 1 voted ballot without correction. That would provide the 2 voter the opportunity to correct the ballot for an under- 3 vote before the ballot is cast and counted. 4 It would prevent voters from selecting more than 5 the allowable number of choices for each contest, so it 6 doesn’t allow over-voting. 7 It provides feedback to the voter before final 8 casting of the ballot that identifies specific contests for 9 which the voter has selected fewer than the allowable 10 number of choices, providing the voter the opportunity to 11 correct the ballot. 12 It allows the voter to change a vote within a 13 contest before advancing to the next contest, to provide 14 navigation controls that allow the voter to advance to the 15 next contest or go back to the previous contest before 16 completing the vote on the contests currently being 17 presented. So it’s really just checking, you know, a lot 18 of the -- some of the basic rules, the no over-voting, 19 letting you know if you’ve under-voted, and allowing you to 20 vote, basically, any contest in any manner in any order 21 that that voter prefers. A voter was able to vote 22 appropriate contests in any manner or order they wished and 23 was notified when under-voting, and was prevented from 24 over-voting. 25 We were also looking at cognitive issues, California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 18 1 completeness of instructions, availability of assistance 2 from the system, plain language being used, context before 3 actions, no bias among choices, ballot design, conventional 4 use of colors, icons and languages, as well as perceptual 5 issues, including accommodation for color blindness and no 6 reliance solely on color so that color coding is not used 7 as the sole means of conveying information. 8 Interaction issues, we were looking at no page 9 scrolling being allowed, unambiguous feedback for voter’s 10 selection, so that was very obvious that what they were 11 selecting as their choice. We looked for accidental 12 activation, size and separation of touch areas, repeating 13 keys, timing issues, initial system response times, maximum 14 completed response time for vote confirmation, maximum 15 completed system response time for all operations, and 16 voter inactivity time. 17 As NaKesha mentioned, we did see an issue with 18 the no repeating keys, that key presses were allowed to be 19 repeated. And it sounds like Dominion Voting Systems has 20 implemented a mitigation for that. 21 In terms -- we were also looking at alternative 22 languages, general support for alternative languages, 23 complete information in an alternative language, 24 auditability of records for English readers, and voter 25 control of language. An issue that was seen in terms of California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 19 1 voter control with the language that the system allows the 2 voter to select among the available languages throughout 3 the voting session, while preserving the current votes. 4 So once a voter selects a language and they 5 download that ballot, the connection to the server is 6 broken and that ballot is local only to that device that 7 the voter is voting on. So should they decide to change 8 languages, they would need to go back and access a whole 9 new ballot and it would not carry over anything that they 10 had voted in the first language to a second language, so 11 that was one thing that was noted. 12 There were a number of requirements that were 13 related to hardware in the voting environment where the 14 voter would be casting their ballot that were deemed not 15 applicable as the voter will be utilizing their own 16 equipment, so we really couldn’t speak to hardware-oriented 17 items. 18 In terms or privacy, some of the categories were 19 visual privacy, auditory privacy, and no receipts. And 20 again, this was as a Remote Access Vote-By-Mail System. 21 The voting will occur in an environment of the voter’s 22 choosing. And all privacy issues will be reliant upon 23 where they choose to cast their -- or to mark their 24 ballots. 25 Some final requirements that were looked at were California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 20 1 related to, I think this is Rule 19295, RAVBM system 2 Requirements, that the system shall not have the 3 capability, including an optional capability, to use a 4 remote server to mark a voter’s selections, transmit it to 5 the server from the voter’s computer via the internet, 6 store any voter identifiable selections on any remote 7 server, or tabulate votes. And it was verified that, as I 8 mentioned a little bit earlier, that once the ballot is 9 delivered to the voter’s personal environment, all 10 connections are removed and there are no remote servers to 11 do any of those things. 12 And that basically concludes -- 13 MS. LAPSLEY: Okay. 14 MR. SANTOS: -- SLI’s report. 15 MS. LAPSLEY: Great. Thank you, Mike. 16 So with that, is anyone -- is there anyone from 17 Dominion that would like to respond to either the Staff 18 Report or the consultant’s report? 19 UNIDENTIFIED MALE: No, thank you. 20 MS. LAPSLEY: No, thank you? All right. 21 With that, we’ll go ahead and move to public 22 comments. And right now we have one public speaker card 23 and that’s from Mr. Fred Nisen with Disability Rights of 24 California. 25 Mr. Nisen? California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 21 1 UNIDENTIFIED MALE: Thank you. We’re from 2 Disability Rights California, and I’m going to be reading 3 his testimony. 4 (On behalf of Fred Nisen.) 5 “Hi. My name is Fred Nisen. I am the Supervising 6 Attorney of the Voting Rights Practice Group at 7 Disability Rights California, California’s protection 8 and advocacy system for people with disabilities. 9 “I, along with other members of my staff, participated 10 in the testing of Dominion’s ImageCast Remote 5.2. 11 After reading through the reports online, these are my 12 following comments. 13 “This PIN process is too cumbersome. It would require 14 the voter have to have some dedication to not give up 15 during this process. I understand that people are 16 concerned with security at this time. However, just 17 giving people more hoops to jump through will not make 18 the system more secure and will scare away people who 19 could benefit from having vote-by-mail be made 20 accessible to them without having to waive their right 21 to a private and independent vote. I have a reason to 22 believe that Dominion is willing to work with counties 23 to make their process less burdensome for voters with 24 disabilities. 25 “As a condition of approval, the Secretary of State’s California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 22 1 Office should require that the voter verification be a 2 one-step process, asking for voter I’D, name and date 3 of birth, similar to other RAVBM systems. 4 “Personally, I found the system easy to use, once I 5 was able to get to the ballot. However, one of our 6 staff members who uses the Java screen reading 7 software on his computer also tested the system, 8 including the problems with the audio instructions on 9 how to complete a write-in candidate selection. He 10 also found a problem with the audio instructions on 11 how to return to the previous screen. 12 “I also noted in the Staff Report that the Secretary 13 of State’s Office expects counties to remake all the 14 ballots that come in using this Remote Accessible 15 Vote-By-Mail System. It is my understanding that when 16 counties are using an ImageCast Voting System, as well 17 as ImageCast Remote 5.2, they can simply be slipped 18 into the ballot box when it is removed from the 19 envelope. This would make the voter’s choices as 20 private as any other vote-by-mail voters since they do 21 not have to use copy to a paper ballot. 22 “In fact, I understand that a county that uses 23 Dominion ICX Ballot Marking Device as their 24 accessibility voting system can use the ICX to 25 duplicate the remote ballot. I am not advocating that California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 23 1 a county purchase a particular system, but if a county 2 uses ImageCast to count their ballots and they use 3 this Accessible Vote-By-Mail System, they should be 4 able to input the Accessible Vote-By-Mail ballots 5 directly into the ballot counter. This would ensure 6 that the voter has a private and independent ballot to 7 the ballot box without anybody filling out a ballot 8 for them. 9 “Thank you.” 10 MS. LAPSLEY: Great. Thank you. 11 Thank you, Mr. Nisen. 12 Seeing no other members of the public wishing to 13 have -- to make public comment, we will be accepting public 14 comment through May 6th, again, as I indicated before, to 15 the Voting Systems at sos.ca.gov email address. People can 16 feel free to send them electronically, or via U.S. Mail to 17 Secretary of State, Attention: Voting System Comment, 1500 18 11th Street, 6th Floor, Sacramento, California 95814. 19 And that with, we’ll go ahead and conclude this 20 public hearing. Again, I thank everyone for coming and for 21 your time today. Thank you. 22 (The hearing concluded at 9:39 a.m.) 23 24 25 California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 24 REPORTER’S CERTIFICATE I do hereby certify that the testimony in the foregoing hearing was taken at the time and place therein stated; that the testimony of said witnesses were reported by me, a certified electronic court reporter and a disinterested person, and was under my supervision thereafter transcribed into typewriting. And I further certify that I am not of counsel or attorney for either or any of the parties to said hearing nor in any way interested in the outcome of the cause named in said caption. IN WITNESS WHEREOF, I have hereunto set my hand this 10th day of May, 2018. PETER PETTY CER**D-493 Notary Public California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610 25 CERTIFICATE OF TRANSCRIBER I do hereby certify that the testimony in the foregoing hearing was taken at the time and place therein stated; that the testimony of said witnesses were transcribed by me, a certified transcriber and a disinterested person, and was under my supervision thereafter transcribed into typewriting. And I further certify that I am not of counsel or attorney for either or any of the parties to said hearing nor in any way interested in the outcome of the cause named in said caption. I certify that the foregoing is a correct transcript, to the best of my ability, from the electronic sound recording of the proceedings in the above-entitled matter. May 10, 2018 MARTHA L. NELSON, CERT**367 California Reporting, LLC 229 Napa St., Rodeo, CA 94572 (510) 313-0610