Withdrawal of Approval/Conditional Reapproval - December 6, 2007 Revision

SECRETARY OF STATE WITHDRAWAL OF APPROVAL OF HART INTERCIVIC SYSTEM 6.2.1 DRE & OPTICAL SCAN VOTING SYSTEM AND CONDITIONAL RE-APPROVAL OF USE OF HART INTERCIVIC SYSTEM 6.2.1 DRE & OPTICAL SCAN VOTING SYSTEM (December 6,2007 Revision) Whereas, pursuant to Elections Code section 19201, no voting system, in whole or in part, may be used unless it has received the approval of the Secretary of State; and Whereas, Elections Code section 19222 requires that I, as Secretary of State for the State of California, conduct periodic reviews of voting systems to determine if they are defective, obsolete, or otherwise unacceptable; and Whereas, at my inauguration as Secretary of State on January 8,2007, I announced my intention to conduct a top-to-bottom review of voting systems approved for use in Califomia; and Whereas, on March 22,2007, I circulated for public comment draft criteria for a review of voting systems approved fir use in ~alifor&ac, overing system security issues, access for voters with disabilities, access for minority language voters, and usability for - - elections officials and poll workers; and Whereas, pursuant to my statutory obligations, I have undertaken such a review of voting systems approved for use in California, including the Hart Intercivic System 6.2.1 voting - svstem. uursuant to a contract with the Regents of the Universitv of California and cbnducted by experts selected and supervised by principal inve&igators kom the computer science faculties of the Berkelev and Davis carnuuses, to determine if the voting systems are defective, obsolete, orotherwise unacceptable for use in the February 5,2008, Presidential Primary Election and subsequent elections in California; and Whereas, the study was completed on July 20,2007, following which the expert reviewers delivered their written reports on their findings and methodology; and Whereas, the expert reviewers found that the quality of the 2002 Voting System Standards (VSS) to which each of the three systems in their study were certified is inadequate, and noted further that questions have been raised about the effectiveness of the testing; for example, Ciber, lnc:, a testing laboratory involved in testing of voting systems under the 2002 VSS, has been denied interim accreditation for testing voting systems by the Federal Election Assistance Commission after finding that ~ibe"rw as not following its quality-control procedures and could not document that it was conducting all the required tests"; and Whereas, the expert reviewers demonstrated that the physical and technological security mechanisms provided by the vendors for each of the voting systems analyzed were inadequate to ensure accuracy and integrity of the election results and of the systems that provide those results; and Whereas, the expert reviewers reported that all of the voting systems studied contain serious design flaws that have led directly to specific vulnerabilities, which attackers could exploit to affect election outcomes; and Whereas, the Hart Source Code Review Team found that the Hart voting system contains design features that can be used in a fashion for which those design features were not intended, including network interfaces that are not secured against direct attack; and Whereas, the Hart Source Code Review Team found that the Hart voting system's software fails to check the correctness of inputs from other Hart voting system components and uses those inputs in unsafe ways, potentially enabling an attacker to use voting system components to reprogram voting system units throughout the county with malicious code that would affect a subsequent election; and Whereas, the Hart Source Code Review Team found that the Hart voting system exhibits a notable lack of the use of cryptographic security protocols to secure network communications, and where cryptography is used, a single countywide symmetric key is used that could allow a person to forge ballot information and election results in multiple polling locations; and Whereas, the Hart Source Code Review Team found that the Hart voting system allows raw ballot records and other information to be used to reconstruct how each voter voted, potentially compromising the secrecy of the ballot; and Whereas, the Hart Source Code Review Team found that many attacks are hard to detect and correct, defying development and implementation of simple, effective countermeasures; and Whereas, the Hart Red Team that conducted penetration testing of the Hart voting system discovered multiple vulnerabilities; and Whereas, on non-polling place components of the voting system that run on a Windows platform, Hart Red Team members located an undisclosed database user name and password and also manually bypassed Hart software security settings so they could run - the Hart software in a standard Windows desktop environment, a possible vector for . unauthorized access to the voting system's datadases; and Whereas, Hart Red Team members determined that the Hart voting system software fails to check the correctness of inputs h m o ther Hart voting system components; and Whereas, Hart Red Team members were able to access device-level menus on the Hart eScan precinct-based optical scan unit that should have been locked with passwords, which could allow access for altering voting system configuration settings; and Whereas, Hart Red Team members confirmed findings f7om previous studies that allowed malicious actions to be ~erformedo n the Hart eScan ~recinct-basedo ~ticaslc an unit, including altering vote totals, using tools commonly found in an office; and Whereas, Hart Red Team members were able to demonstrate the ability, after the close of the polls, to use a laptop computer to tamper with a Mobile Ballot BOX-memoryd evice used to record votes cast on the eSlate direct recording electronic voting device, an attack that, if undetected during the tampering, could alter vote totals in a m&er not detected by technological safeguards but detectable in a manual recount; and Whereas, Hart Red Team members found that the Hart voting system allows for remote eavesdropping and capture of the audio narration of a ballot (a feature designed for use by voters with disabilities), potentially violating the secrecy of the ballot; and Whereas, on July 30,2007, a duly noticed public hearing was held to give interested persons an opportunity to express their views regarding the review of various voting systems, including the Hart Intercivic System 6.2.1 voting system; at this hearing, approximately 60 individuals testified; many more submitted comments by letter, facsimile transmission, and electronic mail; and Whereas, pursuant to Elections Code section 19222, I, as Secretary of State, am authorized to withdraw approval previously granted of any voting system or part of a voting system if I determine that voting system or any part of that voting system to be defective or othenvise unacceptable; and Whereas, I have reviewed the Hart Intercivic System 6.2.1 voting system and I have reviewed and considered several reports regarding the use of this voting system; the public testimony presented at the duly noticed public hearing held on July 30,2007, and the comments submitted by letter, facsimile transmission, and electronic mail; and Whereas, pursuant to Elections Code section 19222, six months' notice must be given before withdrawing approval previously granted of any voting system or part of a voting system unless I, as Secretary of State, for good cause shown, make a determination that a shorter period is necessary; and Whereas, pursuant to Elections Code section 19222, any withdrawal by the Secretary of State of the previous approval of a voting system or part of a voting system is not effective as to any election conducted within six months of that withdrawal; now Therefore, I, Debra Bowen, Secretary of State for the State of California, find and determine, pursuant to Division 19 of the Elections Code, as follows: For the reasons set forth above, the Hart Intercivic System 6.2.1 voting system, comprised of JBC, version 4.3.1, eSIatelDAU, version 4.2.13, escan, version 1.3.14, VBO, version 1.8.3, eCM Manager, version 1.1.7, Ballot Now software, version 3.3.11, BOSS software, version 4.3.13, Rally software, version 2.3.7, Tally software, version 4.3.10, and SERVO, version 4.2.10, which was previously approved, is found and determined to be defective or unacceptable and its certification and approval for use in subsequent elections in California is withdrawn effective August 3,2007, except as specifically provided below. 1. Before any use in the February 5,2008, Presidential primary election, jurisdictions must reinstall all software and firmware (including reformatting all hard disk drives and reinstalling the operating system where applicable) on all election management system servers and workstations, voting devices and hardware components of the voting system. Voting system application software must be reinstalled using the currently approved version obtained directly from the federal testing laboratory or the Secretary of State. 2. Within 30 days of the original issuance of this document on August 3,2007, the vendor must present a plan and jurisdiction Use Procedures to the Secretary of State for approval that will prevent future viral propagation of malicious software fiom one system component to another, such as from a voting system component located in one precinct to voting system components located in other precincts. The plan and Use Procedures must incorporate, or employ methods at least as effective as, a configuration of parallel central election management systems separated by an "air- gap" where (1) a permanent central system known to be running unaltered, certified software and firmware is used solely to define elections and program voting equipment and memory cards, (2) a physically-isolated duplicate system, reformatted after every election to guard against the possibility of infection, is used solely to read - memory cards containing vote results, accumulate and tabulate those results and produce reports, and (3) a separate computer dedicated solely to this purpose is used to reformat all memory devices before they are connected to the permanent system again. (This "airgap" model was proposedby the Source Code Review ~ e k t h a t reviewed the Diebold Election Systems, Inc., GEMS 1.18.24 voting system. Further details concerning the model are provided in Section 6.10 of the Source Code Review of the Diebold Voting System, dated July 20,2007, and available on the Secretary of State website at http://www.sos.ca.gov/elections/voting svstems/ttbr/diebold-source- public-iul29.vdf.) The vendor's plan must prohibit the installation of TALLY and SERVO on the same computer. The vendor's plan must also require each SERVO computer to be rebooted from a write-once CD-ROM or read-only flash drive containing the trusted build of SERVO following each connection of an eSlate or JBC device to the SERVO computer and prior to connection of another eSlate or JBC device to the SERVO computer. The vendor's plan must require jurisdictions that use more than one eSlate per precinct to permanently assign each precinct a set of JBC and eSlate devices; identified by serial number, for use in all elections, taking into account equipment replacement needs and precinct consolidations. 3. Within 30 days of the original issuance of this document on August 3,2007, the vendor must submit to the Secretary of State for approval specifications for the hardware and operating system platform that must be used for all applicable components of the voting system. The vendor must identify the requirements for "hardening" the configuration of that platform, including, but not limited to: BIOS configuration; Identification of essential services that are required and non-essential services that must be disabled, Identification of essential ports that are required and non-essential ports that must be disabled and, if feasible, removed or physically blocked; Audit logging configuration; Definition of user security roles and associated permissions to assure all users have only the minimum required permissions for their role; Password policies, including password strength, expiration, and maximum attempts, along with all related user account control settings; and All utilities and software applications, with specifications for their installation, configuration and use, that are necessary for operation of the voting system (e.g., security software, data compression utilities, Adobe Acrobat, etc.). The vendor must identify automated mechanisms for jurisdictions to confirm and document that their system has been configured to these standards, and that all updatable components are the approved version and level. The vendor must provide full instructions for the use of these mechanisms, including expected results. 4. Immediately after any repair or modification of any voting system component that requires opening the housing, the integrity of the firmware and/or software must be verified using the automated mechanisms described above, or all software must be reinstalled by the jurisdiction from a read-only version of the approved firmware and/or software supplied directly by the federal testing laboratory or Secretary of State before the equipment can be put back into service. 5. Jurisdictions are prohibited from installing any software applications or utilities on any component of the voting system that have not been identified by the vendor and approved by the Secretary of State. 6. Within 30 days of the original issuance of this document on August 3,2007, the vendor must develop and submit to the Secretary of State for approval, a plan and procedures for timely identification of required security updates (e.g., operating system security patches, security software updates, etc), vendor testing of the updates, and secure distribution and application of vendor-approved security updates. 7. Within 45 days of the original issuance of this document on August 3,2007, the vendor, working with elections officials, must develop and submit to the Secretary of State for approval, requirements and use procedures for operating and maintaining the physical and logical security of the system, including, but not limited to: Physical security and access to the system and all components; Network security; Data security (including data backup requirements and procedures); and Separation of roles and responsibilities for jurisdiction personnel. 8. No network connection to any device not directly used and necessary for voting system functions may be established. Communication by or with any component of the voting system by wireless or modem transmission is prohibited at any time. No component of the voting system, or any device with network connectivity to the voting system, may be connected to the Internet, directly or indirectly, at any time. 9. Within 45 days of the original issuance of this document on August 3,2007, the vendor, working with elections officials, must develop and submit to the Secretary of State for approval, detailed requirements and use procedures for programming, pre- and post-election logic and accuracy testing, transporting and operating voting equipment that will prevent or detect unauthorized access to or modification of any component of the voting system, including, but not limited to: Chain of custody controls and signature-verified documentation; Requirements for secure interim storage of any system component; and Employment of mechanisms to detect unauthorized access to the equipment. Following meetings with vendor and county representatives in the period from September 28,2007, through October 5,2007, the Secretary of State has determined that, at a minimum, the Use Procedures must require the jurisdiction to secure all voting system components in one or more uniquely serialized, tamper-evident container(s) before the jurisdiction transfers them to the custody of an Inspector, other poll worker, drayage company or other intermediary, or before jurisdiction personnel deliver them to a secure polling place or secure satellite distribution facility, as the case may be. Transportation of voting system components to the custody of an Inspector, other poll worker, drayage company or other intermediary, secure polling place, or secure satellite distribution facility shall not occur earlier than 10 calendar days prior to Election Day. Electronic components of a voting system not transported back to the jurisdiction headquarters on election night must be secured in one or more uniquely serialized, tamper-evident container(s) and placed in secured storage. The use procedures must impose the same requirements for signed logging of the inspection of security containers and the removal and return of voting system components to security containers that apply to security seals and locks on the voting system components themselves. The following are examples of acceptable tamper- evident containers: A uniquely serialized, sealed banker's bag; A zippered nylon or canvass bag or case on which the zipper@)t hat prevent access to the voting system component(s) inside are kept closed by a uniquely serialized, tamper-evident lock; or A hard lid that blocks access to all doors, ports or other points of access to the inside of the voting system component(s) and that is held in place by a latch or latches closed with a uniquely serialized, tamper-evident lock or locks. The Use Procedures must also require a minimum of two elections ofiicials or poll workers to perform or directly observe critical security processes, such as sealing and locking equipment for transport, conducting logic and accuracy testing, verifying the integrity and authenticity of security locks and seals, setting up voting equipment, opening the polls, closing the polls and printing results. 10. Where application of tamper-evident seals directly to a system component is required to detect unauthorized access to the component, those seals must be serialized and the vendor must specify in each instance the-type of the seal to be used and the exact placement of that seal using photographs. 11 . Upon request, members of the public must be permitted to observe and inspect, without physical contact, the integrity of all externally visible security seals used to secure voting equipment in a time and manner that does not interfere with the conduct of the election or the privacy of any voter. 12. Where voting equipment is used to record and tabulate vote results in a polling place, upon close of the polls, the poll workers are required to print two copies of the accumulated vote results and one audit log ffom each JBC or eScan. Each poll worker must sign every copy. One copy of the vote results fkom each device must be publicly posted outside the polling place. The second copy, along with the audit log, must be included with the official election material that is returned to the jurisdiction headquarters on election night. 13. No poll worker or other person may record the time at which or the order in which voters vote in a polling place. 14. Poll workers are not permitted to have access to any VBO audit records, nor may they participate in any audits or recounts involving VBO audit records. Poll workers may participate in audits involving VBO audit records from a precinct other than the one in which they were a poll worker. 15. Within 60 days of the original issuance of this document on August 3,2007, the vendor, working with elections officials, must develop and submit to the Secretary of State for approval, specific detailed requirements and use procedures for vote results auditing and reconciliation, review of audit logs and retention of election documentation to validate vote results and detect unauthorized manipulation of vote results, including, but not limited to: Precinct level ballot accounting; Identification of abnormal voting patterns on VBO audit trails; and Reconciliation of variances between electronic and manual audit vote results. 16. Any post-election auditing requirements imposed as a condition of this certification . shall be oaid for bv the vendor. Elections officials are reauired to conduct the audits and the vendor is required to reimburse the jurisdiction. 17. After consultation with elections officials, the Secretary of State shall establish additional post-election manual count auditing requirements, including: Increased manual count sample sizes for close races, based on an adjustable sample model, where the size of the initial random sample depends on a number of factors, including the apparent margin of victory, the number of precincts, the number of ballots cast in each precinct, and a desired confidence level that the winner of the election has been called correctly. In establishing sampling requirements for close races, the Secretary of State may impose a specific sampling threshold for a given 10 vote differential or percentage of the margin of victory, taking into account the number of electors and the number and size of precincts in the race; Escalation requirements for expanding the manual count to additional precincts when variances are found; and Procedures to increase transparency and effectiveness of post election manual count audits. Elections officials must comply with these requirements as set forth by the Secretary of State in the document entitled "Post-Election Manual Tally Requirements" and any successor document. The vendor shall reference compliance with the "Post-Election Manual Tally Requirements" in its Use Procedures for the voting system 18. Each polling place must be equipped with a method or log in a format specified by the Secretarv of State after consultation with the elections officials to record all problems anh issues with the voting equipment in the polling place as reported by voters or observed by poll workers. Such records must include the following information for each event: Date and time of occurrence; Voter involved, if any; Equipment involved; Brief description of occurrence; Actions taken to resolve issue, if any; and Elections official(s) who observed andlor recorded the event. All such event logs or reports must be made available to the public for inspection and review upon request. Prior to or concurrent with the certification of the election, the elections official must submit a report to the Secretary of State of all reported problems experienced with the voting system and identifying the actions taken, if any, to resolve the issues. 19. Training of poll workers must include the following: Secure storage of voting equipment while in the poll worker's possession; Chain-of-custody procedures required for voting equipment and polling place supplies; Seal placement and procedures for verification of seal integrity; - . Placement and observation of voting equipment; Observation of activity that could indicate tampering or an attempt at tampering; The Voter Bill of Rights set forth in section 2300 of the Elections Code; The purpose served by the Voter Verified Paper Audit Trail (VVPAT), the importance of its use by voters, and how to handle problems such as paper jams; How to ensure, when required, that a minimum of five voters vote on each DRE in a polling place; The public right to inspect voting equipment and security seals, and how to handle requests for such inspection; How to handle equipment failure or lack of sufficient paper ballots in a polling place and how to ensure continuity of the election in the event of such a failure; and How to properly log all events and issues related to voting equipment in the polling place, including voter complaints of malfunctioning equipment. 20. Elections officials must develop appropriate security procedures for use when representatives of qualified political parties and bona fide associations of citizens and media associations~p ursuant to theirrights under Elections Code section 15004, check and review the preparation and operation of vote tabulating devices and attend any or all phases of the election. The security procedures must permit representatives to observe at a legible distance the contents of the display on the vote tabulating computer or device. This requirement may be satisfied by positioning an additional display monitor or monitors in a manner that allows the representatives to read the contents displayed on the vote tabulating computer or device while also observing the vote tabulating computer or device and any person or persons operating the vote tabulating computer or device. 21. All voters voting on paper ballots in a polling place must be provided a privacy sleeve for their ballot and instructed on its use in accordance with Elections Code section 14272. 22. A warning must be posted in each voting booth stating that, pursuant to Elections Code sections 18564,18565,18566,18567,18568 and 18569, tampering with voting equipment or altering vote results constitutes a felony, punishable by imprisonment. 23. With respect to any piece of voting equipment for which the chain of custody has been compromised or for which the integrity of the tamper-evident seals has been compromised, the following actions must be taken: The chief elections official of the jurisdiction must be notified immediately; The equipment must be removed from service immediately and replaced if possible; Any votes cast on the device prior to its removal from service must be subject to a 100% manual tally, by the process described in Elections Code section 15360, as part of the official canvass. Notice to the public of this manual tally may be combined with the notice required by any other manual tally required in this order or by Elections Code section 15360; Any memory card containing data from that device must be secured and retained for the 111 election retention period; An image of all device software and firmware must be stored on write-once media and retained securely for the 111e lection retention period; and All device software and firmware must be reinstalled from a read-only version of 8 the approved firmware and software supplied directly by the federal testing laboratory or the Secretary of State before the equipment is placed back into service. 24. If a voting device experiences a fatal error from which it cannot recover gracefully (i.e., the error is not handled through the device's internal error handling procedures with or without user input), such that the device must be rebooted or the device reboots itself to restore operation, the following actions must be taken: The chief elections official of the jurisdiction must be notified immediately; The equipment must be removed from service immediately and replaced as soon as possible; Any votes cast on the device prior to its removal from service must be subject to a 100% manual tally, by the process described in Elections Code section 15360, over and above the normal manual tally conducted during the official canvass as defined in Elections Code section 336.5. Notice to the public of this manual tally may be combined with the notice required by any other manual tally required in this order or by Elections Code section 15360; Any memory card containing data from that device must be secured and retained for the fill election retention period; An image of all device software and firmware must be stored on write-once media and retained securely'for the full election retention period; The vendor or jurisdiction shall provide an analysis of the cause of the failure; Upon request by the Secretary of State, the vendor or jurisdiction shall retain the device for a reasonable period of time to permit forensic analysis; and All device software and firmware must be reinstalled from a read-only version of the approved firmware and software supplied directly by the federal testing laboratory or the Secretary of State before the equipment is placed back into service. 25. The Secretary of State will review and finalize all plans, requirements and procedures submitted pursuant to the foregoing requirements above within thirty days of receipt. Upon approval, all such plans, requirements and procedures will automatically be incorporated into the official use procedures for the voting system, and will become binding upon all users of the system. 26. No substitution or modification of the voting system shall be made with respect to any component of the voting system, including the Use Procedures, until the Secretary of State has been notified in writing and has determine that the proposed change or modification does not impair the accuracy and efficiency of the voting system sufficient to require a re-examination and approval. 27. The Vendor developed utilities, Fusion, In-Fusion, Bravo and Trans, are specifically excluded from this certification. 28. The Secretary of State reserves the right, with reasonable notice to the vendor and to the jurisdictions using the voting sys&m; to modify the Use Procedures used with the voting system and to impose additional requirements with respect to the use of the system if the Secretary of state determinesthat such modifications or additions are necessary to enhance the accuracy, reliability or security of any of the voting system. Such modifications or additions shall be deemed to be incorporated herein as if set forth in full. 29. Any jurisdiction using this voting system shall, prior to such use in each election, file with the California Secretary of State a copy of its Election Observer Panel plan. 30. The vendor agrees in writing to provide, and shall provide, to the Secretary of State, or to the Secretary of State's designee, within 30 days of the Secretary of State's demand for such, a working version of the voting system, including all hardware, firmware and software of the voting system, as well as the source code for any software or firmware contained in the voting system, including any commercial off the shelf software or firmware that is available and disclosable by the vendor, provided that the Secretary of State first commits to the vendor in writing to maintain the confidentiality of the contents of such voting system or source code so as to protect the proprietary interests of the vendor in such voting system or source code. The terms of the commitment to maintain confidentiality shall be determined solely by the Secretary of State, after consultation with the vendor. The voting system shall not be installed in any California jurisdiction until the vendor has signed such an agreement. Any reasonable costs associated with the review of the source code for any software or firmware contained in the voting system shall be born by the vendor. 31. The Secretary of State reserves the right to monitor activities before, during and after the election at any precinct or registrar of voters' office, and may, at his or her discretion, conduct a random parallel monitoring test of voting equipment. 32. By order of the Secretary of State, voting systems certified for use in California shall comply with all applicable state and federal requirements, including, but not limited to, those voting system requirements as set forth in the California Elections Code and the Help America Vote Act of 2002 and those requirements incorporated by reference in the Help America Vote Act of 2002. Further, voting systems shall also comply with all state and federal voting system guidelines, standards, regulations and requirements that derive authority from or are promulgated pursuant to and in furtherance of California Elections Code and the Help America Vote Act of 2002 or other applicable state or federal law when appropriate. 33. Voting system manufacturers or their agents shall assume full responsibility for any representation they make that a voting system complies with all applicable state and federal requirements, including, but not limited to, those voting system requirements as set forth in the California Elections Code and the Help America Vote Act of 2002 and those requirements incorporated by reference in the Help America Vote Act of .,, 2002. In the event such revresentation is determined to be false or misleadine. voting " system manufacturers or their agents shall be responsible for the cost of any upgrade, retrofit or replacement of any votin-g sy- stem or its comvonent varts found to be necessary for certification or otherwise not in compliance. 34. Any voting system purchased with funds allocated by the Secretary of State's office shall meet all applicable state and federal standards, regulations and requirements, including, but not limited to, those voting system requirements as set forth in the California Elections Code and the Help America Vote Act of 2002 and those requirements incorporated by reference in the Help America Vote Act of 2002. 35. The vendor must establish a California County User Group and hold at least one annual meeting where all California users and Secretary of State staff are invited to attend and review the system and ensure voter accessibility. 36. In addition to depositing the source code in an approved escrow facility, the vendor must deposit with the Secretary of State a copy of the system source code, binary executables and tools and documentation, to allow the complete and successful compilation and installation of a system in its production/operational environment with confirmation by a verification test by qualified personnel using only this content. The Secretary of State reserves the right to perform a full independent review of the source code at any time. 37. The vendor must provide printing specifications for paper ballots to the Secretary of State. The Secretary of State will certify printers to print ballots for this system based upon their demonstrated ability to do so. The vendor may not require exclusivity in ballot printing and must cooperate fully in certification testing of ballots produced by other ballot printers. 38. Where circumstances require it, the Secretary of State may adjust or suspend any of the conditions of recertification for a vendor or a jurisdiction, as the Secretary of State deems prudent and necessary to facilitate successful election administration. Such adjustments or suspensions shall be deemed to be incorporated herein as if set forth in full. IN WITNESS WHEREOF, I hereunto set my hand and aMix the Great Seal of the State of California, this 6" day of December 2007. i dBRAB o w m Secretary of State 13