Hart Verity Voting 3.2 Voting System Software Testing Report

Hart InterCivic Verity Voting 3.2 Voting System Software Test Report for California Secretary of State CAF-22010-CSTR-06 Vendor Name Hart InterCivic Vendor System Verity Voting 3.2 Prepared by: 4720 Independence St. Wheat Ridge, CO 80033 303-422-1566 www.SLICompliance.com Accredited by the Election Assistance Commission (EAC) for Selected Voting System Test Methods or Services California Secretary of State Hart InterCivic Verity Voting 3.2 California Certification Software Test Report v6.0 Revision History Date Release Author Revision Summary June 3, 2022 1.0 B. Roberson Initial Release April 24, 2023 2.0 B.Roberson Added results for RCV May 3, 2023 3.0 B.Roberson Added updated results for RCV July 17, 2023 4.0 B. Roberson, Updated for CASOS comments M. Santos July 21, 2023 5.0 M. Santos Removed RCV references August 7, 2023 6.0 M. Santos Updated grammar Disclaimer The information reported herein must not be used by the client to claim product certification, approval, or endorsement by NVLAP, NIST, or any agency of the Federal Government. All testing conducted for this engagement has been done outside of the U.S. Election Assistance Commission's (EAC) Test and Certification Program. In no way does this test report represent an EAC certification against the Voluntary Voting System Guidelines (VVSG) or any other standard. Trademarks • SLI is a registered trademark of SLI Compliance. • All products and company names are used for identification purposes only and may be trademarks of their respective owners. Copyright 2023 by SLI ComplianceSM, a Division of Gaming Laboratories International, LLC California Certification Software Test Report Page 2 of 11 Document No. CAF-22010-CSTR-06 California Secretary of State Hart InterCivic Verity Voting 3.2 California Certification Software Test Report v6.0 TABLE OF CONTENTS INTRODUCTION ................................................................................................................................. 4 SCOPE OF THE HART INTERCIVIC VERITY VOTING 3.2 VOTING SYSTEM ................................................ 4 REVIEW SPECIFICATIONS ............................................................................................................... 5 SOURCE CODE REVIEW ...................................................................................................................... 5 REVIEW RESULTS............................................................................................................................. 7 DISCREPANCIES ................................................................................................................................. 7 VULNERABILITIES ............................................................................................................................... 8 FINAL REPORT ................................................................................................................................ 11 California Certification Software Test Report Page 3 of 11 Document No. CAF-22010-CSTR-06 California Secretary of State Hart InterCivic Verity Voting 3.2 California Certification Software Test Report v6.0 INTRODUCTION This report outlines the test approach SLI Compliance (SLI) followed when performing Software Testing on the Hart Intercivic Verity Voting 3.2 voting system (Hart Verity Voting 3.2) against the California Voting System Standards (CVSS). The purpose of this document is to provide an understanding of the work SLI conducted. Scope of the Hart InterCivic Verity Voting 3.2 Voting System This section provides a description of the scope of the following Hart Verity Voting 3.2 voting system components: • Verity Data application • Verity Build application • Verity Count application • Verity Central application • Verity Election Management • Verity Desktop • Verity User Manager • Verity Scan firmware/hardware • Verity Touch Writer with Access firmware/hardware • Verity Reader firmware/hardware • Verity Print firmware/hardware Verity Data provides the user with controls for entering and proofing data and audio. Verity Data also performs validation on the exported information to ensure that it will successfully import into Verity Build. Verity Build opens the election to proof data, view reports, and print ballots. It also allows for configuring and programming the Verity Scan digital scanners and Verity Touch Writer ballot marking devices (BMD), as well as producing the election definition and auditing reports. Verity Count is an application that tabulates election results and generates reports. Verity Count can be used to collect and store all election logs from every Verity component/device used in the election, allowing for complete election audit log reviews. Verity Central is a high-speed, central digital ballot scanning system used for high- volume processing of ballots (such as vote by mail). The unit is based on commercial-off-the-shelf (COTS) scanning hardware coupled with the custom Hart- California Certification Software Test Report Page 4 of 11 Document No. CAF-22010-CSTR-06 California Secretary of State Hart InterCivic Verity Voting 3.2 California Certification Software Test Report v6.0 developed ballot processing application software which resides on an attached workstation. Verity Election Management allows users with the Administrator role to import and manage election definitions. Imported election definitions are available through the Elections chevron in Verity Build. Users can also delete, archive, and manage the election definitions. Verity Desktop enables users with the correct roles to set the workstations’ date and time, gather Verity application hash codes (in order to validate the correctness of the installed applications), and to access Windows desktop. Verity User Manager enables users with the correct role and permissions to create and manage user accounts within the Verity Voting system for the local workstation in a standalone configuration, or for the network in a networked configuration. Verity Scan is a digital scan precinct ballot counter (tabulator) that is used in conjunction with an external ballot box. The unit is designed to scan marked paper ballots, interpret and record voter marks on the paper ballot, and deposit the ballots into the secure ballot box. The Verity Touch Writer with Access is a standalone precinct level BMD which also includes an Audio Tactile Interface (ATI), which allows voters who cannot complete a paper ballot to generate a machine-readable and human-readable paper ballot, based on vote selections made. Verity Reader is a voting center ballot reading device for marked paper ballots, that a voter can use to verify how their ballot is being read. Verity Print is a voting center ballot production device for unmarked paper ballots. REVIEW SPECIFICATIONS The following are the specifications for source code testing conducted on the Hart Verity Voting 3.2 voting system. Source Code Review The Hart Verity Voting 3.2 voting system includes proprietary software and firmware. The voting system code base was tested to the applicable CVSS requirements. Review of the code included: • Adherence to the applicable standards in sections 5 and 7 of the CVSS California Certification Software Test Report Page 5 of 11 Document No. CAF-22010-CSTR-06 California Secretary of State Hart InterCivic Verity Voting 3.2 California Certification Software Test Report v6.0 • Adherence to other applicable coding format conventions and standards including best practices for the coding language used • Analysis of the program logic and branching structure • Evaluation of whether the system is designed in a way that allows meaningful analysis, including: o Whether the architecture and code are amenable to an external review o Whether code analysis tools can be usefully applied o Whether the code complexity is at a level that obfuscates its logic Security considerations reviewed against the code base included: • Search for exposures to commonly exploited vulnerabilities • Evaluation of the use and correct implementation of cryptography and key management • Analysis of error and exception handling • Evaluation of the likelihood of security failures being detected o Evaluation of whether audit mechanisms are reliable and tamper resistant o Evaluation of whether data that might be subject to tampering is properly validated and authenticated • Evaluation of the risk that a user can escalate his or her capabilities beyond those authorized • Evaluation of the design and implementation to ensure that sound, generally accepted engineering practices are followed, checking to verify that code is defensively written against: o Bad data o Errors in other modules o Changes in environment o User errors o Other adverse conditions • Evaluation of embedded, exploitable code (such as “Easter eggs”) that can be triggered to affect the system • Evaluation of the code for dynamic memory access features which would permit the replacement of certificated executable code or control data or insertion of exploitable code or data. • Evaluation of the code for use of runtime scripts, instructions, or other control data that can affect the operation of security relevant functions or the integrity of the data. California Certification Software Test Report Page 6 of 11 Document No. CAF-22010-CSTR-06 California Secretary of State Hart InterCivic Verity Voting 3.2 California Certification Software Test Report v6.0 Source Code Review Tools utilized by SLI included: • Module Finder: an SLI proprietary application used to parse module names from C/C++, Java and VB code and populate the identified module names into the review documents • Examdiff: Pro 5: a commercial application used to compare source code deliveries. • Understand: a commercial application used to review code to stated requirements REVIEW RESULTS Discrepancies Discrepancies are reported such that the California Secretary of State is provided with a basis for evaluating the extent to which the source code meets applicable standards. Verity Data source code review No source code requirements were found to be an issue within the Verity Data source code base reviewed; as a result, no discrepancies were written against the code base. Verity Build source code review No source code requirements were found to be an issue within the Verity Build source code base reviewed; as a result, no discrepancies were written against the code base. Verity Count source code review No source code requirements were found to be an issue within the Verity Count source code base reviewed; as a result, no discrepancies were written against the code base. Verity Central source code review No source code requirements were found to be an issue within the Verity Central source code base reviewed; as a result, no discrepancies were written against the code base. California Certification Software Test Report Page 7 of 11 Document No. CAF-22010-CSTR-06 California Secretary of State Hart InterCivic Verity Voting 3.2 California Certification Software Test Report v6.0 Verity Election Management source code review No source code requirements were found to be an issue within the Verity Election Management source code base reviewed; as a result, no discrepancies were written against the code base. Verity Desktop source code review No source code requirements were found to be an issue within the Verity Desktop source code base reviewed; as a result, no discrepancies were written against the code base. Verity User Manager source code review No source code requirements were found to be an issue within the Verity User Manager source code base reviewed; as a result, no discrepancies were written against the code base. Verity Scan source code review No source code requirements were found to be an issue within the Verity Scan source code base reviewed; as a result, no discrepancies were written against the code base. Verity Touch Writer with Access source code review No source code requirements were found to be an issue within the Verity Touch Writer source code base reviewed; as a result, no discrepancies were written against the code base. Verity Reader source code review No source code requirements were found to be an issue within the Verity Reader source code base reviewed; as a result, no discrepancies were written against the code base. Verity Print source code review No source code requirements were found to be an issue within the Verity Print source code base reviewed; as a result, no discrepancies were written against the code base. Vulnerabilities For any vulnerabilities discovered, SLI was tasked with identifying the particular standards applicable to each vulnerability. To the extent possible, reported vulnerabilities include an indication of whether the exploitation of the vulnerability would require access by: California Certification Software Test Report Page 8 of 11 Document No. CAF-22010-CSTR-06 California Secretary of State Hart InterCivic Verity Voting 3.2 California Certification Software Test Report v6.0 • Voter: Usually has low knowledge of the voting machine design and configuration. Some may have more advanced knowledge. May carry out attacks designed by others. They have access to the machine(s) for less than an hour. • Poll worker: Usually has low knowledge of the voting machine design and configuration. Some may have more advanced knowledge. May carry out attacks designed by others. They have access to the machine(s) for up to one week, but all physical security has been put into place before the machines are received. • Elections official insider: Has a wide range of knowledge of the voting machine design and configuration. May have unrestricted access to the machine for long periods of time. Their designated activities include: o Set up and pre-election procedures; o Election operation; o Post-election processing of results; and o Archiving and storage operations. • Vendor insider: Has great knowledge of the voting machine design and configuration. They have unlimited access to the machine before it is delivered to the purchaser and, thereafter, may have unrestricted access when performing warranty and maintenance service, and when providing election administration services. SLI will not verify or demonstrate exploitability of the vulnerability, but the report of the vulnerability will identify factors involved in the exploitation. Any vulnerability theories developed by the source code review team members shall, to the extent possible, be referred to the Secretary of State staff. EMS source code vulnerability review No vulnerabilities were found within the EMS source code base reviewed; as a result, no findings were written against the code base. Verity Data source code vulnerability review No vulnerabilities were found to be an issue within the Verity Data source code base reviewed; as a result, no findings were written against the code base. Verity Build source code vulnerability review No vulnerabilities were found to be an issue within the Verity Build source code base reviewed; as a result, no findings were written against the code base. California Certification Software Test Report Page 9 of 11 Document No. CAF-22010-CSTR-06 California Secretary of State Hart InterCivic Verity Voting 3.2 California Certification Software Test Report v6.0 Verity Count source code vulnerability review No vulnerabilities were found to be an issue within the Verity Count source code base reviewed; as a result, no findings were written against the code base. Verity Central source code vulnerability review No vulnerabilities were found to be an issue within the Verity Central source code base reviewed; as a result, no findings were written against the code base. Verity Election Management source code vulnerability review No vulnerabilities were found to be an issue within the Verity Election Management source code base reviewed; as a result, no findings were written against the code base. Verity Desktop source code vulnerability review No vulnerabilities were found to be an issue within the Verity Desktop source code base reviewed; as a result, no findings were written against the code base. Verity User Manager source code vulnerability review No vulnerabilities were found to be an issue within the Verity User Manager source code base reviewed; as a result, no findings were written against the code base. Verity Scan source code vulnerability review No vulnerabilities were found to be an issue within the Verity Scan source code base reviewed; as a result, no findings were written against the code base. Verity Touch Writer with Access source code vulnerability review No vulnerabilities were found to be an issue within the Verity Touch Writer source code base reviewed; as a result, no findings were written against the code base. Verity Reader source code vulnerability review No vulnerabilities were found to be an issue within the Verity Reader source code base reviewed; as a result, no findings were written against the code base. Verity Print source code vulnerability review No vulnerabilities were found to be an issue within the Verity Print source code base reviewed; as a result, no findings were written against the code base. California Certification Software Test Report Page 10 of 11 Document No. CAF-22010-CSTR-06 California Secretary of State Hart InterCivic Verity Voting 3.2 California Certification Software Test Report v6.0 FINAL REPORT No discrepancy findings were located within the Hart Verity Voting 3.2 code base. No potential vulnerabilities were identified within the Hart Verity Voting 3.2 code base. As directed by the California Secretary of State, this software testing report does not include any recommendation as to whether the system should be approved. End of Software Test Report California Certification Software Test Report Page 11 of 11 Document No. CAF-22010-CSTR-06