Executive Summary

Executive Summary KNOWiNK PollPad v2.5.2.01b Electronic Poll Book System KNOWiNK applied for certification of the PollPad v2.5.2.01b electronic poll book system on June 26, 2020. Review included five phases of testing, and the scope included reviewing findings from the 2.5.0 testing. The testing included: (1) Accessibility, Usability and Privacy Testing, (2) Software Testing, (3) Security and Telecommunications Testing, (4) Functional Testing, and (5) Volume Testing. 1. Accessibility, Usability and Privacy Testing PollPad 2.5.0 Findings and Status: • WCAG 2.0 §1.1.1 – All images have appropriate, equivalent alternative text: Resolved • WCAG 2.0 § 1.1.1 - All linked images have descriptive alternative text: Resolved • WCAG 2.0 § 1.4.8 - Blocks of text over one sentence in length do not require horizontal scrolling when the text size is doubled: Resolved • WCAG 2.0 § 2.1.1 - All applicable page functionality is available using the keyboard: Resolved • WCAG 2.0 § 2.1.2 - Keyboard focus is never locked on one element. The user can navigate to and from all navigable page elements using only a keyboard: Resolved • WCAG 2.0 § 3.1.4 - Expansions for abbreviations are provided by expanding or explaining the definition the first time it is used: Resolved • Section 508 § 1194.21 - (c) An onscreen indication of the current focus shall be provided that moves among all elements as the input focus changes: Resolved • Section 508 § 1194.21 - (d) Sufficient information about a user interface element shall be available to assistive technology and also in text: Resolved • Section 508 § 1194.22 - (a) A text equivalent for every non-text element shall be provided: Resolved • Section 508 § 1194.22 - (k) A text-only page shall be provided to make a web site comply with the provisions of these standards: Resolved • Section 508 § 1194.22 - (n) If electronic forms are completed online, the form shall allow access to all information, field elements, and functionality via assistive technology: Resolved • Section 508 § 1194.23 - (k) Products which have mechanically operated controls or keys, shall be tactilely discernible without activating the controls or keys: Resolved • Section 508 § 1194.25 - (c) Where a product utilizes touchscreens or contact-sensitive controls, an input method shall be provided that complies with §1194.23 (k) (1) through (4): Resolved • Section 508 § 1194.25 - (e) Audio shall be provided at a standard signal, allow for private listening, and provide the ability to interrupt, pause, and restart the audio at any time: Resolved • Section 508 § 1194.25 - (f) When products deliver voice output, incremental volume control and a function to automatically reset the volume shall be available: Resolved • Section 508 § 1194.26 - (a) All mechanically operated controls and keys shall comply with §1194.23 (k) (1) through (4): Resolved • Section 508 § 1194.26 - (b) If a product utilizes touchscreens or touch-operated controls, an input method shall be provided that complies with §1194.23 (k) (1) through (4): Resolved PollPad 2.5.2.01b Findings and Status: SLI evaluated the PollPad against the applicable portions of the Web Content Accessibility Guidelines (WCAG) 2.0 and Section 508 of the Rehabilitation Act of 1973 for compliance. Zero (0) unexpected results or issues were encountered. Page 1 of 3 2. Software Testing (Source Code Review) PollPad 2.5.0 Findings and Status: • Controllers were throwing model windows and did not maintain proper architecture: Resolved • Unnecessary code comments were left in ‘In-Files’: Resolved • Syncable exporter can be restarted lacking a check for modifications between runs: Resolved • No evidence was found of use of encryption for peer to peer traffic: Resolved • Code comments about app instability after running the import function: Resolved PollPad 2.5.2.01b Findings and Status: SLI Compliance performed a security and integrity review of the PollPad source code. Zero (0) issues were identified within the PollPad source code. 3. Security and Telecommunications Testing (Red Team) PollPad 2.5.0 Findings and Status: The findings pertained to KNOWiNK’s ePulse web-based monitoring platform and were considered of minimal overall impact to system security by SLI. Six of the seven findings were resolved. • Cross-Site Scripting (DOM-Based): Resolved • Open Redirection (DOMBased): Resolved • Cookie Scoped to Parent Domain: Resolved • Link Manipulation (DOMbased): Resolved • Content Type Incorrectly Stated: Resolved • Strict Transport Security Not Enforced: Resolved • Password Fields with Autocomplete Enabled: Partially Resolved o KNOWiNK added the autocomplete="off" attribute for all password fields except for two, disabling password programs from remembering passwords. This resolved all instances of password autocomplete except the two remaining. KNOWiNK will permanently disable the password autocomplete in the two fields in the next version of the system. PollPad 2.5.2.01b Findings and Status: SLI Compliance performed Security and Telecommunications Testing on the PollPad 2.5.2.01b system. Zero (0) new issues were identified within the system. 4. Functional Testing PollPad 2.5.0 Findings and Status: • The “Cancel” option of the Absentee Scanner functionality did not work: Resolved • Poll Pad application capable of storing a voter’s California driver’s license number, and Social Security Number via import of the voter file from the jurisdiction’s election management system. o Resolved by requiring KNOWiNK and/or jurisdictions to exclude the California driver’s license number and Social Security Number during the voter file import from the jurisdiction’s election management system, and disable any functionality that captures driver’s license numbers, and Social Security Number’s or portions thereof. • All iPad Operating System (iOS) settings (e.g., updates, date and time, WiFi, etc.) are accessible and capable of manipulation. Page 2 of 3 o Resolved by requiring KNOWiNK and/or jurisdictions to deploy devices in Guided Access mode. Guided Access restricts the iOS device to the Poll Pad application. • The Poll Pad application does not require a user specific username and password be entered when accessing the application. o Resolved by requiring adjustment of iPad settings to require a password anytime the iPad is accessed. However, user specific usernames and passwords are not available for the Poll Pad application. PollPad 2.5.2.01b Findings and Status: Testing identified three new findings. One of the three findings does not hinder system performance or security and will be resolved in the next version of the system. The other two findings will be resolved with a condition for use. • 'Import Voter File' status indicators imply incomplete import after import completes. o Although the status indicator implies an incomplete import, the import successfully completes, and this does not hinder performance. KNOWiNK is committed to resolving this issue in the next version of the system. • ‘Emailing Location Button’ function for wrong location voters not working. o Resolved by requiring KNOWiNK and/or jurisdictions to disable the ‘Emailing Location Button.’ KNOWiNK is committed to resolving this issue in the next version of the system. • 'Registration Time' display column within ‘Summary Report’ function not displaying registration times for all voters. o Resolved by requiring KNOWiNK and/or jurisdictions to disable the ‘Registration Time’ display column. KNOWiNK is committed to resolving this issue in the next version of the system. 5. Volume Testing PollPad 2.5.0 Findings and Status: Over 300 voters were processed on the 2.5.0 system. Zero unexpected results or issues were encountered. PollPad 2.5.2.01b Findings and Status: Over 400 voters were processed on the 2.5.2.01b system. Zero unexpected results or issues were encountered. Conclusion - It is OVSTA’s recommendation that the KNOWiNK PollPad v2.5.2.01b system be conditionally approved. • Volume testing had zero 2.5.0 findings and resulted in zero new findings. • Accessibility, Usability and Privacy testing resolved all 2.5.0 findings and resulted in zero new findings. • Software testing (Source Code Review) resolved all 2.5.0 findings and resulted in zero new findings. • Security and Telecommunications testing resolved six of the seven 2.5.0 findings and resulted in zero new findings. The remaining low level 2.5.0 finding was diminished to only two fields and KNOWiNK will resolve the finding in the next system version. • Functional testing resulted in the previous finding being resolved through programmatic changes made or through conditions for use being placed on the system. There were three new findings during functional testing, two will be resolved with conditions for use and the third does not affect the system’s performance or security. Page 3 of 3