County of Los Angeles ISB 1.2 Staff Report

A P LEX ADILLA |SECRETARY OF STATE | STATE OF CALIFORNIA OFFICE OF VOTING SYSTEMS TECHNOLOGY ASSESSMENT 1500 11th Street | Sacramento, CA 95814 | Tel 916.695.1680 | Fax 916.653.4620 | www.sos.ca.gov Los Angeles County’s Interactive Sample Ballot Version 1.2 Remote Accessible Vote by Mail System Staff Report Prepared by: Secretary of State’s Office of Voting Systems Technology Assessment December 24, 2019 Table of Contents I. Introduction ......................................................................................... 1 1. Scope ................................................................................... 1 2. Summary of the Application ................................................. 1 3. Contracting and Outsourcing ............................................... 1 II. Summary of the System .................................................................... 2 III. Testing Information and Results ........................................................ 2 1. Background .......................................................................... 2 2. Functional Testing Summary ............................................... 2 3. Software Review Testing Summary ..................................... 3 4. Security and Telecommunications Testing Summary .......... 4 5. Usability, Accessibility & Privacy Testing Summary ............ 5 IV. Compliance with State and Federal Laws and Regulations ............... 6 1. Elections Code Review ......................................................... 6 2. Section 508 and WCAG Review ........................................... 7 V. Conclusion .......................................................................................... 7 SECRETARY OF STATE’S STAFF REPORT 2 | P age I. INTRODUCTION 1. Scope This staff report presents the test results for all phases of the certification test of Los Angeles County’s Interactive Sample Ballot 1.2 Remote Accessible Vote by Mail (RAVBM) system. The purpose of the testing is to test the compliance of the remote accessible vote by mail system with California and federal laws. Testing also uncovers other findings, which do not constitute non-compliance, and those findings are reported to the remote accessible vote by mail system vendor to address the issues procedurally. The procedures for mitigating any additional findings are made to the documentation, specifically the Interactive Sample Ballot 1.2 Use Procedures. Interactive Sample Ballot 1.2 was evaluated against the applicable portions of the California Voting Systems Standards (CVSS). The CVSS were written in such a way to be applicable to a wide variety of voting technology, therefore the relevant portions of the CVSS were reviewed as it relates to the Interactive Sample Ballot 1.2 RAVBM system for purposes of this report. The use of “voting system” shall apply to RAVBM. 2. Summary of the Application Los Angeles County submitted an application for the Interactive Sample Ballot 1.2 remote accessible vote by mail system on February 5, 2019. Interactive Sample Ballot 1.2 is solely for use in Los Angeles County for the purposes of remote accessible ballot marking pursuant to Elections Code sections 303.3 and 19283. Los Angeles County was required to submit the following: (1) the technical documentation package (TDP); (2) two test environments; (3) source code; and (4) the Interactive Sample Ballot 1.2 Use Procedures. 3. Contracting and Consulting Upon receipt of a complete application, the Secretary of State released a Request for Quote (RFQ) for assistance with the Security and Telecommunications, Usability, Accessibility and Privacy, and Software (Source Code Review) testing. Through the formal California contracting process and pursuant to California Elections Code section 19285, the Secretary of State awarded a contract to SLI Compliance, a division of Gaming Laboratories International, LLC, to serve in the capacity as the state-approved testing agency or expert technician to examine the remote accessible vote by mail system. II. SUMMARY OF THE SYSTEM Interactive Sample Ballot 1.2 remote accessible vote by mail system is a web- based interface. The voter can optionally use a screen reader to navigate the ballot. After a voter marks their ballot and reviews their selections, the voter must print their selections. The printed paper cast record is returned to the local elections official, where it will be remade into a ballot for tabulation. The printed paper cast record and the ballot are kept together for auditing purposes. III. TESTING INFORMATION AND RESULTS 1. Background The Interactive Sample Ballot 1.2 remote accessible vote by mail system application is an application which allows users to mark a ballot using their desktop, tablet, or mobile phone and generate a paper cast vote record, with the voter’s selections. Users can access the application platform using industry standard web browsers. All phases of testing were conducted from September to December of 2019. 2. Functional Testing Summary System Configuration: The Interactive Sample Ballot 1.2 remote accessible vote by mail system is supported by a fully redundant network and application architecture protecting against a single point of failure. For the functional test, the SOS had two test elections configured based on California elections as described below: 1. Los Angeles County Primary Election 2. Los Angeles County General Presidential Election Each election performed as expected. Undervotes The system warned of undervotes and allowed the tester to proceed to the end of the ballot to print the paper cast record. SECRETARY OF STATE’S STAFF REPORT 2 | P age Overvotes The system warned of overvotes and allowed the tester to proceed to the end of the ballot and print the paper cast record. Write-Ins The system allowed the tester to make write in selections, with no character limit. Printed Paper Cast Record Each paper cast record printed displays a QR code in the top left corner, with the Los Angeles County Clerk Recorder’s emblem to the right. The date of the election, the type of election (Primary/General) and return instructions are included in the middle of the page. If the paper cast record is multiple pages, the QR code appears in the top header of the document, along with the emblem, date of the election, and type of election. The final section, Summary of Selections, lists each contest along with the voter’s selections in a human readable format, printed on the paper cast record. The QR code contains the voter’s selections, however it cannot be used for tabulation. It can be read using QR code readers from application stores. The election official can verify the selections correspond to those listed on the paper cast record, and either hand duplicate or utilize an adjudication system to duplicate the paper cast record onto a ballot for tabulation. The paper cast record is kept with the duplicated ballot for auditing purposes. Image 2A shows a sample of the paper cast record. SECRETARY OF STATE’S STAFF REPORT 3 | P age Image 2A: 3. Software Review Testing Summary SLI performed Software Testing (Source Code Review) of the Interactive Sample Ballot 1.2 RAVBM system. SLI utilized the following tools: • Understand: a commercial application used to review code to stated requirements. SLI found no discrepancy findings or vulnerabilities, within the Interactive Sample Ballot 1.2 RAVBM system. See the testing consultant’s Source Code Test Report located on the Secretary of State website for more information. SECRETARY OF STATE’S STAFF REPORT 4 | P age 4. Security and Telecommunications Testing SLI performed Security and Telecommunications Testing on the Interactive Sample Ballot 1.2 Remote System over three phases. The first phase was a comprehensive documentation review for compliance with the applicable portions of the CVSS. The second phase consisted of Functional Security Testing, followed by a third phase of Telecommunications and Data Transmission Testing. The issues identified during Security and Telecommunications testing are listed below, along with mitigations by the County. Table 4A: Security and Telecommunications Issue Identified County Mitigation Cached ballot selections Caching bugs fixed for ballot delivery. Purging of session storage now occurring at appropriate times to handle use case where voter loads a ballot returns to landing or search page without completing marking session and attempts to load another ballot of different style. Documentation Update on Updated documentation to be provided. Final Implementation Security See the testing consultant’s Security and Telecommunications Report located on the Secretary of State website for more information. 5. Usability, Accessibility and Privacy Testing Summary SLI performed Usability, Accessibility, and Privacy Testing on the Interactive Sample Ballot 1.2 Remote System over three phases. The first phase was a comprehensive documentation review for compliance with the applicable portions of the CVSS. The second phase consisted of Usability and Accessibility Testing, followed by a third phase of Privacy Testing. The issues identified during Usability, Accessibility and Privacy testing are listed below, along with mitigations by the County. Table 5A Usability, Accessibility and Privacy Testing Issue Identified County Mitigation 3.2.8.e.h – No inactivity warning or state Will be addressed in the next release. 3.2.7.c.ii – Navigation keys (up and down arrows, tab) Will be addressed in the did have a repetitive effect. next release. See the testing consultant’s Usability, Accessibility, and Privacy Report located on the Secretary of State website for more information. SECRETARY OF STATE’S STAFF REPORT 5 | P age IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS 1. Elections Code Review 1) §19283 (b) Remote accessible vote by mail system standards adopted by the Secretary of State pursuant to subdivision (a) shall include, but not be limited to, all of the following requirements: (1) The machine or device and its software shall be suitable for the purpose for which it is intended. (2) The remote accessible vote by mail system shall preserve the secrecy of the ballot. (3) The remote accessible vote by mail system shall be safe from fraud or manipulation. (4) The remote accessible vote by mail system shall be accessible to voters with disabilities and to voters who require assistance in a language other than English if the language is one in which a ballot or ballot materials are required to be made available to voters. The system meets these requirements. 2) §19295 A remote accessible vote by mail system or part of a remote accessible vote by mail system shall do not any of the following: (a) Have the capability, including an optional capability, to use a remote server to mark a voter’s selections transmitted to the server from the voter’s computer via the Internet. (b) Have the capability, including an optional capability, to store any voter identifiable selections on any remote server. (c) Have the capability, including the optional capability, to tabulate votes. The system meets these requirements. 2. Section 508 and WCAG Compliance Review SECRETARY OF STATE’S STAFF REPORT 6 | P age Interactive Sample Ballot 1.2 was written to WCAG 2.0 guidelines to implement accessibility features. The system also complies with the applicable portions of Section 508. V. CONCLUSION The Interactive Sample Ballot 1.2 remote accessible vote by mail system, in the configuration tested and documented by the Los Angeles County’s Interactive Sample Ballot 1.2 Use Procedures, meets all applicable California and federal laws. The Interactive Sample Ballot 1.2 remote accessible vote by mail system is compliant with all California and federal laws. SECRETARY OF STATE’S STAFF REPORT 7 | P age