Los Angeles County ISB 4.0 Ovsta Staff Report

Los Angeles County Voting Solutions for All People Interactive Sample Ballot (ISB) Version 4.0 Staff Report Prepared by: Secretary of State’s Office of Voting Systems Technology Assessment February 6, 2026 Table of Contents I. Introduction ......................................................................................... 1 1. Scope ................................................................................... 1 2. Summary of the Application ................................................. 1 3. Contracting and Consulting .................................................. 1 II. Summary of the System .................................................................... 2 III. Testing Information and Results ........................................................ 2 1. Background .......................................................................... 2 2. Functional Testing Summary ............................................... 2 3. Software Review Testing Summary ..................................... 4 4. Security and Telecommunications Testing Summary .......... 4 5. Volume Testing Summary……………………………………...4 6. Usability, Accessibility & Privacy Testing Summary ............ 5 IV. Compliance with State and Federal Laws and Regulations ............... 5 1. Elections Code Review ......................................................... 5 2. Section 508 and WCAG Review ........................................... 6 V. Conclusion .......................................................................................... 6 SECRETARY OF STATE’S STAFF REPORT – Los Angeles County ISB Version 4.0 2 | P age I. INTRODUCTION 1. Scope This staff report presents the test results for all phases of the certification test of Los Angeles County’s Voting Solutions for All People Interactive Sample Ballot (ISB) 4.0 Remote Accessible Vote by Mail (RAVBM) system. The purpose of the testing is to test the compliance of the remote accessible vote by mail system with California and federal laws. Testing also uncovers other findings, which do not constitute non-compliance, and those findings are reported to the remote accessible vote by mail system vendor to address the issues procedurally. The procedures for mitigating any additional findings are made to the documentation, specifically the Interactive Sample Ballot 4.0 Use Procedures. Interactive Sample Ballot 4.0 was evaluated against the applicable portions of the California Voting Systems Standards (CVSS). The CVSS were written in such a way to be applicable to a wide variety of voting technology, therefore the relevant portions of the CVSS were reviewed as it relates to the Interactive Sample Ballot 4.0 RAVBM system for purposes of this report. The use of “voting system” shall apply to RAVBM. 2. Summary of the Application Los Angeles County submitted an application for the Interactive Sample Ballot 4.0 remote accessible vote by mail system on February 3, 2025. Interactive Sample Ballot 4.0 is solely for use in Los Angeles County for the purposes of remote accessible ballot marking pursuant to Elections Code sections 303.3 and 19283. Los Angeles County was required to submit the following: (1) the technical documentation package (TDP); (2) two test environments; (3) source code; and (4) the Interactive Sample Ballot 4.0 Use Procedures. 3. Contracting and Consulting Upon receipt of a complete application, the Secretary of State released a Request for Quote (RFQ) for assistance with the Security and telecommunications, Usability, Accessibility and Privacy, and Software (Source Code Review) testing. The statement of work (SOW) also had an option for the Secretary of State to use the awarded contractor for Functional testing, if it deemed necessary. Through the formal California contracting process and pursuant to California Elections Code section 19285, the Secretary of State awarded a contract to SLI Compliance, a division of Gaming Laboratories International, LLC, to serve in the capacity as the state-approved testing agency or expert technician to examine the remote accessible vote by mail system. SECRETARY OF STATE’S STAFF REPORT – Los Angeles County ISB Version 4.0 1 | P age II. SUMMARY OF THE SYSTEM The Interactive Sample Ballot 4.0 remote accessible vote by mail system is a web-based interface. The voter can optionally use a screen reader to navigate the ballot. After a voter marks their ballot and reviews their selections, the voter must print their selections. The printed paper cast record is returned to the local elections’ official, where it will be remade into a ballot for tabulation. The printed paper cast record and the ballot are kept together for auditing purposes. III. TESTING INFORMATION AND RESULTS 1. Background The Interactive Sample Ballot 4.0 remote accessible vote by mail system application is an application which allows users to mark a ballot using their desktop, tablet, or mobile phone and generate a paper cast vote record, with the voter’s selections. Users can access the application platform using industry standard web browsers. All phases of testing were conducted from September 2025 to January of 2026. 2. Functional Testing Summary System Configuration: The Interactive Sample Ballot 4.0 remote accessible vote by mail system is supported by a fully redundant network and application architecture protecting against a single point of failure. For the functional test, the SOS had five test elections configured based on California elections as described below: 1. Los Angeles County Statewide Direct Primary Election 2. Los Angeles County General Presidential Election 3. Los Angeles County Gubernatorial Recall 4. Los Angeles County Presidential Primary Election 5. Los Angeles County General Election Each election performed as expected. Undervotes The system warned of undervotes and allowed the tester to proceed to the end of the ballot to print the paper cast record. SECRETARY OF STATE’S STAFF REPORT – Los Angeles County ISB Version 4.0 2 | P age Overvotes The system warned of overvotes and allowed the tester to proceed to the end of the ballot and print the paper cast record. Write-Ins The system allowed the tester to make write in selections, with no character limit. Printed Paper Cast Record Each paper cast record printed displays a QR code in the top left corner, with the Los Angeles County Clerk Recorder’s emblem to the right. The date of the election, the type of election (Primary/General) and return instructions are included in the middle of the page. If the paper cast record is multiple pages, the QR code appears in the top header of the document, along with the emblem, date of the election, and type of election. The final section, Summary of Selections, lists each contest along with the voter’s selections in a human readable format, printed on the paper cast record. The QR code contains the voter’s selections, however it cannot be used for tabulation. It can be read using QR code readers from application stores. The election official can verify the selections correspond to those listed on the paper cast record, and either hand duplicate or utilize an adjudication system to duplicate the paper cast record onto a ballot for tabulation. The paper cast record is kept with the duplicated ballot for auditing purposes. SECRETARY OF STATE’S STAFF REPORT – Los Angeles County ISB Version 4.0 3 | P age 3. Software Review Testing Summary SLI performed Software Testing (Source Code Review) of the Interactive Sample Ballot 4.0 RAVBM system. SLI utilized the following tools: • ExamDiff Pro: a commercial application used to compare revised code to previously reviewed code. • Checkmarx: a commercial application to perform automated reviews of source code. • Modulefinder: a custom, in-house application used to parse module names from source code and populate review spreadsheets. SLI found no discrepancy findings or vulnerabilities, within the Interactive Sample Ballot 4.0 RAVBM system. See the testing consultant’s Source Code Test Report located on the Secretary of State website for more information. 4. Security and Telecommunications Testing SLI performed Security and Telecommunications Testing on the Interactive Sample Ballot 4.0 Remote System over three phases. The first phase was a comprehensive documentation review for compliance with the applicable portions of the CVSS. The second phase consisted of Functional Security Testing, followed by a third phase of Telecommunications and Data Transmission Testing. The issues identified during Security and Telecommunications testing are listed below, along with mitigations by the County. Table 4A: Physical Security Issue Consultant Assessment Vendor Mitigation A web vulnerability scan found that Los Angeles County will provide the application fails to prevent users documentation regarding the Strict from connecting to it over processes, procedures, and Transport unencrypted connections. The security measures to mitigate this Security Not issue is considered low severity and risk. They are also committed to Enforced has minimal impact on overall resolving this in the next version system security. of the system. See the testing consultant’s Security and Telecommunications Report located on the Secretary of State website for more information. 5. Volume Testing Summary SLI performed Volume Testing on the Interactive Sample Ballot 4.0 Remote System. Volume testing encompasses the examination and testing of software, and operational tests to validate system performance and functioning under normal conditions. Test entry data representing voter ballot voting events was used to test the system. SECRETARY OF STATE’S STAFF REPORT – Los Angeles County ISB Version 4.0 4 | P age The Interactive Sample Ballot 4.0 RAVBM examination was to be able to process a minimum of: • 150 voters for ISB sample ballots • 150 voters for UOCAVA ballots and • 150 voters for RAVBM ballots. Testing began on January 7th, 2026, and included utilization of the provided links to access the three different voter types generated by the Interactive Sample Ballot 4.0 RAVBM system. All paper cast vote records were successfully generated. See the testing consultant’s Volume Test Report located on the Secretary of State website for more information. 6. Usability, Accessibility and Privacy Testing Summary SLI performed Usability, Accessibility, and Privacy Testing on the Interactive Sample Ballot 4.0 Remote System over three phases. The first phase was a comprehensive documentation review for compliance with the applicable portions of the CVSS. The second phase consisted of Usability and Accessibility Testing, followed by a third phase of Privacy Testing. There were no issues identified during Usability, Accessibility and Privacy testing. See the testing consultant’s Usability, Accessibility, and Privacy Report located on the Secretary of State website for more information. IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS 1. Elections Code Review 1) §19283 (b) Remote accessible vote by mail system standards adopted by the Secretary of State pursuant to subdivision (a) shall include, but not be limited to, all the following requirements: (1) The machine or device and its software shall be suitable for the purpose for which it is intended. (2) The remote accessible vote by mail system shall preserve the secrecy of the ballot. (3) The remote accessible vote by mail system shall be safe from fraud or manipulation. SECRETARY OF STATE’S STAFF REPORT – Los Angeles County ISB Version 4.0 5 | P age (4) The remote accessible vote by mail system shall be accessible to voters with disabilities and to voters who require assistance in a language other than English if the language is one in which a ballot or ballot materials are required to be made available to voters. i. The system meets these requirements. 2) §19295 A remote accessible vote by mail system or part of a remote accessible vote by mail system shall not do any of the following: (a) Have the capability, including an optional capability, to use a remote server to mark a voter’s selections transmitted to the server from the voter’s computer via the Internet. (b) Have the capability, including an optional capability, to store any voter identifiable selections on any remote server. (c) Have the capability, including the optional capability, to tabulate votes. i. The system meets these requirements. 2. Section 508 and WCAG Compliance Review Interactive Sample Ballot 4.0 was written to WCAG 2.0 guidelines to implement accessibility features. The system also complies with the applicable portions of Section 508. V. CONCLUSION The Interactive Sample Ballot 4.0 remote accessible vote by mail system, in the configuration tested and documented by the Los Angeles County’s Interactive Sample Ballot 4.0 Use Procedures, meets all applicable California and federal laws. The Interactive Sample Ballot 4.0 remote accessible vote by mail system is compliant with all California and federal laws. SECRETARY OF STATE’S STAFF REPORT – Los Angeles County ISB Version 4.0 6 | P age