Los Angeles County ISB 4.0 Consultant’s Software Test Report

County of Los Angeles VSAP Interactive Sample Ballot 4.0 RAVBM Software Test Report CAF-25014-SCRTR-01 Vendor Name Los Angeles County VSAP Interactive Sample Ballot 4.0 Vendor System Remote Access Vote By Mail Prepared by: 4720 Independence St. Wheat Ridge, CO 80033 303-422-1566 www.SLICompliance.com Los Angeles County VSAP ISB 4.0 RAVBM California Certification Software Test Report v1.0 Copyright 2026 by SLI ComplianceSM, a Division of Gaming Laboratories International, LLC Revision History Date Release Author Revision Summary B. Roberson January 19th, 2026 1.0 Initial Release M. Santos Disclaimer The information reported herein must not be used by the client to claim product certification, approval, or endorsement by NVLAP, NIST, or any agency of the Federal Government. Trademarks • SLI is a registered trademark of SLI Compliance. • All products and company names are used for identification purposes only and may be trademarks of their respective owners. Page 2 of 9 California Certification Software Test Report Report Number CAF-25014-SCRTR-01 Los Angeles County VSAP ISB 4.0 RAVBM California Certification Software Test Report v1.0 TABLE OF CONTENTS INTRODUCTION ................................................................................................................................. 4 REVIEW SPECIFICATIONS ............................................................................................................... 4 SOURCE CODE REVIEW ...................................................................................................................... 4 REVIEW RESULTS............................................................................................................................. 6 DISCREPANCIES ................................................................................................................................. 6 VULNERABILITIES ............................................................................................................................... 8 FINAL REPORT .................................................................................................................................. 9 Page 3 of 9 California Certification Software Test Report Report Number CAF-25014-SCRTR-01 Los Angeles County VSAP ISB 4.0 RAVBM California Certification Software Test Report v1.0 INTRODUCTION The California Voting Systems Standards (CVSS) are applicable to a wide variety of voting technology. Therefore, the relevant portions of the CVSS are reviewed as they relate to the Remote Accessible Vote By Mail (RAVBM) for the purposes of this report. The use of “voting system” shall apply to the RAVBM. This report outlines the testing SLI Compliance (SLI) followed when performing Software Testing on the Los Angeles County Voting Solutions for All People 4.0 Interactive Sample Ballot Remote Access Vote by Mail System (VSAP ISB 4.0 RAVBM) against the California Voting System Standards (CVSS). Coding languages involved in the VSAP ISB 4.0 RAVBM application are shown in Table 1. Table 1 – VSAP ISB 4.0 RAVBM System Languages Languages Java JavaScript C/C++ SQL Source Code Review tools utilized by SLI included: • ExamDiff Pro: a commercial application used to compare revised code to previously reviewed code. • Checkmarx: a commercial application to perform automated reviews of source code. • Modulefinder: a custom, in-house application used to parse module names from source code and populate review spreadsheets. REVIEW SPECIFICATIONS The following are the specifications for source code testing conducted on the VSAP ISB 4.0 RAVBM. Source Code Review The VSAP ISB 4.0 RAVBM includes proprietary software; the code base was tested to the applicable CVSS requirements. Review of the code included: • Evaluating adherence to the applicable standards in sections 5 and 7 of the CVSS. • Evaluating adherence to other applicable coding format conventions and standards including best practices for the coding language used. • Analyzing the program logic and branching structure. Page 4 of 9 California Certification Software Test Report Report Number CAF-25014-SCRTR-01 Los Angeles County VSAP ISB 4.0 RAVBM California Certification Software Test Report v1.0 • Evaluating whether the system is designed in a way that allows meaningful analysis, including: Whether the architecture and code are amenable to an external review. o Whether code analysis tools can be usefully applied. o Whether the code complexity is at a level that obfuscates its logic. o Security considerations reviewed against the code base included: • Searching for exposures to commonly exploited vulnerabilities. • Evaluating the use and correct implementation of cryptography and key management. • Analyzing error and exception handling. • Evaluating the likelihood of security failures being detected including: Whether audit mechanisms are reliable and tamper resistant. o Whether data that might be subject to tampering is properly validated o and authenticated. • Evaluating the risk that a user can escalate his or her capabilities beyond those authorized. • Evaluating the design and implementation to ensure that sound, generally accepted engineering practices are followed, checking to verify that code is defensively written against: Bad data o Errors in other modules o Changes in environment o User errors o Other adverse conditions o • Evaluating for embedded, exploitable code (such as “Easter eggs”) that can be triggered to affect the system. • Evaluating the code for dynamic memory access features which would permit the replacement of certificated executable code or control data or insertion of exploitable code or data. • Evaluating the code for use of runtime scripts, instructions, or other control data that can affect the operation of security relevant functions or the integrity of the data. Page 5 of 9 California Certification Software Test Report Report Number CAF-25014-SCRTR-01 Los Angeles County VSAP ISB 4.0 RAVBM California Certification Software Test Report v1.0 REVIEW RESULTS Discrepancies Discrepancies are reported such that the California Secretary of State (CASOS) is provided with a basis for evaluating the extent to which the source code meets applicable standards. VSAP ISB 4.0 RAVBM Software Test Review • Evaluate adherence to the applicable standards in sections 5 and 7 of the CVSS. ♦ The expected outcome for this review was that no issue would be found. ♦ The actual outcome for this review was a determination that no issue was found. • Evaluate adherence to other applicable coding format conventions and standards including best practices for the coding language used. ♦ The expected outcome for this review was that no issue would be found. ♦ The actual outcome for this review was a determination that no issue was found. • Analyze the program logic and branching structure. ♦ The expected outcome for this review was that no issue would be found. ♦ The actual outcome for this review was a determination that no issue was found. • Evaluate whether the system is designed in a way that allows meaningful analysis, including: Whether the architecture and code are amenable to an external review. o Whether code analysis tools can be usefully applied. o Whether the code complexity is at a level that obfuscates its logic. o ♦ The expected outcome for this review was that no issue would be found. ♦ The actual outcome for this review was a determination that no issue was found. Security considerations reviewed against the code base included: • Evaluate the use and correct implementation of cryptography and key management. Page 6 of 9 California Certification Software Test Report Report Number CAF-25014-SCRTR-01 Los Angeles County VSAP ISB 4.0 RAVBM California Certification Software Test Report v1.0 ♦ The expected outcome for this review was that no issue would be found. ♦ The actual outcome for this review was a determination that no issue was found. • Analyze error and exception handling. ♦ The expected outcome for this review was that no issue would be found. ♦ The actual outcome for this review was a determination that no issue was found. • Evaluate the likelihood of security failures being detected including: Whether audit mechanisms are reliable and tamper resistant. o Whether data that might be subject to tampering is properly validated o and authenticated. ♦ The expected outcome for this review was that audit mechanisms would be determined to be reliable and tamper resistant, and that any data that might be subject to tampering is properly validated and authenticated. ♦ The actual outcome for this review was a determination that audit mechanisms are properly implemented to be reliable and tamper resistant and evident, as well as that data that might be subject to tampering is properly validated and authenticated. • Evaluate the risk that a user can escalate his or her capabilities beyond those authorized. ♦ The expected outcome for this review was that no issue would be found. ♦ The actual outcome for this review was a determination that no issue was found. • Evaluate the design and implementation to ensure that sound, generally accepted engineering practices are followed, checking to verify that code is defensively written against: Bad data o Errors in other modules o Changes in environment o User errors o Other adverse conditions o ♦ The expected outcome for this review was that no issue would be found. Page 7 of 9 California Certification Software Test Report Report Number CAF-25014-SCRTR-01 Los Angeles County VSAP ISB 4.0 RAVBM California Certification Software Test Report v1.0 ♦ The actual outcome for this review was a determination that no issue was found. • Evaluate for embedded, exploitable code (such as “Easter eggs”) that can be triggered to affect the system. ♦ The expected outcome for this review was that no issue would be found. ♦ The actual outcome for this review was a determination that no issue was found. • Evaluate the code for use of runtime scripts, instructions, or other control data that can affect the operation of security relevant functions or the integrity of the data. ♦ The expected outcome for this review was that no issue would be found. ♦ The actual outcome for this review was a determination that no issue was found. During this review, no issues were noted within the VSAP ISB 4.0 RAVBM code base. Vulnerabilities For any vulnerabilities discovered, SLI was tasked with identifying the particular standards applicable to each vulnerability. To the extent possible, reported vulnerabilities include an indication of whether the exploitation of the vulnerability would require access by: • Voter: Usually has low knowledge of the voting technology design and configuration. Some may have more advanced knowledge. May carry out attacks designed by others. • Elections official insider: Has a wide range of knowledge of the voting technology design and configuration. May have unrestricted access to voting technology for long periods of time. Their designated activities include: Set up and pre-election procedures; o Election operation; o Post-election processing of results; and o Archiving and storage operations. o • Vendor insider: Has great knowledge of voting technology design and configuration. They have unlimited access to voting technology before it is delivered to the purchaser and, thereafter, may have unrestricted access Page 8 of 9 California Certification Software Test Report Report Number CAF-25014-SCRTR-01 Los Angeles County VSAP ISB 4.0 RAVBM California Certification Software Test Report v1.0 when performing warranty and maintenance service, and when providing election administration services. SLI will not verify or demonstrate exploitability of the vulnerability but the report of the vulnerability will identify factors involved in the exploitation. Any vulnerability theories developed by the source code review team members shall, to the extent possible, be referred to CASOS staff. VSAP ISB 4.0 RAVBM Software Code Vulnerability Review The source code was reviewed for exposures to commonly exploited vulnerabilities, such as buffer overflows, integer overflow, inappropriate casting, or arithmetic. ♦ The expected outcome was that no issue would be found. ♦ The actual outcome was a determination that no issues were found. The source code was reviewed for evaluation of potential vulnerabilities and related issues (code quality and standards compliance), considering that an exploitable issue in a component that is not in itself security relevant could be used to subvert more critical data. This is an issue whenever the architecture of the system does not provide strong separation of the components. ♦ The expected outcome for this review was that no issue would be found. ♦ The actual outcome was a determination that no issues were found. The source code was reviewed for evaluation for dynamic memory access features which would permit the replacement of certificated executable code or control data or insertion of exploitable code or data. ♦ The expected outcome for this review was that no issue would be found. ♦ The actual outcome was a determination that no issues were found. No vulnerabilities were identified within the VSAP ISB 4.0 RAVBM code base. Final Report No issues were found within the VSAP ISB 4.0 RAVBM code base. No vulnerabilities were identified within the VSAP ISB 4.0 RAVBM code base. As directed by the California Secretary of State, this software testing report does not include any recommendation as to whether or not the system should be approved. End of VSAP ISB 4.0 RAVBM Software Test Report Page 9 of 9 California Certification Software Test Report Report Number CAF-25014-SCRTR-01