Los Angeles Responses to Certification Testing

VOTING SOLUTIONS FOR ALL PEOPLE RESPONSES TO CERTIFICATION TESTING VSAP SYSTEM TESTING • The County conducted extensive user testing that took place over 11 years. This included over 3,000 voters and pollworkers during the design phase. • The California Secretary of State’s Office of Voting System Technology Assessment (OVSTA), with state- approved testing consultant Freeman Craft McGregor Group (FCMG), conducted functional testing, volume testing, security testing and accessibility testing. • The County engaged two separate independent firms to conduct independent security testing. The firms engaged were FireEye (Mandiant) and Cylance. • The County conducted a Countywide Mock Election in September 2019, which engaged nearly 6,000 voters, testing processes and technologies. • The County conducted a Pilot Election with Manual Audit in November 2019. The primary intent of this Pilot was to test the functionality and usability of Ballot Marking Devices. USB/ROOT VULNERABILITY Concern: Root access to the system through USB ports. Note: This USB vulnerability was related to the VSAP Ballot Layout (VBL) and VSAP Tally (Tally), not the VSAP Ballot Marking Device (BMD). All attempts to circumvent the physical security of the BMD itself through the USB port were unsuccessful. The BMD is not bootable. Mitigations/Resolutions: The County has adopted procedures to limit root access to the VSAP system. The Tally Operations Center, where VBL and Tally are located, has multiple layers of physical security, including keycard access, video surveillance, and security personnel. The County generated a new set of cryptographic keys after FCMG completed this work and report, and incorporated them into a Trusted Build, locking out Smartmatic and Digital Foundry staff. Only authorized County staff have system access, which would be necessary to exploit root access. These countermeasures significantly lessen the opportunity to exploit unauthorized root access. Furthermore, port locks have been placed on all USB ports in these locations to further reduce the risk. BALLOT JAMS Concern: Paper jams at the printer exit on the BMD. Mitigations/Resolutions: The issue was addressed through hardware and firmware changes to the BMD. The changes were submitted to and tested by SOS and FCMG. All changes passed review and regression testing. There were two changes: 1. Hardware: • Addition of metallic brushes that remove electrostatic energy that is created by the movement of the paper exiting the BMD into the ballot box; and • Addition of a mechanical guide to the paper ballot to ensure the ballot moves toward the rear side (the side away from the BMD) of the ballot box as it falls away from the BMD printer exit. This ensures that the ballots fall to the bottom and stack toward rear side of the ballot box. 2. Firmware: • The printer manufacturer provided firmware in the printer was updated to eject the ballot at a higher speed. This, along with the anti-static measures, helps ensure the ballot falls to the bottom of the ballot box. When the ballot remains in the printer exit (meaning it has not fallen into the ballot box) the printer sensors “see” it and give an indication that the printer is jammed. For more information, visit LAVote.net VOTING SOLUTIONS FOR ALL PEOPLE RESPONSES TO CERTIFICATION TESTING TAMPER-EVIDENT SEALS Concern: Integrated Ballot Box (IBB) on the BMD may be opened and ballots removed/added without detection. Note: For this vulnerability to happen, a malicious actor must, without being noticed, access the back of a BMD for a prolonged period. They must have tape, tweezers and a piece of cardboard and they must maneuver carefully not to trigger a sensor on the ballot box that alerts Election Workers that the ballot box has been opened. This testing was conducted on a BMD without the attached privacy shield, which is an additional layer of protection to the attack. Mitigations/Resolutions: The County has procedures in place to prevent this issue 1. Election Workers are trained to securely lock BMDs with serialized seals; 2. Election Workers are trained to check seals and observe voting area for individuals who may be tampering with BMDs; and 3. Addition of adhesive tamper-evident seals placed over the seam of the IBB in addition to the serialized zip-tie seals that are used to securely close the box. As voted ballots will be removed every night by Election Workers, this attack would need to be conducted during the hours that a Vote Center is open and in operation, which would make the likelihood of an attempted attack or exploit highly unlikely without detection and disruption in the Vote Center. There are Vote Center personnel assigned as Voting Area Monitors who are responsible for observing and being present in the voting area where the BMDs are located. Not only would these workers notice someone working behind a BMD, but also, removal or opening of the ballot box triggers a screen display warning and requires Election Worker engagement to bring the triggered unit back into service. BMDs are also visible to all Election Workers and voters. The addition of the adhesive tamper-evident seals provides an additional layer of detection and protection. “MORE” BUTTON Concern: Candidates who are not visible on first screen of contest may be at a disadvantage because voters may not see that they need to select the “MORE” button to see additional candidates. Mitigations/Resolutions: The County consulted with its design and usability experts and with its development/manufacturing team to make refinements and modifications. These included: 1. Addition of a pulsating yellow ring to the “MORE” button; and 2. Addition of a gradient effect to visibly indicate that the contest continues vs hard page stops that appear that all options are visible in a single view. The above referenced refinements and modifications were made before the November Pilot election in which voters were given the option to vote on the BMD or to use the traditional InkaVote ballot. While the Pilot Election was limited, the contest for Long Beach City Council, First District included eight candidates and thus provided a good test and comparison of ballots cast on the old system all listed on a single page to ballots cast using the BMD where the “MORE” button navigation was required to view all selections. From the pilot election, we analyzed three ballot types – Vote by Mail (VBM), BMD and InkaVote. The results revealed minimal differences between the ballot types, which is not unusual based on past elections. The County will also be promoting the use of the “MORE” Button through its voter education and outreach plans. The topic will be highlighted in the Official Sample Ballot, video tutorials, and informational displays and handouts at Vote Centers. Additionally, Election Workers will be trained on the issue to assist voters, if needed, and will proactively tell voters about the “MORE” button at the Vote Centers. For more information, visit LAVote.net