Executive Summary

Executive Summary Tenex Precinct Central 5.0.0 Electronic Poll Book System Tenex applied for certification of the Precinct Central 5.0.0 electronic poll book system on February 1, 2022. Through the formal California contracting process and pursuant to California Elections Code section 19285, the Secretary of State awarded a contract to SLI Compliance (SLI) as the state- approved testing contractor in May of 2020. Testing concluded in late-April 2022. Electronic poll books replace the paper roster voter check-in model. Electronic poll books allow poll workers to process voters in approximately 35 to 40 seconds. They are also coupled with built-in election management and reporting tools designed to give election administrators real-time access to monitor their election. All electronic poll book devices deployed in the election connect to a central hub where voter check-in data is securely transferred in near real time. This tool allows election administrators to oversee the operation of individual voting locations and devices, including battery life of the device, average check-in times, or the number of ballots issued or spoiled. The testing included: (1) Accessibility, Usability and Privacy Testing, (2) Software Testing, (3) Security and Telecommunications Testing, (4) Functional Testing, and (5) Volume Testing. 1. Accessibility, Usability and Privacy Testing Accessibility, usability (All Users Exp) and privacy testing, tests the system specialized focus on voters with accessibility needs. The goal is to test and confirm the system’s ability to allow for voters with accessible needs to mark and cast their votes privately and independently. SLI evaluated the Precinct Central against the applicable portions of the Web Content Accessibility Guidelines (WCAG) 2.0 and Section 508 of the Rehabilitation Act of 1973 for compliance. One hundred and forty-three (143) requirements were reviewed, and three (3) requirements were not met. All unmet requirements were associated to the same findings within the system. All findings were limited to non-voter facing functionality and would not prevent or hinder a voter with accessibility needs from independently participating in the check-in process at a polling location. However, Tenex has committed to resolving these issues in the next version of the system. The following three (3) findings were related to the lack of an assistive technology, such as a Bluetooth keyboard, to allow users access to the application functionality via contact or touch sensitive controls. To mitigate these finding Tenex will make an iOS keyboard available to the counties for purchase. • Section 508 § 1194.21 Software applications and operating systems - (l) When electronic forms are used, the form shall allow people using assistive technology to access the information, field elements, and functionality required for completion and submission of the form, including all directions and cues. • Section 508 § 1194.25 Self Contained, Closed Products - (c) Where a product utilizes touchscreens or contact-sensitive controls, an input method shall be provided that complies with §1194.23 (k) (1) through (4). Page 1 of 3 • Section 508 § 1194.26 Desktop and Portable Computers - (b) If a product utilizes touchscreens or touch-operated controls, an input method shall be provided that complies with §1194.23 (k) (1) through (4). 2. Software Testing (Source Code Review) Software testing (also known as source code review) is a line-by-line review of all the computer code of the system for any errors, anomalies, or malicious code. The Tenex Precinct Central 5.0.0 electronic poll book system had over 211,000 lines of computer code. One (1) issue was identified within the Precinct Central source code. The following discrepancy is considered by SLI a non-functional issue of no impact to overall system security. • Lack of Header Comments, Multiple Instances Header comments, regarding programming languages, are used to identify a file, what it contains, its purpose, and a small description of what the code is solving. For example, a module within the code that solves ballot layout logic (rotation, languages, character limitations). The actual outcome for this review was a determination that many file/module header comments were insufficient or missing. 3. Security and Telecommunications Testing (Red Team) Security and telecommunications testing is testing that examines the overall security and integrity of the system. SLI performed Security and Telecommunications testing on the Precinct Central. During testing, a full review of the Precinct Central system was performed to analyze for findings against applicable requirements. Four (4) issues were identified during testing. The discrepancies are considered by SLI to be of minimal impact to overall system security and successfully mitigated via Tenex’s implementation of Amazon Web Service Security Suite services, firewalls, network hardening techniques, input sanitization techniques, and virus scanning technologies. • Epson TM-m30 receipt printer had two active ports and had the default Epson credentials in place. An open port is a network port that accepts traffic and allows communication with the o device. The default Epson username and password are also present on the device. The default credentials can be used by an attacker to gain access to the device. Tenex will disable the port using the administrative interface for all elections deployed printers. Tenex will also update the default passwords for the printers. • Epson TM-l90 receipt printer had two active ports and had the default Epson credentials in place. An open port is a network port that accepts traffic and allows communication with the o device. The default Epson username and password are also present on the device. The default credentials can be used by an attacker to gain access to the device. Tenex will disable the port using the administrative interface for all elections deployed printers. Tenex will also update the default passwords for the printers. Page 2 of 3 • One (1) Instance of DOM-based Link Manipulation This allows attackers to control a target within the current page, such as a clickable o link. For example, an attacker might be able to use this vulnerability to construct a link that, if visited by another user, can cause the user to submit sensitive data to a server controlled by the attacker. • Multiple Instances of Open Redirection (DOM-Based) Cross-site Scripting allow attackers to input strings of executable malicious code into o the web application. Malicious code is injected into the website’s content, making it a part of the website, and thus allowing it to affect victims who may visit or view that website. 4. Functional Testing Functional testing examines the system to the extent to which the system is accurate, efficient, reliable, and in compliance with the applicable regarding electronic poll book laws and standards. SLI configured the electronic poll books and exercised their functionality to provide verification of expected functions of the system as outlined in the vendor provided technical documentation, execution of test cases and verification of the electronic poll book’s compliance with State statutes and regulations. During the examination, all electronic poll book functions outlined in the Tenex Precinct Central 5.0.0 User Guide documentation were exercised. During testing, twelve (12) issues related to minor documentation discrepancies were identified and provided to Tenex for modification. The documentation was subsequently modified, and the changes verified by Secretary of State Staff. There were no issues related to the hardware or software encountered during testing. 5. Volume Testing The Volume Test simulates conditions in which the electronic poll book system would be used on Election Day. For approximately two days, over 1,500 mock voters were processed on the Tenex Precinct Central 5.0.0 electronic poll book system. Zero (0) unexpected results or issues were encountered during the Volume Test. Conclusion The Tenex Precinct Central 5.0.0 electronic poll book system meets applicable California, HAVA, and Federal Elections laws. The system does however have some remaining findings, which Tenex will address or has addressed in the appropriate mitigation areas of this report. It is OVSTA’s recommendation that the Tenex Precinct Central 5.0.0 system be conditionally approved. Page 3 of 3