Staff Report

T S S ’ ENEX OFTWARE OLUTIONS P C RECINCT ENTRAL Version 5.0.0 Apple iPad, Generation 5, 32 Gigabyte Apple iPad, Generation 6, 32 Gigabyte Apple iPad, Generation 7, 32 Gigabyte Apple iPad, Generation 8, 32 Gigabyte Apple iPad, Generation 9, 32 Gigabyte Epson TM-m30 Printer Epson TM-m80 Printer Epson TM-m90 Printer iOS, Version 15.4.1 Precinct Central Application, Version 5.0.0 Precinct Central Console, Version 5.0.0 Staff Report Prepared by: Secretary of State’s Office of Voting Systems Technology Assessment May 4, 2022 Table of Contents I. Introduction ........................................................................................ 2 1. Scope .................................................................................. 2 2. Summary of the Application ................................................. 2 3. Contracting and Outsourcing ............................................... 2 II. Summary of the System .................................................................... 3 1. Apple iPad, Generation 5, 32 Gigabyte ............................... 3 2. Apple iPad, Generation 6, 32 Gigabyte ............................... 3 3. Apple iPad, Generation 7, 32 Gigabyte ............................... 3 4. Apple iPad, Generation 8, 32 Gigabyte ............................... 3 5. Apple iPad, Generation 9, 32 Gigabyte ............................... 3 6. Epson TM-m30 Printer ........................................................ 3 7. Epson TM-p80 Printer ......................................................... 3 8. Epson TM-l90 Printer ........................................................... 3 9. iOS, Version 15.4.1 ............................................................. 3 10. Precinct Central Application, Version 5.0.0 ......................... 3 11. Precinct Central Console, Version 5.0.0 .............................. 4 III. Testing Information and Results ....................................................... 4 1. Background ......................................................................... 4 2. Functional Testing Summary ............................................... 4 3. Software (Source Code) Review Testing Summary ............ 6 4. Security and Telecommunications Testing Summary .......... 8 5. Volume Testing Summary ................................................... 9 6. Accessibility ......................................................................... 9 IV. Compliance with State Laws and Regulations ................................... 13 V. Conclusion .......................................................................................... 15 SECRETARY OF STATE’S STAFF REPORT – KNOWINK Precinct Central Version 5.0.0 1 | P age I. INTRODUCTION 1. Scope This report presents the test results for all phases of the certification test of the Tenex Precinct Central Version 5.0.0. The purpose of the testing is to test the compliance of the electronic poll book with California laws. Testing also uncovers other findings, which do not constitute non-compliance, and those findings are reported to the electronic poll book vendor to address the issues procedurally. The procedures for mitigating any additional findings are made to the documentation, specifically the Tenex Precinct Central 5.0.0 User Guide. 2. Summary of the Application Tenex submitted an application for the Precinct Central 5.0.0 system on February 1, 2022. The system is comprised of the following major components: • Apple iPad, Generation 5, 32 Gigabyte • Apple iPad, Generation 6, 32 Gigabyte • Apple iPad, Generation 7, 32 Gigabyte • Apple iPad, Generation 8, 32 Gigabyte • Apple iPad, Generation 9, 32 Gigabyte • Epson TM-m30 Printer • Epson TM-p80 Printer • Epson TM-l90 Printer • iOS, Version 15.4.1 • Precinct Central Application, Version 5.0.0 • Precinct Central Console, Version 5.0.0 In addition to these major components, which includes the executable code and the source code, Tenex was required to submit the following: (1) the technical documentation package (TDP); (2) all the hardware components to field two complete working versions of the system, including all peripheral devices, one for the Functional Test Phase and one for the Security and Telecommunications Penetration Test Phase; (3) all the peripherals that would be in the polling place; and (4) the Tenex Precinct Central 5.0.0 User Guide. 3. Contracting and Consulting The Secretary of State released a Request for Quote (RFQ) for assistance with the software, security and telecommunications and accessibility testing. The statement of work (SOW) also had an option for the Secretary of State to use the awarded contractor for additional software, security and telecommunications and accessibility testing, if it deemed necessary. Through the formal California contracting process, the Secretary of State awarded a contract to SLI Compliance. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central 5.0.0 2 | Pa g e II. SUMMARY OF THE SYSTEM The system consists of eleven (11) components: 1. Apple iPad, Generation 5, 32 Gigabyte The iPad 5 comes with 32GB of storage capacity and is Wi‑Fi, and Bluetooth 4.2 technology compliant. 2. Apple iPad, Generation 6, 32 Gigabyte The iPad 6 comes with 32GB of storage capacity and is Wi‑Fi, and Bluetooth 4.2 technology compliant. 3. Apple iPad, Generation 7, 32 Gigabyte The iPad 7 comes with 32GB of storage capacity and is Wi‑Fi, and Bluetooth 4.2 technology compliant. 4. Apple iPad, Generation 8, 32 Gigabyte The iPad 8 comes with 32GB of storage capacity and is Wi‑Fi, and Bluetooth 4.2 technology compliant. 5. Apple iPad, Generation 9, 32 Gigabyte The iPad 9 comes with 32GB of storage capacity and is Wi‑Fi, and Bluetooth 4.2 technology compliant. 6. Epson TM-m30 Printer The TM-m30 thermal receipt printer is offered with a variety of interface options and is an iOS compatible Bluetooth printer. 7. Epson TM-p80 Printer The TM-p80 thermal receipt printer is offered with a variety of interface options and is an iOS compatible Bluetooth printer. 8. Epson TM-l90 Printer, Model M335B The TM-l90 thermal receipt printer is offered with a variety of interface options and is an iOS compatible Bluetooth printer. 9. iOS, Version 15.4.1 iOS is an Apple, Inc. mobile operating system exclusively for its hardware. It is the operating system that presently powers many of the company's mobile devices. 10. Precinct Central Application, Version 5.0.0 The Precinct Central solution provides an electronic voter check-in and verification process for election officials. Precinct Central is an Apple iPad application requiring no appendages for operation. The application also provides built-in election management tools, reporting tools and customizable workflows. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central 5.0.0 3 | Pa g e 11. Precinct Central Console, Version 5.0.0 Precinct Central Console is a web-based monitoring platform that connects polling places to the centralized location and facilitates communication between administrators and poll workers. It connects poll books, provides polling place status, enables trouble resolution, provides secure voter data management, and allows for poll worker supervision. III. TESTING INFORMATION AND RESULTS 1. Background Tenex submitted an application to the Secretary of State for certification of the Tenex Precinct Central 5.0.0 electronic poll book system (Precinct Central) on February 1, 2022. Examination of this system was conducted by Secretary of State Staff in conjunction with the State’s technical consultant SLI Compliance. Functional testing and Volume testing were performed by Secretary of State Staff from April 4 to April 8, 2022. Source Code Review, Security and Telecommunications Testing, and Accessibility Testing were performed by SLI Compliance from March 30 to April 19, 2022. 2. Functional Testing Summary Secretary of State Staff performed functional examination of the Precinct Central system. Secretary of State Staff configured the electronic poll books and exercised their functionality to provide verification of expected functions of the system as outlined in the vendor provided technical documentation, execution of test cases, and verification of the electronic poll book’s compliance with State statutes and regulations. During the examination, all electronic poll book functions outlined in the Tenex Precinct Central 5.0.0 User Guide documentation were exercised. Functional Testing Tenex provided five (5) electronic poll books (iPad’s with iOS version 14.5.1, and the Tenex Precinct Central 5.0.0 application), access to the Tenex Precinct Central Console 5.0.0 election management suite website, and three printers (Epson TM-m30, Epson TM-p80, and Epson TM-l90) for functional testing. Issues & Observations: During Functional Testing, twelve (12) issues were identified. All issues required mitigation. a. Documentation Twelve (12) issues were related to minor documentation discrepancies and were provided to Tenex for modification. The documentation was subsequently modified, and the changes verified by Secretary of State Staff. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central 5.0.0 4 | Pa g e b. Hardware There were no issues related to the hardware. c. Software There were no issues related to the software. 3. Software (Source Code) Review Testing Summary SLI Compliance performed a review of the Precinct Central source code. During testing, SLI conducted a security and integrity review of the Precinct Central source code. One (1) issue was identified within the Precinct Central source code. Table 3A: Software (Source Code) Review Testing Note: The following discrepancy is considered by SLI a non-functional issue of no impact to overall system security. Discrepancy Vendor Mitigation/Response Lack of Header Tenex is committed to resolving this issue in the next Comments version of the system. 4. Security and Telecommunications Testing SLI Compliance performed Security and Telecommunications testing on the Precinct Central. During testing, a full review of the Precinct Central was performed to analyze for findings against applicable requirements. Five (5) issues were identified during testing. The discrepancy and vendor mitigation/response are listed in the following table: Table 4A: Security and Telecommunications Testing Note: The following discrepancies are considered by SLI to be of minimal impact to overall system security and successfully mitigated via the implementation of Amazon Web Service Security Suite services, firewalls, network hardening techniques, input sanitization techniques, and virus scanning technologies. Discrepancy Vendor Mitigation/Response The Epson TM-m30 receipt Tenex will disable the port using the administrative printer had two active ports and interface for all elections deployed printers. Tenex had the default Epson will also update the default passwords for the credentials in place. printers. The Epson TM-L90 receipt Tenex will disable this port using the administrative printer had two active ports and interface for all elections deployed printers. Tenex had the default Epson will also update the default passwords for the credentials in place. printers. One (1) Instances of DOM- Tenex is committed to resolving this issue in the Based Link Manipulation next version of the system. Tenex will modify the .net code to inspect the return URL with a URI evaluator and make sure Multiple Instances of Open that the target domain has not been altered from Redirection (DOM-Based) the request before continuing processing. Tenex will work with the California Secretary of State SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central 5.0.0 5 | Pa g e through the administrative process to approve this fix. 5. Volume Testing Summary For approximately two days, 1,500 mock voters were processed on the Tenex Precinct Central 5.0.0 electronic poll book system. Zero (0) unexpected results or issues were encountered during the Volume Test. 6. Accessibility SLI evaluated the Precinct Central 5.0.0 electronic poll book system against the Web Content Accessibility Guidelines (WCAG) 2.0 and Section 508 of the Rehabilitation Act of 1973 for compliance. Six (6) unexpected results or issues were encountered during the Accessibility Review. Table 6A: Accessibility Note: One hundred and forty-three (143) requirements were reviewed, and three (3) requirements were not met. All unmet requirements were associated to the same findings within the system. All findings were limited to non-voter facing functionality and would not prevent or hinder a voter with accessibility needs from independently participating in the check-in process at a polling location. Discrepancy Vendor Mitigation/Response Section 508 § 1194.21 Software applications and operating systems - (l) When electronic forms are used, the form shall allow people Tenex will make an iOS keyboard using assistive technology to access the available to the counties for information, field elements, and functionality purchase to meet this requirement. required for completion and submission of the form, including all directions and cues. Section 508 § 1194.25 Self Contained, Closed Products - (c) Where a product utilizes Tenex will make an iOS keyboard touchscreens or contact-sensitive controls, an available to the counties for input method shall be provided that complies purchase to meet this requirement. with §1194.23 (k) (1) through (4). Section 508 § 1194.26 Desktop and Portable Computers - (b) If a product utilizes Tenex will make an iOS keyboard touchscreens or touch-operated controls, an available to the counties for input method shall be provided that complies purchase to meet this requirement. with §1194.23 (k) (1) through (4). SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central 5.0.0 6 | Pa g e IV. COMPLIANCE WITH STATE LAWS AND REGULATIONS Two (2) sections of the California Code of Regulations, sections 20150 and 20158, describe in detail the requirements any electronic poll book system must meet in order to be approved for use in California elections. These sections are described in detail and analyzed for compliance below. 1) §20150(a)(1): An electronic poll book shall contain, at a minimum, all of the following voter registration data: Name, Address, District/Precinct, Party preference, Voter status, Whether or not the voter has been issued a vote by mail ballot, Whether or not the vote by mail ballot has been recorded as accepted by the elections official, and whether or not the voter’s identification must be verified. The system meets this requirement. 2) §20150(a)(2): An electronic poll book shall not contain the following voter registration data: California driver’s license number, and Social Security Number or portion thereof. The system meets this requirement. 3) §20158(a): The electronic poll book shall not be connected to a voting system at any time. The system meets this requirement. 4) §20158(b): The electronic poll book shall demonstrate that it accurately processes all activity as prescribed in the vendor’s application packet. The system meets this requirement. 5) §20158(c): The electronic poll book shall be capable of operating for a period of at least two hours on backup power, such that no data is lost or corrupted nor normal operations interrupted. When backup power is exhausted, the electronic poll book shall retain the contents of all memories intact. The system meets this requirement. 6) §20158(d): The electronic poll book shall be compatible with: all voter registration election management systems used in the State of California, including any software system (middle ware) used to prepare the list of voters for the equipment, and any hardware attached to the electronic poll book (e.g. bar code scanners, signature capture devices, transport media, printers, etc.). The system meets this requirement. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central 5.0.0 7 | Pa g e 7) §20158(e): An electronic poll book shall contain all of the following voter registration data: Name, Address, District/Precinct, Party preference, Voter status, Whether or not the voter has been issued a vote by mail ballot, Whether or not the vote by mail ballot has been recorded as accepted by the elections official, and whether or not the voter’s identification must be verified. The system meets this requirement. 8) §20158(f): The electronic poll book shall encrypt all voter registration data at rest and in transit, utilizing a minimum of Advanced Encryption Standard (AES) 256-bit data encryption, based on recognized industry standards. The system meets this requirement. 9) §20158(g): The electronic poll book shall provide reliable transmission of voter registration and election information. The system meets this requirement. 10) §20158(h): The electronic poll book shall have the capability to store a local version of the electronic list of registered voters to serve as a backup. The system meets this requirement. 11) §20158(i): The electronic poll book shall produce a list of audit records that reflect all actions of the system, including in-process audit records that display all transactions. Such audit records shall be able to be exported in non- proprietary, human readable format. The system meets this requirement. 12) §20158(j): The electronic poll book shall enable a poll worker to easily verify that the electronic poll book: has been set up correctly, is working correctly so as to verify the eligibility of the voter, is correctly recording that a voter has voted, and has been shut down correctly. The system meets this requirement. 13) §20158(k): After the voter has been provided with a ballot, the electronic poll book shall permit a poll worker to enter information indicating that the voter has voted at the election. The electronic poll book shall have the capability to transmit this information to every other electronic poll book in the county utilizing the same list of registered voters. The system meets this requirement. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central 5.0.0 8 | Pa g e 14) §20158(l): The electronic poll book shall permit voter activity to be accurately uploaded into the county’s voter registration election management system. The system meets this requirement. 15) §20158(m): During an interruption in network connectivity of an electronic poll book, all voter activity shall be captured and the electronic poll book shall have the capacity to transmit that voter activity upon connectivity being restored. The system meets this requirement. 16) §20158(n): If the electronic poll book uses an electronic signature capture device, the device shall: produce a clear image of the electronic signature capable of verification, and retain and identify the signature of the voter The system meets this requirement. 17) §20158(o): The electronic poll book shall have the capacity to transmit all information generated by the voter or poll worker as part of the process of receiving a ballot, including the time and date stamp indicating when the voter voted, and the electronic signature of the voter, where applicable, to the county’s voter registration election management system. The system meets this requirement. 18) §20158 (p): The Secretary of State recommends electronic poll books not be enabled or installed with any technologies delineated in the Institute of Electrical and Electronics Engineers’ (IEEE) 802.11 wireless local area network (LAN) standards. However, should an electronic poll book be enabled or installed with a wireless technology, the following shall be utilized: a minimum of 256-bit data encryption, a minimum of Wireless Protected Access (WPA) 2 security enabled, compliance with Payment Card Industry Data Security Standards (PCI DSS) version 3.2, a dedicated wireless access point (WAP) or connection utilized only by county employees or elections officials and void of public or guest access, and devices equipped with one or more of the following: biometric authentication, multi-factor authentication, compliance with current PCI DSS version 3.2 password requirements, or remote wipe technology set to automatically clear a device upon 8 eight failed login attempts. The system meets this requirement. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central 5.0.0 9 | Pa g e 19) §20158 (q): Jurisdictions utilizing a wide area network (WAN) to transmit voter registration data from an electronic poll book to a centralized location shall utilize one of the following: a dedicated leased line, a hardware virtual private network (VPN), or a dedicated cellular connection void of public or guest access. The system meets this requirement. 20) §20158 (r): The electronic poll book shall be reviewed for accessibility. The system meets this requirement. V. CONCLUSION The Tenex Precinct Central Electronic Poll Book System, Version 5.0.0, in the configuration tested and documented by SLI Compliance and the California Secretary of State, is compliant with all California laws. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central 5.0.0 10 | P a ge