Secretary of State Staff Report

A P LEX ADILLA |SECRETARY OF STATE | STATE OF CALIFORNIA OFFICE OF VOTING SYSTEMS TECHNOLOGY ASSESSMENT 1500 11th Street | Sacramento, CA 95814 | Tel 916.695.1680 | Fax 916.653.4620 | www.sos.ca.gov Tenex Precinct Central ePollbook Version 4.0 Apple iPad, Generation 5 iOS, Version 10.3.3 Precinct Central ePollbook Application (EPB), Version 4.0 Epson TM-m30 Printer, Model M335B Precinct Central Console, Version 4.0 AT&T Velocity Mobile Hotspot, Model MF923 Staff Report Prepared by: Secretary of State’s Office of Voting Systems Technology Assessment May 22, 2018 Table of Contents I. Introduction .....................................................................................................1 1. Scope ...............................................................................................1 2. Summary of the Application ...........................................................1 3. Contracting and Outsourcing ..........................................................1 II. Summary of the System .................................................................................2 1. Apple I-Pad, Generation 5 ..............................................................2 2. iOS, Version 10.3.3 .........................................................................2 3. Precinct Central ePollbook Application (EPB), Version 4.0 ..........2 4. Epson TM-m30 Printer, Model M335B..........................................2 5. Precinct Central Console, Version 4.0 ............................................2 6. AT&T Velocity Mobile Hotspot, Model MF923 ...........................2 III. Testing Information and Results ....................................................................3 1. Background .....................................................................................3 2. Functional Testing Summary ..........................................................3 3. Software Review Testing Summary ...............................................5 4. Security and Telecommunications Testing Summary ....................7 5. Volume Testing Summary ..............................................................8 6. Accessibility ....................................................................................8 IV. Compliance with State Laws and Regulations ...............................................9 V. Conclusion .......................................................................................................11 A P LEX ADILLA |SECRETARY OF STATE | STATE OF CALIFORNIA OFFICE OF VOTING SYSTEMS TECHNOLOGY ASSESSMENT 1500 11th Street | Sacramento, CA 95814 | Tel 916.695.1680 | Fax 916.653.4620 | www.sos.ca.gov I. INTRODUCTION 1. Scope This report presents the test results for all phases of the certification test of the Tenex Precinct Central ePollbook, Version 4.0. The purpose of the testing is to test the compliance of the electronic poll book with California laws. Testing also uncovers other findings, which do not constitute non-compliance, and those findings are reported to the electronic poll book vendor to address the issues procedurally. The procedures for mitigating any additional findings are made to the documentation, specifically the Precinct Central ePollbook Use Procedures. 2. Summary of the Application Tenex submitted an application for the Precinct Central ePollbook on December 1, 2016. The system is comprised of the following major components: Apple iPad, Generation 5 iOS, Version 10.3.3 Precinct Central ePollbook Application (EPB), Version 4.0 Epson TM-m30 Printer, Model M335B Precinct Central Console, Version 4.0 AT&T Velocity Mobile Hotspot, Model MF923 In addition to these major components, which includes the executable code and the source code, Tenex was required to submit the following: 1) the technical documentation package (TDP); 2) all the hardware components to field two complete working versions of the system, including all peripheral devices, one for the Functional Test Phase and one for the Security and Telecommunications Penetration Test Phase; 3) all the peripherals that would be in the polling place; and 4) the Precinct Central ePollbook Use Procedures. 3. Contracting and Consulting Upon receipt of a complete application, the Secretary of State released a Request for Quote (RFQ) for assistance with the software, security and telecommunications and accessibility testing. The statement of work (SOW) also had an option for the Secretary of State to use the awarded contractor for additional software, security and telecommunications and accessibility testing, if it deemed necessary. Through the formal California contracting process, the Secretary of State awarded a contract to SLI Compliance. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central, version 4.0 1 | P a ge II. SUMMARY OF THE SYSTEM The system consists of six (6) components: 1. Apple iPad, Version 5 The iPad 5 is 9.4 inches (240 mm) tall, 6.6 inches (169.5 mm) wide, 0.29 inches (7.5 mm) thin, and weighs in at 1.03 pounds (469 grams). It comes with 32GB of storage capacity. The display has the retina density of 2048x1536 pixels at 264 pixels-per-inch (ppi). Inside the iPad is an Apple A9 system-on-a-chip (SoC) with integrated M9 motion co-processor and 2 GB of RAM. The device is also Wi‑Fi (802.11a/b/g/n/ac), dual band (2.4GHz and 5GHz) , HT80 with MIMO and Bluetooth 4.2 technology compliant. 2. iOS, version 10.3.3 iOS (formerly iPhone OS) is a mobile operating system created and developed by Apple Inc. exclusively for its hardware. It is the operating system that presently powers many of the company's mobile devices, including the iPhone, iPad, and iPod Touch. Major versions of iOS are released annually. 3. Precinct Central ePollbook Application (EPB), Version 4.0 Tenex Software Solutions’ Precinct Central ePollbook application runs on the iPad hardware platform and requires no other peripherals for driver license scanning and signature capture. It is customizable and scalable per jurisdictional needs. The application provides on-screen help guides and FAQs to aid with Election Day procedures, equipment setup, and more. 4. Precinct Central Console, Version 4.0 Precinct Central Console is a real-time comprehensive monitoring platform that allows elections staff to monitor devices, users, communications, and performance metrics on a dedicated computing environment. Precinct Central Console provides direct access to election information to officials. The Precinct Central Console is also the election office portal for all pre-election setup activity and post- election data reconciliation, auditing, and export. 5. Epson TM-m30 Printer, Model M335B The TM-m30 thermal receipt printer prints 3" receipts from mobile devices and/or desktop computers. It prints at 200 millimeters per second, is Bluetooth and WiFi compatible and works with the iOS system. 6. AT&T Velocity Mobile Hotspot, Model MF923 The AT&T Velocity offers WiFi via AT&T's LTE, HSPA+, and 3G networks. It is dual- band, meaning it offers both 2.4GHz and 5 GHz WiFi and allows up to 10 connections at once. It measures 4.5 x 2.5 x .7 inches (WHD) and weighs 0.28 pounds. The Velocity also lets users set the Wi-Fi range to short, medium, or long. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central, version 4.0 2 | P a ge III. TESTING INFORMATION AND RESULTS 1. Background Tenex submitted an application to the Secretary of State for certification of the Tenex Precinct Central ePollbook, Version 4.0 on December 1, 2016. State examination and functional testing of this system was conducted by Secretary of State Staff in conjunction with the State’s technical consultant SLI Compliance. The configuration of the equipment was conducted at the Secretary of State’s office in Sacramento, California on March 12, 2018. Functional testing was performed by Secretary of State Staff from March 12 to March 14, 2018 (Phase I), and April 10 to April 11, 2018 (Phase II). Volume testing was conducted by Secretary of State Staff from April 23, 2018, through April 24, 2018. Source Code Review, Security and Telecommunications Testing and Accessibility Testing were performed by SLI Compliance from April 13 to May 11, 2018. 2. Functional Testing Summary Functional examination and review was conducted as if the California Secretary of State were a jurisdiction that just purchased Tenex’s Precinct Central ePollbook system. Tenex’s Precinct Central ePollbook Use Procedures documentation was executed to install all hardware and software per the vendor’s instruction. All electronic poll book functions to be utilized by a jurisdiction were exercised. Functional Testing Phase I Phase I of Functional Testing began on March 12, 2018, and proceeded through March 16, 2018. Tenex provided two electronic poll books (5th Generation I-Pad with iOS version 10.3.3 and the Tenex Precinct Central ePollbook application), access to the Tenex Precinct Central Console website, two printers (Epson TM-m30) and one AT&T Velocity Mobile Hotspot for functional testing. For approximately three days, Secretary of State Staff exercised the functionality of the electronic poll book according to the vendor provided technical documentation. The exercises included verification of expected functions of the system as outlined in the vendor provided technical documentation, execution of test cases and verification of the electronic poll books compliance with State statutes and regulations. Issues & Observations: During Phase I, approximately twenty-four (24) issues were identified. All twenty-four (24) issues required mitigation. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central, version 4.0 3 | P a ge a. Documentation Twenty-two (22) issues were related to minor documentation discrepancies and were provided to Tenex for modification. The documentation was subsequently modified and the changes verified by Secretary of State Staff. b. Hardware There were no issues related to the hardware. c. Software Two (2) issues were related to the software and were provided to Tenex for mitigation. All iPad operating system (iOS) settings (e.g., updates, date and time, WiFi, etc.) were accessible and capable of manipulation. This was mitigated by setting the device in Guided Access Mode. Guided Access restricts the iOS device to the Precinct Central ePollbook application. The Precinct Central ePollbook application did not require a user specific username and password be entered when accessing the application. This was mitigated by adjusting the application settings to require a password anytime the application is accessed. The mitigations were implemented and verified by Secretary of State Staff. Functional Testing Phase II Phase II of Functional Testing began on April 10, 2018, and proceeded through April 11, 2018. Tenex provided mitigations to the issues and observations identified within Phase I of Functional Testing. For approximately two days, Secretary of State Staff exercised and confirmed the functionality of the mitigations to the issues and observations identified within Phase I of Functional Testing. A Tenex representative was present for Phase II of Functional Testing. Issues & Observations: During Phase II, mitigations to issues identified in Phase I were exercised and confirmed. Six (6) additional issues were identified during Phase II. All six (6) issues required mitigation. a. Documentation Six (6) issues were related to minor documentation discrepancies, which were given to Tenex for modification. The documentation was subsequently modified and the changes verified by Secretary of State Staff. b. Hardware There were no issues related to the hardware. c. Software SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central, version 4.0 4 | P a ge There were no issues related to the software. 3. Software Review Testing Summary SLI Compliance performed a review of the Precinct Central ePollbook source code. During the testing, SLI conducted a Security review of the Objective C source code, an Integrity review of the Objective C source code, and a Vulnerability review of the Objective C source code. The results and vendor mitigations/responses are listed in the following table: Table 3A: Security Review of Objective C Source Code Discrepancy Vendor Mitigation/Response No findings or vulnerabilities were located. N/A Table 3B: Integrity Review of Objective C Source Code Discrepancy Vendor Mitigation/Response Tenex will put a catch at the end of the line. The database does not always send an error Tenex will work with the California Secretary message when a failure occurs. of State through the administrative process to approve this fix. Table 3C: Vulnerability Review of Objective C Source Code Discrepancy Vendor Mitigation/Response No findings or vulnerabilities were located. N/A 4. Security and Telecommunications Testing SLI Compliance performed Security and Telecommunications testing on the Precinct Central ePollbook. During the testing, SLI conducted a physical security review, logical security review, physical telecommunications review and a logical telecommunications review. The results and vendor mitigations/responses are listed in the following table: Table 4A: Physical Security Review Discrepancy Vendor Mitigation/Response The Epson TM-m30 receipt printer had an Tenex will disable this port using the active wired network port that when administrative interface for all elections deployed supplied with an IP via a DHCP server printers. Tenex will also update the default had the default Epson credentials in place. passwords for the printers. Table 4B: Logical Security Review Note: The following discrepancies were considered of minimal overall impact to the overall security of the Tenex Precinct Central 4.0 solution by SLI as all discrepancies would require Election Official insider or Vendor insider access. Discrepancy Vendor Mitigation/Response Tenex will augment the current cookie based mechanism of identifying users with additional Cross-Site Request Forgery hidden fields that are cryptographically enhanced. Tenex will work with the California Secretary of SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central, version 4.0 5 | P a ge State through the administrative process to approve this fix. Tenex will set the secure flag to “ON” for the SSL cookie. Tenex will work with the California SSL Cookie Without Secure Flag Set Secretary of State through the administrative process to approve this fix. Tenex will modify the .net code to inspect the return URL with a URI evaluator and make sure that the target domain has not been altered from Open Redirection (DOM-Based) the request before continuing processing. Tenex will work with the California Secretary of State through the administrative process to approve this fix. Tenex will modify the .net infrastructure code to not set the target URLs from an untrusted source. Link Manipulation (DOM-based) Tenex will work with the California Secretary of State through the administrative process to approve this fix. Tenex will modify all responses to include the correct content/MIME type in the header. Tenex Content Type Incorrectly Stated. will work with the California Secretary of State through the administrative process to approve this fix. Tenex will enable HTTP Strict Transport Security (HSTS) by adding a response header with Strict- Transport-Security and maxage parameters so Strict Transport Security. browsers will only process the session in secure encrypted sessions. Tenex will work with the California Secretary of State through the administrative process to approve this fix. Table 4C: Physical Telecommunications Review Discrepancy Vendor Mitigation/Response The Epson TM-m30 Bluetooth Receipt printer has an accessible RJ-45 Ethernet Tenex will disable this port using the port that has a print server that utilizes administrative interface for all elections deployed default username and password printers. Tenex will also update the default combinations to access and configure the passwords for the printers. printer. Table 4D: Logical Telecommunications Review Discrepancy Vendor Mitigation/Response The Epson TM-m30 Bluetooth Receipt printer has an accessible RJ-45 Ethernet Tenex will disable this port using the port that has a print server that utilizes administrative interface for all elections deployed default username and password printers. Tenex will also update the default combinations to access and configure the passwords for the printers. printer. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central, version 4.0 6 | P a ge 5. Volume Testing Summary Volume Testing began on April 23, 2018, and proceeded through April 24, 2018. For approximately two days, Secretary of State Staff processed 250 mock voters on the Precinct Central ePollbook. No unexpected results or issues were encountered during the Volume test. 6. Accessibility SLI evaluated the Precinct Central ePollbook against the applicable portions of the Web Content Accessibility Guidelines (WCAG) 2.0 and Section 508 of the Rehabilitation Act of 1973 for compliance. The discrepancies and vendor mitigations/responses are listed in the following table: Table 6A: WCAG 2.0 Review NOTE: The WCAG 2.0 examination included 93 requirements. Discrepancy Vendor Mitigation/Response 1.4.6 Contrast (Enhanced) (Level AAA) - Tenex will make the necessary adjustments to Text and images of text have a contrast ratio the text, images of text and large text to ensure of at least 7:1. the requirement is met. Tenex will work with the California Secretary of State through the The text is extremely light. administrative process to approve this fix. 1.4.6 Contrast (Enhanced) (Level AAA) - Tenex will make the necessary adjustments to Large text (over 18 point or 14 point bold) the text, images of text and large text to ensure has a contrast ratio of at least 4.5:1. the requirement is met. Tenex will work with the California Secretary of State through the The text is extremely light. administrative process to approve this fix. Tenex can provide an iOS keyboard to the Guideline 2.1 - Keyboard Accessible: Make counties at an additional cost to meet this all functionality available from a keyboard. requirement. 2.1.1 Keyboard (Level A) - All page functionality is available using the Tenex can provide an iOS keyboard to the keyboard, unless the functionality cannot be counties at an additional cost to meet this accomplished in any known way using a requirement. keyboard (e.g., free hand drawing). 2.1.3 Keyboard (No Exception) (Level AAA) - All page functionality is available Tenex can provide an iOS keyboard to the using the keyboard. counties at an additional cost to meet this requirement. Not all functionality is available from a keyboard. Table 6B: Section 508 Review Note: The Section 508 examination included 50 requirements. Discrepancy Vendor Mitigation/Response § 1194.21 Software applications and End users can utilize built-in assistive operating systems - (l) When electronic technologies to meet this requirement by using forms are used, the form shall allow people assistive technologies such as VoiceOver and SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central, version 4.0 7 | P a ge using assistive technology to access the Bluetooth keyboards. Additional functionality information, field elements, and can be added to the application in a future functionality required for completion and release to enhance the applications compliance submission of the form, including all to this requirement. directions and cues. The built-in VoiceOver screen reader provides § 1194.23 Telecommunications Products - audio and visual feedback for touchscreen (k) Products which have mechanically controls without requiring the user to activate operated controls or keys, shall comply with them. The Home, Sleep/Wake, and Volume the following: (1) Controls and keys shall rocker switch are also tactilely discernible. The be tactilely discernible without activating Volume rocker switch must be pressed to the controls or keys. determine the current volume setting. The built-in VoiceOver screen reader provides audio and visual feedback for touchscreen controls. Also, VoiceOver can be controlled via key commands entered on a standard Bluetooth keyboard. The iPad also includes a number of Accessibility features to support motor control; § 1194.25 Self-contained, closed Products - AssistiveTouch which provides an alternative (c) Where a product utilizes touchscreens or set of screen gestures for users who may have contact-sensitive controls, an input method difficulty with touch gestures and requires only shall be provided that complies with a single finger or apparatus to operate, Switch §1194.23 (k) (1) through (4). Control which provides an alternate method for navigating and making onscreen selections, and Touch Accommodations which provides a means to adjust how the screen responds to touches, such as controlling how long you touch before it’s recognized or whether it ignores repeated touches. iPad uses a non-mechanical, onscreen § 1194.26 Desktop and portable Computers keyboard. An external keyboard (available - (b) If a product utilizes touchscreens or separately) can also be used for text input. touch-operated controls, an input method Tenex can provide a compatible Bluetooth shall be provided that complies with keyboard at an additional cost to meet this §1194.23 (k) (1) through (4). requirement. iPad includes a built-in screen reader called VoiceOver that enables iPad to be used by those who are blind or visually impaired. Also, VoiceOver can be controlled via key commands § 1194.31 Functional performance Criteria - entered on a standard Bluetooth keyboard. iPad (a) At least one mode of operation and supports more than 70 Bluetooth wireless information retrieval that does not require braille displays (sold separately) and braille user vision shall be provided, or support for tables for more than 25 international languages. assistive technology used by people who are Some braille displays provide input buttons that blind or visually impaired shall be provided. can be used in addition to iPad’s on screen controls. Tenex can provide one of the compatible braille displays at an additional cost to meet this requirement. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central, version 4.0 8 | P a ge IV. COMPLIANCE WITH STATE LAWS AND REGULATIONS Two (2) sections of the California Code of Regulations, Sections 20150 and 20158, describe in detail the requirements any electronic poll book system must meet in order to be approved for use in California elections. These sections are described in detail and analyzed for compliance below. 1) §20150(a)(1): An electronic poll book shall contain, at a minimum, all of the following voter registration data: Name, Address, District/Precinct, Party preference, Voter status, Whether or not the voter has been issued a vote by mail ballot, Whether or not the vote by mail ballot has been recorded as accepted by the elections official, and Whether or not the voter’s identification must be verified. The system meets this requirement. 2) §20150(a)(2): An electronic poll book shall not contain the following voter registration data: California driver’s license number, and Social Security Number or portion thereof. The system meets this requirement. 3) §20158(a): The electronic poll book shall not be connected to a voting system at any time. The system meets this requirement. 4) §20158(b): The electronic poll book shall demonstrate that it accurately processes all activity as prescribed in the vendor’s application packet. The system meets this requirement. 5) §20158(c): The electronic poll book shall be capable of operating for a period of at least two hours on backup power, such that no data is lost or corrupted nor normal operations interrupted. When backup power is exhausted, the electronic poll book shall retain the contents of all memories intact. The system meets this requirement. 6) §20158(d): The electronic poll book shall be compatible with all voter registration election management systems used in the State of California, including any software system (middle ware) used to prepare the list of voters for the equipment, and any hardware attached to the electronic poll book (e.g. bar code scanners, signature capture devices, transport media, printers, etc.). The system meets this requirement. 7) §20158(e): An electronic poll book shall contain all of the following voter registration data: Name, Address, District/Precinct, Party preference, Voter status, Whether or not the voter has been issued a vote by mail ballot, Whether or not the vote by mail ballot has been recorded as accepted by the elections official, and Whether or not the voter’s identification must be verified. The system meets this requirement. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central, version 4.0 9 | P a ge 8) §20158(f): The electronic poll book shall encrypt all voter registration data at rest and in transit, utilizing a minimum of Advanced Encryption Standard (AES) 256-bit data encryption, based on recognized industry standards. The system meets this requirement. 9) §20158(g): The electronic poll book shall provide reliable transmission of voter registration and election information. The system meets this requirement. 10) §20158(h): The electronic poll book shall have the capability to store a local version of the electronic list of registered voters to serve as a backup. The system meets this requirement. 11) §20158(i): The electronic poll book shall produce a list of audit records that reflect all actions of the system, including in-process audit records that display all transactions. Such audit records shall be able to be exported in non-proprietary, human readable format. The system meets this requirement. 12) §20158(j): The electronic poll book shall enable a poll worker to easily verify that the electronic poll book: has been set up correctly, is working correctly so as to verify the eligibility of the voter, is correctly recording that a voter has voted, and has been shut down correctly. The system meets this requirement. 13) §20158(k): After the voter has been provided with a ballot, the electronic poll book shall permit a poll worker to enter information indicating that the voter has voted at the election. The electronic poll book shall have the capability to transmit this information to every other electronic poll book in the county utilizing the same list of registered voters. The system meets this requirement. 14) §20158(l): The electronic poll book shall permit voter activity to be accurately uploaded into the county’s voter registration election management system. The system meets this requirement. 15) §20158(m): During an interruption in network connectivity of an electronic poll book, all voter activity shall be captured and the electronic poll book shall have the capacity to transmit that voter activity upon connectivity being restored. The system meets this requirement. 16) §20158(n): If the electronic poll book uses an electronic signature capture device, the device shall: produce a clear image of the electronic signature capable of verification, and retain and identify the signature of the voter The system meets this requirement. 17) §20158(o): The electronic poll book shall have the capacity to transmit all information generated by the voter or poll worker as part of the process of receiving a SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central, version 4.0 10 | P a ge ballot, including the time and date stamp indicating when the voter voted, and the electronic signature of the voter, where applicable, to the county’s voter registration election management system. The system meets this requirement. 18) §20158 (p): The Secretary of State recommends electronic poll book not be enabled or installed with any technologies delineated in the Institute of Electrical and Electronics Engineers’ (IEEE) 802.11 wireless local area network (LAN) standards. However, should an electronic poll book be enabled or installed with a wireless technology, the following shall be utilized: a minimum of 256-bit data encryption, a minimum of Wireless Protected Access (WPA) 2 security enabled, compliance with Payment Card Industry Data Security Standards (PCI DSS) version 3.2, a dedicated wireless access point (WAP) or connection utilized only by county employees or elections officials and void of public or guest access, and devices equipped with one or more of the following: biometric authentication, multi-factor authentication, compliance with current PCI DSS version 3.2 password requirements, or remote wipe technology set to automatically clear a device upon 8 eight failed login attempts. The system meets this requirement. 19) §20158 (q): Jurisdictions utilizing a wide area network (WAN) to transmit voter registration data from an electronic poll book to a centralized location shall utilize one of the following: a dedicated leased line, a hardware virtual private network (VPN), or a dedicated cellular connection void of public or guest access. The system meets this requirement. 20) §20158 (r): The electronic poll book shall be reviewed for accessibility. The system meets this requirement. V. CONCLUSION The Tenex Precinct Central ePollbook, Version 4.0, in the configuration tested and documented by the California Secretary of State, is compliant with all California laws. SECRETARY OF STATE’S STAFF REPORT – Tenex Precinct Central, version 4.0 11 | P a ge