Post-Election Audit Pilots, and New Physical and Cyber Security Requirements in Indiana Election Code

Transcription

1 Post-Election Audit Pilots, and New Physical and Cyber Security Requirements in Indiana Election Code Jay S. Bagga, Ph.D. & Bryan D. Byers, Ph.D. VSTOP Co-Directors Ball State University With Special Assistance From: Jessica Martin, VSTOP Project Manager Mani Kilaru, VSTOP IT Specialist Molly Owens, Graduate Assistant

2 Risk Limiting Audit (RLA) Pilot in Indiana RLA Pilot in Marion County, Indiana held on May 29-30, 2018 The largest county in Indiana in terms of number of registered voters (> 600K) Includes the city of Indianapolis The first RLA audit in Indiana, and the first in U.S. to include Dr. Rivest s Bayesian method

3 RLA Pilot Team Members of the Team Marion County, EAC, MIT and VSTOP

4 Some background Post Election Audits Governor s Council on Cybersecurity Discussions with SOS Discussions with Jerome Lovato, EAC Jerome s presentation in Austin last year Selection of some paper ballot counties in Indiana Approval process for Marion County SOS, IED, Marion

5 RLAs Defined (1) Risk-Limiting Audits Working Group White Paper, 2012 Risk-limiting audits systematically check the election outcomes reported by vote-counting systems. Specifically, a risk-limiting audit checks some voted ballots or voterverifiable records in search of strong evidence that the reported election outcome was correct if it was.

6 RLAs Defined (2) Risk-Limiting Audits Working Group White Paper, 2012 Specifically, if the reported outcome (usually the set of winner(s)) is incorrect, then a risk-limiting audit has a large, pre-specified minimum chance of leading to a full hand count that reveals the correct outcome. A risk-limiting audit can stop as soon as it finds strong evidence that the reported outcome was correct (Closer elections generally entail checking more ballots).

7 Post-Election Methods (1) RLAs depend on Voter Verified Paper Ballots which are read by an Optical Scan Voting System. Dr. Lindeman and Dr. Stark s RLA Method. Ballot Polling RLA (sample of paper ballots). Comparison RLA (using Cast Vote Record). Provides strong statistical evidence of a correct election outcome and a high probability of correcting a wrong outcome.

8 Post-Election Methods (2) Dr. Rivest s Bayesian Method. Statistical tabulation audit. Provides statistical assurance that a reported contest outcome is correct or else it finds the correct contest outcome. Bayesian risk limit is the upper bound of probability desired in an audit that the procedure will make an error.

9 Races Audited in the Pilot 2016 Presidential (5 precincts) Primary Democratic Sheriff (10 Precincts) Republican US Senator (Comparison Polling Audit).

10 Manifest for 2016 Presidential Race Precinct ID Total # of Ballots Batch ID # of Ballots in Batch LA-03P 295 LA LA-03A 5:19PM 103 LA-03U 1 LA-03A 1:48 PM 1 WS WS-49P 354 WS-49A 6:12 PM 45 PE-39P 510 PE PE-39A Election Day 85 PE-39U 4 PE-39A Unknown 1 WR-23P 506 WR WR-23A 1:30 PM 94 WR-23U 4 WS-69P 444 WS-69A 2:02 PM 149 WS WS-69U 4 WS-69A 10:23 PM 1 WS-69A Unknown 1

11 Ballot Polling (Dr. Stark s RLA Method)

12 Ballot Polling Results (Dr. Stark s RLA Method)

13 Ballot Polling Results (Dr. Rivest s Bayesian Method)

14 Manifest for 2018 Sheriff (D) Race Precinct ID Total # of Ballots Batch ID # of Ballots in Batch PI PI-09P 189 PI-09A 9:34 PM 9 WR WR-35P 184 WR-35A 3:54 PM 11 WR-33A 7:12 PM 1 WR WR-33U 1 WR-33P 181 WR-33A 4:07 PM 12 PI-19P 178 PI PI-19A 5:04 PM 7 PI-19U 1 PI-13P 80 PI-13A (A) A 27 PI-13A (B) B 9 PI PI-13A (C) C 25 PI-13A (D) D 12 PI-13A (E) E 8 PI-13A (F) F 20 PI-13U 2 WS WS-27P 147 WS-27A 3:40PM 21 WR WR-28P 158 WR-28A 1:10PM 8 PI PI-08P 147 PI-08A 9:50 PM 7 WS WS-14P 134 WS-14A 4:37 PM 20 LA LA-18P 136 LA-18A Unknown 12

15 Results for 2018 Sheriff (D) Race Ballot Polling (Dr. Stark s RLA Method)

16 Results for 2018 Sheriff (D) Race Ballot Polling Results (Dr. Rivest s Bayesian Method)

17 Comparison Polling for 2018 U.S. Senator (R) Race

18 Comparison Polling for 2018 U.S. Senator (R) Race

19 Summary Remarks The RLA Pilot has raised awareness about post election audits among election officials in Indiana SOS, IED, Counties. A deliverable for the Governor s Council on Cybersecurity. More such pilots under discussion. VSTOP will monitor RLA activity in other states.

20 Public Law (SEA 327): Election Security

21 Care and Custody of Voting Equipment CEB Responsibility The county election board is responsible for the care and custody of all ballot card voting systems, electronic voting systems, and electronic poll books while not in use. (SEA 327 3, 4, and 5; Effective date: March 15, 2018; Citation affected: IC [New], IC ; IC )

22 Reimbursement for Security and Monitoring Expenditures A county election board may file an application with the secretary of state for reimbursement of expenditures made by the county to secure and monitor facilities where voting systems and electronic poll books are stored. The application must be on a form prescribed by the Election Division. If the secretary of state, with the consent of the Election Division, approves the application, the county may be reimbursed for all or part of the expenditures. (SEA 327 1; Effective date: March 15, 2018; Citation affected: IC [New])

23 Voting Equipment Access Policies (1) The county election board is responsible for establishing access protocols for voting systems and electronic poll books, including specifying when variations from access policies are permitted. The county election board may adopt a resolution by unanimous vote of the board s entire membership to establish a security protocol to secure the county s voting systems and electronic poll books. The security protocol must include an audit trail [log] to detect unauthorized access to the voting systems and electronic poll books. The voting system technical oversight program (VSTOP) and the Election Division shall be available to advise the county election board in the development of a security protocol.

24 Voting Equipment Access Policies (2) If the county election board does not adopt a security protocol by unanimous resolution of the board s entire membership, then upon completion of the canvass of votes cast in an election, the county election board shall place a uniquely numbered seal on each voting system and electronic poll book used in the election to secure the voting system and electronic poll book and permit post-election auditing. The form of the seal and information contained on the seal shall be prescribed by the Election Division and must make it impossible to access the sealed part of the voting system or electronic poll book unit without detection.

25 Voting Equipment Access Policies (3) A seal placed on a voting system or electronic poll book must remain in place except when the county election board finds unsealing to be necessary and orders unsealing for one of the following reasons: 1) To conduct maintenance on the voting system or electronic poll book. 2) To prepare the voting system or electronic poll book for use in the next election to be conducted by the county in which the voting system or electronic poll book will be made available. 3) To install certified voting system hardware, firmware, or software on a voting system or certified upgrades on an electronic poll book. 4) To conduct a public test of the voting system or electronic poll book required by state law.

26 Voting Equipment Access Policies (4) 5) To conduct an audit authorized or required by this title. 6) For the county election board to correct an error under IC (error in the certification of an election). 7) When ordered during a recount or contest proceeding under IC 3-12.

27 Voting Equipment Access Policies (5) The county election board shall document when each voting system or electronic poll book is sealed or unsealed by identifying the following: 1) the serial number of each voting system or electronic poll book that is sealed or unsealed; 2) the date on which the sealing or unsealing occurred; and 3) the individual who performed the sealing or unsealing. (SEA 327 9; Effective date: July 1, 2018; Citation affected: IC )

28 Reporting of Improper Access to Voting Equipment or SVRS Data A county election board shall file a report with the secretary of state not later than forty-eight (48) hours after receiving notice of the following from a federal, state, or local government agency: 1) a voting system or electronic poll book has been improperly obtained or altered in a manner that violates Indiana law; or 2) the data concerning the county maintained in the statewide voter registration system (SVRS) has been accessed or altered by a person in violation of Indiana law. (SEA ; Effective date: March 15, 2018; Citation affected: IC )

29 Disposal of Voting Systems and Electronic Poll Books Whenever a county wishes to dispose of a voting system unit or an electronic poll book unit, the county election board must first file a plan with the Election Division. The plan must state the following: 1) the serial number of each unit to be disposed of by the county; 2) the method to be used for disposal of the equipment, including sale, transfer, or destruction of the equipment; and 3) that the disposal will occur in compliance with federal and state laws requiring the retention of election materials until the expiration of the period specified by those laws.

30 County Disposal of Voting Systems and Electronic Poll Books If the Election Division approves the proposed plan, the Election Division shall notify the county election board and the voting system technical oversight program (VSTOP). The county election board may dispose of the equipment after receiving notice that the Election Division approves the county s proposed plan. (SEA ; Effective date: March 15, 2018; Citation affected: IC [New])

31 Election Equipment Inventory Each county election board shall regularly provide information to the voting system technical oversight program (VSTOP) to update the inventory of voting systems and electronic poll books. Not later than January 31 of each year, the county election board shall certify to the secretary of state that the information set forth in the inventory regarding the voting systems and electronic poll books of the county is accurate, to the best of the knowledge and belief of the county election board. The inventory system maintained by VSTOP shall include unique serial numbers to identify each voting system unit and electronic poll book and indicate the location where each voting system unit or electronic poll book is ordinarily stored. (SEA and 13; Effective date: March 15, 2018; Citation affected: IC ; IC [New])

32 Electronic Poll Book Server Information generated by the voter or the poll clerk as part of the process of casting a ballot, including the time and date stamp indicating when the voter signed the electronic poll book and the signature of the voter, is required to be kept on private server approved by the county election board. Former law required this information to be kept on a private server maintained by the county election board. The amended state law permits the information to be kept on a private server maintained by the county s vendor rather than on a server maintained by the county. (SEA 327 5; Effective date: March 15, 2018; Citation affected: IC )

33 Summary Remarks With these new legislative changes, VSTOP will be more involved in physical and cybersecurity of election systems within the state. In addition to these new laws, VSTOP conducted an epb security survey study. Some of the practices used by epb vendors and counties for security with these devices is making it into a policy report for the Indiana Secretary of State. Some of these recommendations go beyond SEA 327 in the form of best practices.