Voting System in a Pilot Program :: California Secretary of State

California Code of Regulations

Title 2. Administration

Division 7. Secretary of State

Chapter 6.1. Experimental Use of a Voting System in a Pilot Program

Article 1. Approval of Pilot Programs

Section 20685. General Provisions

No voting system that has not been certified or conditionally approved shall be used in a pilot program except as provided for in this Chapter and Section 19209 of the Elections Code.
No voting system that has not been certified or conditionally approved shall be used in a pilot program except as provided for in this Chapter and Section 19209 of the Elections Code.
The Secretary of State shall approve or reject a plan submitted pursuant to this Chapter no later than three months after receipt of the plan.
The voting system shall:
1. Meet the definition of a voting system pursuant to Section 362 of the Elections Code.
2. Use paper ballots pursuant to Section 19203 of the Elections Code.
  1. The ballot manifest;The paper ballots shall contain the official tint and watermark pursuant to Section 13002 of the Elections Code.
  2. Ballots used by this voting system must comply with Section 13004 of the Elections Code and Section 20220 of Title 2 of the California Code of Regulations.
  3. If the voting system includes a ballot on demand system component, that ballot on demand system must be a module within the voting system and comply with California Code of Regulations, Title 2, Sections 20260-20268.
3. Not include features that permit a voter to leave the polling place with a copy of the ballot pursuant to Section 19204 of the Elections Code.
4. Not include features that permit a voter to leave the polling place with a copy of the ballot pursuant to Section 19204 of the Elections Code.
5. The voting system’s hardware, software, and firmware, whether disclosed or commercial off-the-shelf, shall not be modified during the duration of the pilot program without prior written approval from the Secretary of State.

Authority: Section 19209, Elections Code. Reference: Sections 362, 13002, 13004, 19203,19204, 19205, and 19209, Elections Code; Section 20220, Title 2, California Code of Regulations.

Section 20686. Application.

An application to conduct a pilot program shall be submitted to Secretary of State by the governing board of the jurisdiction that plans to conduct the pilot program.
The application shall include the following:
1. Information regarding the request for approval,including voting technology type, application date, and system name and version.
2. Information about the applicant, including name, address, telephone number, and business address, if applicable.
3. Information about the voting system including, but not limited to, software and firmware version numbers.
4. The Pilot Program Plan, as described in Section 20687.
5. System configurations, option settings and definition parameters for all software, firmware, and hardware (including commercial off the shelf).
6. A directory listing of program, data, and support files required to install, configure, operate, and/or provide supplemental support for the voting system.
7. A description of known defects, faults or failures as defined in Elections Code section 19210, outstanding bugs, security vulnerabilities or other limitations of the system and any mitigations for each.
8. Use procedures for the voting system.
9. A detailed network diagram of what components are connected or related and how they are connected.
10. Photographs of the voting system.
11. A list of any other jurisdictions that are using or have used the exact version of the voting system being submitted.
12. A list of California jurisdictional users who are using a predecessor version of the voting system being submitted.
13. All financial relationships between the applicant and the manufacturer, distributor, or retailer of the various components comprising the voting system.
14. All the documentation necessary for the identification of the full system configuration submitted for evaluation, collectively referred to as the Technical Data Package (TDP) and as set forth in the “California Voting System Standards (October 2014),” which are hereby incorporated by reference. The TDP provides information that defines the voting system design, method of operation, and related resources. It provides a system overview and documents the system's functionality, hardware, software, security, test and verification specifications, operations procedures, maintenance procedures, and personnel deployment and training requirements.
15. A TDP main part including:
  1. Implementation Statement;
  2. System Hardware Specification;
  3. Application Logic Design and Specification;
  4. System Security Specification;
  5. System Test Specification;
  6. Configuration for Review; and
  7. Quality and Configuration Management Manual.
16. TDP user documentation including:
  1. System Overview;
  2. System Functionality Description;
  3. System Security Manual;
  4. System Operations Manual;
  5. System Maintenance Manual;
  6. Personnel Deployment and Training Requirements; and
  7. Use Procedures.
17. Any additional information the Secretary of State may request on an as-needed basis from the applicant.

Authority: Section 19209, Elections Code. Reference: Sections 19209 and 19210, Elections Code.

Section 20687. Pilot Program Plan.

The plan for the pilot program shall include the following:
1. A description of all devices that will be utilized.
2. The number of voters the voting system is expected to serve as well as the voting system’s maximum capacity and any information about what specialized segment (for example, precincts) of the voting population the voting system will serve, if any.
3. The number of each type of device that will be deployed.
4. Details on how the device(s) will be set up and deployed, including who will be doing the set up and deployment (i.e., county election officials, contractor, etc.).
5. A description, including diagrams or pictures, where each device is located.
6. The number of reserve/backup units that will be available and how they will be deployed if needed.
7. The source of ballots used by the voting system, for example ballots prepared by a certified ballot printer or ballots printed on demand by the voting system.
8. Specifications about the ballot style used on the system:
  1. Ballot type (e.g., poll ballot or VBM ballot);
  2. Ballot dimensions, including the length and width of the ballot card in inches;
  3. Ballot content, includes the printed information for a specific election required by California Elections Code Division 13; and
  4. Vendor, brand, and specifications for ballot paper being used.
9. Outline of the system’s ability to accommodate voting in all languages in which the jurisdiction is required to provide ballots under applicable state and federal laws.
10. Outline of the system’s ability to accommodate voting by persons with a broad range of physical and cognitive disabilities, as required by applicable state and federal laws.
  1. If the system will not accommodate certain disabilities, a plan for how those voters can otherwise vote in the election in compliance with applicable state and federal laws.
11. The current and projected number of voting-eligible individuals in the jurisdiction.
12. The geography and distribution of the population in the jurisdiction.
13. A description of how the risk-limiting audit requirements of Elections Code section 19209, subdivision (e) will be met.
14. If the voting system utilizes software and firmware with disclosed source code, the location of a repository where the code is publicly available.
  1. This repository shall remain publicly available for the duration of the pilot program. If its location changes, that location shall be made available to the public and the Secretary of State immediately upon such change.
  2. The jurisdiction engaging in the pilot program must designate a responsible person for repository management and make that person’s name available to the Secretary of State.
  3. If there are multiple applications or products within the source code, each shall be clearly identified.
15. Information about the ballot on demand system, if one is included as a module to the voting system, to indicate how that ballot on demand system could meet certification testing criteria in Section 20263 of Title 2 of the California Code of Regulations.
The following shall be developed and provided to the Secretary of State:
1. A method to monitor code access;
2. A method to manage code contributions;
3. A method to track code versioning; and
4. The process for reporting any defect, failure, fault, bug, and/or vulnerability in the voting system.

Authority: Section 19209, Elections Code. Reference: Section 19209, Elections Code; Section 20263 of Title 2 of the California Code of Regulations.

Section 20688. System Demonstration.

The governing board of the jurisdiction that plans to conduct the pilot program shall conduct a demonstration of the system for the Secretary of State within 30 calendar days of submitting the pilot plan at a location as agreed upon by the Secretary of State and the jurisdiction.
At the time of the demonstration the system shall be complete and ready for use by the applicant.
The demonstration shall at a minimum include:
1. System installation and configuration;
2. Election setup;
3. Ballot marking;
4. Accessibility;
5. Tabulation;
6. Post-election procedures; and
7. Any additional processes and/or procedures specific to system function deemed relevant to the Secretary of State to verify compliance with this Chapter.

Authority: Section 19209, Elections Code. Reference: Sections 19209, 19216, and 19217, Elections Code. Section 19209, Elections Code.

Section 20689. Review Procedures

The Secretary of State shall review the application, Pilot Program Plan, and other documents and materials required pursuant to this Chapter in order to evaluate the voting system.
The applicant shall make available all equipment needed to review the application and Pilot Program Plan in the manner described by the Secretary of State.
An applicant shall respond to clarifying questions from the Secretary of State regarding the pilot program or any application materials within 72 hours or as otherwise agreed by the applicant and the Secretary of State.
The Office of Voting Systems Technology Assessment of the Secretary of State's office shall maintain one working copy of each approved voting system, in its approved configuration, for a minimum of one Gubernatorial or Presidential Election cycle.

Authority: Section 19209, Elections Code. Reference: Section 19209, Elections Code.

Section 20690. Incident Notification

The governing board of the jurisdiction conducting an approved pilot program shall notify the Secretary of State of any incident, defect, failure, or fault in the voting system within 30 calendar days.
1. Incidents include, but are not limited to, issues such as paper jams, printing errors, or any defect, fault, or failure pursuant to Elections Code sections 19215 and 19290, and Title 2, California Code of Regulations, section 20161.
If the chain of custody for any component of the voting system has been compromised, the security or information has been breached or attempted to be breached, or experiences a fatal error from which it cannot recover gracefully (i.e., the error is not handled through the device’s internal error handling procedures with or without user input, such that the device must be rebooted or the device reboots itself to restore operation), the governing board of the jurisdiction conducting an approved pilot program must take the following actions:
1. Notify the chief elections official of the jurisdiction immediately.
2. Notify the Secretary of State within 24 hours of discovery;
3. Remove the equipment from service immediately and replace if possible;
4. Subject any votes cast on the device prior to its removal from service to a 1% manual tally or a risk-limiting audit, by the processes described in Elections Code sections 15360 and 15367, as part of the official canvass;
5. Secure any memory card containing data from that device and retain it for the full election retention period as described in Chapter 4 of Division 17 of the Elections Code;
6. Store an image of all device software and firmware on write-once media and retain securely for the full election retention period described in Chapter 4 of Division 17 of the Elections Code; and
7. Reinstall all device software and firmware from a read-only version of the approved firmware and software supplied directly by the Secretary of State before the equipment is placed back into service.

Authority: Section 19209, Elections Code. Reference: Sections 17300, 17301, 17302, 17303,17304, 17305, 17306, 19209, 19215, and 19290 Elections Code; Section 20161, Title 2, California Code of Regulations

Section 20691. Changes or Modifications to Approved Pilot Program.

The voting system shall not be changed or modified without prior written approval from the Secretary of State consistent with Section 19216 of the Elections Code and Title 2, California Code of Regulations, section 20707.
1. The Secretary of State shall respond to such notification within 72 hours or as otherwise agreed by the applicant and the Secretary of State.
2. The Secretary of State’s failure to respond to such notification shall not constitute approval of any change or modification.
The Secretary of State may terminate an approved plan if the jurisdiction conducting an approved pilot program fails to comply with any provision of this Chapter or Section 19209 of the Elections Code.
1. The Secretary of State shall notify the jurisdiction of its intent to terminate, and allow an opportunity to cure, 72 hours before terminating.
2. The Secretary of State may terminate an approved plan immediately and without notice if it identifies a significant risk to the conduct of the election or voter confidence in the election results.
The Secretary of State may impose conditions for use as part of the approved pilot program. If the jurisdiction conducting the pilot program fails to comply with any conditions of use:
1. The Secretary of State shall notify the jurisdiction of its intent to terminate, and allow an opportunity to cure, 72 hours before terminating.
2. The Secretary of State may terminate an approved plan immediately and without notice if it identifies a significant risk to the conduct of the election or voter confidence in the election results.
Consistent with Section 19217 of the Elections Code, the Secretary of State may seek injunctive and administrative relief as appropriate.

Authority: Section 19209, Elections Code. Reference: Sections 19209, 19216, and 19217, Elections Code.

Voting System in a Pilot Program