Archive for the ‘Voter data’ Category

HAVA complaints, every commissioner’s duty

December 9, 2019

Some people may think I filed a HAVA complaint on the Iowa Secretary of State (SoS) for partisan reasons.  Some may think I am just seeking publicity.  You will think what you want, but I will tell you that I have a duty.

I have a duty under Iowa Administrative Code (IAC) Chapter 721-29 to report possible cybersecurity incidents I have identified, which could potentially jeopardize “the confidentiality, integrity, or availability of an information system (e.g., IVoters) or the information (e.g., your voter registration records) the system processes, stores, or transmits ….”  In Iowa, the IAC carries the same force of law as statutes.

The Help America Vote Act (HAVA) of 2002 is Federal law and says a complaint can be filed for a violation that has occurred, is occurring, or is about to occur in connection with a federal election (e.g., the upcoming 2020 primary and general elections).

Federal law says that any person can file a HAVA complaint.  The State of Iowa says county commissioners have a duty to report anything that could jeopardize IVoters.  It is as simple as that, except I want the items I have identified in my HAVA complaint addressed/fixed before the June 2020 primary election.  And you should, too.  Joel D. Miller – Linn County Auditor (LCA)

Latest legal filings re HAVA complaint:

Final Motion to Dismiss by SoS; and

Final Reply to the Motion to Dismiss by LCA.

News coverage of HAVA complaint

December 5, 2019
In anticipation of the Iowa Voter Registration Commission holding a hearing to determine whether to dismiss or proceed on my HAVA complaint – see previous posts – I compiled a listing of the news coverage on this topic. 
PLEASE NOTE:  At 3:15pm on 12/5/2019, I received an email indicating a family member of one of the commissioners passed away this afternoon; therefore, the hearing will likely be postponed to a later date in December.
Please contact me if you have any questions.  Joel D. Miller – Linn County Auditor & Commissioner of Elections
Des Moines Register – 11/24/2019 – Iowa’s 2012 election problem a window into ongoing voter dysfunction, county auditor contends
The Gazette – 10/30/2019 – State hearing set for Linn County auditor’s complaint
KFI AM 640 – 10/23/2019 – Is Iowa’s aging “I-Voter” system vulnerable against 2020 attacks?
KCRG – 10/22/2019 – Preventing election attacks paramount for state in 2020, but some want better assurance of security
Government Technology – 10/22/2019 – Linn County Auditor Raises Concern About State Voter System
The Gazette – 8/22/2019 – Linn County Auditor Joel Miller concerned about security of voter registration database
The Advocate – 8/12/2019 – At Def Con, hackers and lawmakers came together to tackle holes in election security
Des Moines Register – 8/12/2019 – Iowa election system prone to hacks, Iowa auditor alleges in complaint. Secretary of State’s office calls complaints ‘ignorant.’
The Gazette – 8/3/2019 – Miller: Saying I-Voters is secure is not enough
The Gazette – 7/29/2019 – Pate: Iowa offers a model for election security
KGAN TV – 7/22/2019 –  Linn County auditor considers legal action against state over voter security
Siouxland News – 7/21/2019 – Iowa will keep voter registration system for 2020 elections
Associated Press – 7/19/2019 – Iowa will keep voter registration system for 2020 elections

 

Answer to motion to dismiss HAVA complaint

November 27, 2019

Today (11/27/2019), I filed my answers to the arguments made by the Iowa Secretary of State (SoS) in his motion to dismiss my HAVA complaint.  As the banner on my home page indicates, I wear many hats.  I am the author of the answers, but I am not a lawyer.  My brief is functional, but it is not lawyerly.  It is 128 pages long and includes 18 exhibits.

To save you from having to scroll through 128 pages, I embedded the links to my online sources into the exhibit numbers.  If you want to see an exhibit that does not have a link, please reach out to me via the contact form.

Next steps.  The SoS has until 12/5/2019 to respond to these answers and the resistance I filed on 11/26/2019.  Unless the SoS and I decide to settle before 12/9/2019, the Voter Registration Commission, in its role as the Presiding Officer, will hold a hearing at 10am on 12/9/2019 in the SoS conference room on the 1st Floor of the Lucas State Office Building on the Capitol Complex.  The hearing will be open to the public.

In the meantime, feel free to use the contact form to reach me.  Happy Thanksgiving!  Joel D. Miller – Linn County Auditor

 

Resistance to motion to dismiss HAVA complaint

November 26, 2019

On 8/12/2019, I filed a HAVA complaint on the Iowa Secretary of State.

Today, 11/26/2019, I filed part one of my Resistance to the Secretary of State’s Motion to Dismiss my HAVA complaint.

Tomorrow, 11/27/2019, I will file part two of my resistance, i.e., an additional complementary, stand-alone document containing detailed answers to the Arguments in the Motion to Dismiss.

If you are a legal geek, you may find today’s filing interesting.  If you are an elections or cybersecurity geek, then save your reading for tomorrow.  Joel D. Miller – Linn County Auditor

Secretary Pate files motion to dismiss HAVA complaint

November 13, 2019

As expected, the assistant attorney general representing the Office of Iowa Secretary of State Paul D. Pate filed a motion to dismiss my HAVA complaint. Assuming my complaint is not resolved in the next few days, I will be filing a response to the motion to dismiss, which I will post on this blog. Joel D. Miller – Linn County Auditor & Commissioner of Elections

 

IVoters felon list still disenfranchising citizens

October 28, 2019

Recently, Linn County Election Services (LCES) had a phone call from a citizen who received a “Canceled – Convicted Felon Letter” after registering to vote at an Iowa DOT drivers’ license station. Here is a summary of the events that occurred to get her records corrected:

The citizen said she had never been convicted of a felony, although she had been charged.

LCES searched the Felon List within I-Voters and it showed an “N” for “No” in the “Restored/Corrected” field, which meant she was a felon.

LCES gave the citizen the case number and conviction date listed in her I-Voters record.

The citizen said she would contact the clerk of court.

A few hours later, LCES got a call from the Iowa Secretary of State’s Office indicating the citizen’s record had been corrected and LCES should make her an Active voter.

LCES double-checked IVoters and it did indeed show a “C” for “Corrected” in the “Restored/Corrected” column.

LCES made the citizen/voter Active and initiated the process to issue her a Voter Acknowledgement Card.

According to a 9/24/2019 story in the Des Moines Register, “More than 2600 people have been found to have been erroneously listed on the state’s felon list since 2016”.

Chapter 721 of the Code of Iowa states: Any public officer/employee who “… knowingly delivers a falsified writing, with the knowledge that the writing is falsified and that the writing will become a public record of a government body” commits a crime.

Regarding the Felon List, as long ago as 4/15/2015, the Director of Elections for the Iowa Secretary of State, “…noted that the quality of information that has been received from the local clerk’s offices in the past is not reliable ….”

One of the arguments for Iowa passing Voter ID was: If the new Voter ID law keeps even one ineligible voter from voting, then we should pass it. Using that logic, if the current Felon List disenfranchises even one eligible voter, then the Felon List should be abandoned and NOT used by the State’s election officials. Maybe someone should file an injunction prohibiting the use of the Felon List within IVoters? Joel D. Miller – Linn County Auditor

VRC to discuss how-to-proceed on HAVA complaint

October 25, 2019

The Iowa Voter Registration Commission (VRC) will take up my HAVA complaint at its 10am meeting next Wednesday. Details of the meeting are at VR Agenda 10-30-2019.pdf

Here are some events that have occurred since I filed the HAVA complaint on 7/17/2019:

7/19/2019 – Iowa Secretary of State’s Office (SoS) confirms to Associated Press that Iowa’s 14-year-old voter registration system (IVoters) will not be upgraded prior to the 2020 Presidential Election.

7/20/2019 – Published “HAVA complaint filed on Iowa Secretary of State” on this blog.

7/22/2019 – SoS responds to Linn County Auditor’s (LCA) public records request (PRR) seeking correspondence on IVoters development from 1/1/2018 to the present by providing one email from 12/26/2017, and nothing for all of 2018 or 2019. SoS indicates all other records are considered confidential (secret) under Iowa law.

7/22/2019 – Published “Feds trust Pate. Why doesn’t he trust us?” on this blog.

7/26/2019 – LCA requests Auditor of State (AoS) investigate SoS’s usage of $1.05M in FY2019 State funds and $4.8M in Federal funds to determine if the funds have been spent on IVoters upgrades, enhancements, replacement, or security; and to determine how those expenditures benefitted taxpayers.

7/31/2019 – Published “I-Voters: Anyone looking for APTs?” on this blog.

8/1/2019 – Emailed SoS asking for the names of the county auditors assigned to the Cybersecurity Working Group touted by Secretary Pate in a 5/4/2018 press release. To date, no response from the SoS.

8/5/2019 – Published “Saying I-Voters is secure isn’t enough” on this blog.

8/9-11/2019 – LCA and Johnson County Auditor attend DEFCON Hacking Conference in Las Vegas. While there, both host a discussion group on Iowa’s voting system with ethical hackers.

8/12/2019 – Des Moines Register publishes story on my HAVA complaint and my concern that IVoters is vulnerable to hackers. SoS calls me “willfully ignorant”.

8/19/2019 – Director of Elections for SoS “accepts” HAVA complaint and notifies VRC (the presiding officer) of the Administrative Rules requirement that a schedule be established to resolve the complaint.

8/23/2019 – Secretary Pate and others attend a statewide county auditors conference in Des Moines. Pate says he came up with the $7M proposal to replace IVoters by “calling around to other states” to see what they spent to replace their voter registration systems. SoS confirms IVoters will not be upgraded prior to 2020 Presidential Election, and further indicates that no RFI (requests for information) or RFP (requests for proposals) have been issued to replace IVoters.

10/3/2019 – LCA sends PRR to SoS requesting a copy of all contracts related to IVoters since its inception through 12/31/2020.

10/18/2019 – Published “Where are your voter records stored?” on this blog.

10/22/2019 – Assistant Attorney General representing SoS indicates SoS is working on my 10/3 PRR, and they may require longer than 20 days to complete it.

10/22/2019 – Published “Iowa’s voter registration system not designed for today’s technological challenges” on this blog.

10/23/2019 – LCA sends PRR to VRC requesting documents related to IVoters status, updates, and revamp; and provides samples of VRC records containing those items.

10/24/2019 – LCA sends request for information to AoS to answer the question: How can a vendor perform work for the SoS and store voter registration records without being paid by the State?

10/30/2019 – VRC holds meeting on HAVA complaint and other topics.

By Joel D. Miller – Linn County Auditor & Commissioner of Elections

 

Iowa’s voter registration system not designed for today’s technological challenges

October 22, 2019

“The system was built in 2005 and was not designed for today’s technological challenges, including cybersecurity.” 

“… technological advancements are needed to ensure the integrity of our election systems.”

“The system simply was not built for our evolving election methods.”

You write that when you ask for $7,350,000 from legislators.

Source:  An executive summary from the Iowa Secretary of State.

“You might have recently read that I-Voters will not be replaced before the 2020 elections. Replacing the system is a multiyear, multimillion-dollar project and remains on-schedule. It is not something that can or should be rushed into blindly.”

You write that when you did not do your job by replacing I-Voters prior to the 2020 Presidential Election.

Source: Iowa Secretary of State Paul Pate in The Gazette on 7/29/2019

Is I-Voters secure?  Maybe we will learn the answer during my upcoming HAVA complaint hearing.  Joel D. Miller – Linn County Auditor & Commissioner of Elections #trustnverifyivoters

Where are your voter records stored?

October 18, 2019

Iowa law says county commissioners of elections are responsible for the maintenance and storage of all voter registration (VR) records and it also prohibits counties from operating VR systems separate from the Iowa Secretary of State’s (SoS) VR system.

So where are your voter records stored?

You may recall that I filed a HAVA complaint on the SoS?

In doing research for the complaint, I reviewed documentation related to the SoS winning a national award for election cybersecurity.  Specifically, I noticed two references to Arikkan, Inc – see pages 3 and 10, respectively:

In 2017, the decision was made to partner with our IVoters vendor, Arikkan, Inc. to move the statewide voter registration system to a new, privately-hosted, Criminal Justice Information Service (CJIS) compliant data center. This move transferred the system to new hardware, which offered many improvements, including next-generation intrusion detection systems. Programming changes were made for more secure access, and stronger defenses were put in place to protect personal identifiable information.
Spring 2017: The Secretary of State and Arikkan, Inc. partner to move the State Voter Registration Database (IVoters) to a new privately-hosted, CIS-compliant data center. This move transfers the system to new hardware, which offers many improvements, including next generation Intrusion Protection Systems. This also eliminates the need to replace the Iowa Secretary of State’s current infrastructure, which would have cost more than $1 million.

IVoters is the name of Iowa’s statewide voter registration system, i.e., the system all county commissioners of election are required to use.  Per the SoS, Arikkan is our IVoters “vendor” and a “partner” of the SoS.  When you search for Arikkan, you will find that it provides hosting services.

When you search the State’s checkbook for a vendor named Arikkan, you will find that the State of Iowa has never written a check to Arikkan; yet, the SoS states that Arikkan is a “partner” and a “vendor”.

I am certain there is an explanation for the preceding, but when you search for Arikkan, Arrikan, or Arrikkan on the SoS’s Business Entities Search, you also come up empty handed.

On 10/7/2019, the SoS received a public records request from me seeking information on Arikkan, Inc., as well as, other vendors related to IVoters.  I have yet to receive a response from the SoS.

So where are your voter records stored?  I do not know; and I have a right to know.  I am the custodian of those records.  –Joel D. Miller – Linn County Auditor & Commissioner of Elections

Additional references to Arikkan by the SoS (updated 10/22/2019):
Primary Election Voters, Eighteen Year Olds at General Election
Secretary of State Annual Report 2015
Secretary of State Presentation, 3/1/2018

I-Voters: Anyone looking for APTs?

July 31, 2019

I-Voters is the name of our statewide voter registration system. It is a computer system maintained and operated by the Iowa Secretary of State’s (SoS) Office. Currently, the voter registration records for over two million voters are stored in I-Voters.

I-Voters went into service in Iowa in 2006 and every county is required to store its voter registration records on I-Voters, and every county is required to pay the SoS an annual fee to maintain I-Voters. Normally, when you pay someone a fee, you are entitled to know what you are getting in return. That is not the case with I-Voters. Iowa’s county auditors are not privy to any inside information on I-Voters or if I-Voters was the target of hackers or if a county election system was a target of hackers.

I reviewed the two SoS provided lists below and highlighted the items which mention I-Voters or voter registration. I applaud the SoS, the OCIO, and DHS for building a huge firewall around I-Voters, but what about the backdoors built-in the I-Voters over the last 13 years? What about the flaws in the software code used to create I-Voters? What about advanced persistent threats (APTs)? What about discontent or compromised contractors/employees with access to the code in I-Voters?

Which of the activities below are aimed at identifying the backdoors, detecting inherent flaws in the software application, detecting APTs, and/or vetting the contractors/employees with access to I-Voters? Your comments are welcome! – Joel D. Miller – Linn County Auditor

List of Activities to Occur Before or During the 2018 General Election Cycle according to attached IA Narrative Budget authored by the Legal Counsel for the SoS on 3/23/2018

• Partnership with DHS on the “Last Mile Project,” to provide security posters for each of Iowa’s 99 counties

• DHS assessments, including Risk and Vulnerability, Cyber Resilience Review, External Dependency Management, Infrastructure Survey, and Phishing Campaign

• Joined DHS Information Network

• Preform weekly vulnerability scan

• Upgrades to firewalls protecting internal network

• Joined the Electronic Registration Information Center, Inc. (ERIC) and will be sending out an Unregistered But Eligible (UBE) mailing by October 1, 2018

• Develop and implement county level incident response plans

• 2 table tops session were held in partnership with DHS for County Auditors, elections staff and county IT professionals

• Create and distribute Curbside Voting Signs to counties for use at polling locations

• Requiring “Securing the Human,” an online cybersecurity training program, to county level staff in partnership with the Iowa Office of the Chief Information Officer (OCIO)

• Cybersecurity training opportunities for Secretary of State staff, County Auditors, elections staff, and county IT professionals through conferences at NASED, The Election Center, and The National Election Security Summit

• The Iowa Secretary of State’s Office hosted two Cybersecurity Workshops for County Auditors, elections staff and county IT professionals to promote free services offered by the OCIO, DHS, and other state and federal partners

• Post-election audits will be conducted following the General Election

• Upgrades to Election Night Reporting system, including increased cybersecurity protections such as two-factor authentication

• Hiring an Information Security Officer and Cyber Navigator

• Partnering with OCIO to offer all interested counties malware protection and an intrusion detection system

• Development of training tools for County Auditors, elections staff and precinct election officials

• Development of communications aimed at reassuring the public confidence in the integrity and security of Iowa’s elections

• Development of communications aimed at educating and encouraging voters with disabilities to vote, including veterans with disabilities

• Creation of a Cyber Working Group with local, state and federal partners

The following list of security measures have been implemented to the voter registration system according to a CBS2/Fox28 news story on 7/22/2019:

-Mandatory two-factor authentication for anyone who accesses I-Voters

-Mandatory cybersecurity training for all SOS staff and all elections staff in all 99 counties

-Constant monitoring of voter registration additions and changes, with weekly reports that detect any irregularities (Note: As of 7/31/2019, I have yet to see a weekly report from the SoS)

-Upgraded firewalls and cybersecurity protection

-Upgraded Election Night Reporting system with increased cybersecurity protections

-Required that e-poll books be encrypted

-U.S. Department of Homeland Security (DHS) has conducted several assessments on state and county systems

-DHS runs a weekly vulnerability scan.

-Iowa’s Office of the Chief Information Officer runs a separate weekly scan.

-Placed an Albert Sensor on the state’s voter registration system (I-Voters)

-Housed I-Voters in a secure, off-site location

-Held table top exercises with the Iowa National Guard, state agencies and county auditors

-Hosted several cybersecurity trainings for county auditors and county IT staff

-Partnered with DHS to create a pilot program on a self-assessment cybersecurity tool

-Developed and distributed the first of its kind, personalized cybersecurity posters to every county, a model DHS has replicated in dozens of states

-Developed training tools for county auditors, their staff and precinct election officials related to cybersecurity

-Partnered with the OCIO to have their Security Operations Center monitor networks on Election Day

-Worked with the Iowa Homeland Security and Emergency Management Department to opened their Emergency Operations Center that was staffed by multiple state agency representatives to facilitate Election Day communication

-Coordinated with OCIO, Iowa HSEMD, Iowa Public Safety, DHS, FBI, county auditors and IT department to staff the Department of Public Safety’s Fusion Center on Election Day

-Implemented the first statewide post-election audits in Iowa history

#trustnverifyivoters

IA_Narrative_Budget.pdf


%d bloggers like this: