Posts Tagged ‘State Auditor’

Answer to motion to dismiss HAVA complaint

November 27, 2019

Today (11/27/2019), I filed my answers to the arguments made by the Iowa Secretary of State (SoS) in his motion to dismiss my HAVA complaint.  As the banner on my home page indicates, I wear many hats.  I am the author of the answers, but I am not a lawyer.  My brief is functional, but it is not lawyerly.  It is 128 pages long and includes 18 exhibits.

To save you from having to scroll through 128 pages, I embedded the links to my online sources into the exhibit numbers.  If you want to see an exhibit that does not have a link, please reach out to me via the contact form.

Next steps.  The SoS has until 12/5/2019 to respond to these answers and the resistance I filed on 11/26/2019.  Unless the SoS and I decide to settle before 12/9/2019, the Voter Registration Commission, in its role as the Presiding Officer, will hold a hearing at 10am on 12/9/2019 in the SoS conference room on the 1st Floor of the Lucas State Office Building on the Capitol Complex.  The hearing will be open to the public.

In the meantime, feel free to use the contact form to reach me.  Happy Thanksgiving!  Joel D. Miller – Linn County Auditor

 

Resistance to motion to dismiss HAVA complaint

November 26, 2019

On 8/12/2019, I filed a HAVA complaint on the Iowa Secretary of State.

Today, 11/26/2019, I filed part one of my Resistance to the Secretary of State’s Motion to Dismiss my HAVA complaint.

Tomorrow, 11/27/2019, I will file part two of my resistance, i.e., an additional complementary, stand-alone document containing detailed answers to the Arguments in the Motion to Dismiss.

If you are a legal geek, you may find today’s filing interesting.  If you are an elections or cybersecurity geek, then save your reading for tomorrow.  Joel D. Miller – Linn County Auditor

Secretary Pate files motion to dismiss HAVA complaint

November 13, 2019

As expected, the assistant attorney general representing the Office of Iowa Secretary of State Paul D. Pate filed a motion to dismiss my HAVA complaint. Assuming my complaint is not resolved in the next few days, I will be filing a response to the motion to dismiss, which I will post on this blog. Joel D. Miller – Linn County Auditor & Commissioner of Elections

 

VRC to discuss how-to-proceed on HAVA complaint

October 25, 2019

The Iowa Voter Registration Commission (VRC) will take up my HAVA complaint at its 10am meeting next Wednesday. Details of the meeting are at VR Agenda 10-30-2019.pdf

Here are some events that have occurred since I filed the HAVA complaint on 7/17/2019:

7/19/2019 – Iowa Secretary of State’s Office (SoS) confirms to Associated Press that Iowa’s 14-year-old voter registration system (IVoters) will not be upgraded prior to the 2020 Presidential Election.

7/20/2019 – Published “HAVA complaint filed on Iowa Secretary of State” on this blog.

7/22/2019 – SoS responds to Linn County Auditor’s (LCA) public records request (PRR) seeking correspondence on IVoters development from 1/1/2018 to the present by providing one email from 12/26/2017, and nothing for all of 2018 or 2019. SoS indicates all other records are considered confidential (secret) under Iowa law.

7/22/2019 – Published “Feds trust Pate. Why doesn’t he trust us?” on this blog.

7/26/2019 – LCA requests Auditor of State (AoS) investigate SoS’s usage of $1.05M in FY2019 State funds and $4.8M in Federal funds to determine if the funds have been spent on IVoters upgrades, enhancements, replacement, or security; and to determine how those expenditures benefitted taxpayers.

7/31/2019 – Published “I-Voters: Anyone looking for APTs?” on this blog.

8/1/2019 – Emailed SoS asking for the names of the county auditors assigned to the Cybersecurity Working Group touted by Secretary Pate in a 5/4/2018 press release. To date, no response from the SoS.

8/5/2019 – Published “Saying I-Voters is secure isn’t enough” on this blog.

8/9-11/2019 – LCA and Johnson County Auditor attend DEFCON Hacking Conference in Las Vegas. While there, both host a discussion group on Iowa’s voting system with ethical hackers.

8/12/2019 – Des Moines Register publishes story on my HAVA complaint and my concern that IVoters is vulnerable to hackers. SoS calls me “willfully ignorant”.

8/19/2019 – Director of Elections for SoS “accepts” HAVA complaint and notifies VRC (the presiding officer) of the Administrative Rules requirement that a schedule be established to resolve the complaint.

8/23/2019 – Secretary Pate and others attend a statewide county auditors conference in Des Moines. Pate says he came up with the $7M proposal to replace IVoters by “calling around to other states” to see what they spent to replace their voter registration systems. SoS confirms IVoters will not be upgraded prior to 2020 Presidential Election, and further indicates that no RFI (requests for information) or RFP (requests for proposals) have been issued to replace IVoters.

10/3/2019 – LCA sends PRR to SoS requesting a copy of all contracts related to IVoters since its inception through 12/31/2020.

10/18/2019 – Published “Where are your voter records stored?” on this blog.

10/22/2019 – Assistant Attorney General representing SoS indicates SoS is working on my 10/3 PRR, and they may require longer than 20 days to complete it.

10/22/2019 – Published “Iowa’s voter registration system not designed for today’s technological challenges” on this blog.

10/23/2019 – LCA sends PRR to VRC requesting documents related to IVoters status, updates, and revamp; and provides samples of VRC records containing those items.

10/24/2019 – LCA sends request for information to AoS to answer the question: How can a vendor perform work for the SoS and store voter registration records without being paid by the State?

10/30/2019 – VRC holds meeting on HAVA complaint and other topics.

By Joel D. Miller – Linn County Auditor & Commissioner of Elections

 

Where are your voter records stored?

October 18, 2019

Iowa law says county commissioners of elections are responsible for the maintenance and storage of all voter registration (VR) records and it also prohibits counties from operating VR systems separate from the Iowa Secretary of State’s (SoS) VR system.

So where are your voter records stored?

You may recall that I filed a HAVA complaint on the SoS?

In doing research for the complaint, I reviewed documentation related to the SoS winning a national award for election cybersecurity.  Specifically, I noticed two references to Arikkan, Inc – see pages 3 and 10, respectively:

In 2017, the decision was made to partner with our IVoters vendor, Arikkan, Inc. to move the statewide voter registration system to a new, privately-hosted, Criminal Justice Information Service (CJIS) compliant data center. This move transferred the system to new hardware, which offered many improvements, including next-generation intrusion detection systems. Programming changes were made for more secure access, and stronger defenses were put in place to protect personal identifiable information.
Spring 2017: The Secretary of State and Arikkan, Inc. partner to move the State Voter Registration Database (IVoters) to a new privately-hosted, CIS-compliant data center. This move transfers the system to new hardware, which offers many improvements, including next generation Intrusion Protection Systems. This also eliminates the need to replace the Iowa Secretary of State’s current infrastructure, which would have cost more than $1 million.

IVoters is the name of Iowa’s statewide voter registration system, i.e., the system all county commissioners of election are required to use.  Per the SoS, Arikkan is our IVoters “vendor” and a “partner” of the SoS.  When you search for Arikkan, you will find that it provides hosting services.

When you search the State’s checkbook for a vendor named Arikkan, you will find that the State of Iowa has never written a check to Arikkan; yet, the SoS states that Arikkan is a “partner” and a “vendor”.

I am certain there is an explanation for the preceding, but when you search for Arikkan, Arrikan, or Arrikkan on the SoS’s Business Entities Search, you also come up empty handed.

On 10/7/2019, the SoS received a public records request from me seeking information on Arikkan, Inc., as well as, other vendors related to IVoters.  I have yet to receive a response from the SoS.

So where are your voter records stored?  I do not know; and I have a right to know.  I am the custodian of those records.  –Joel D. Miller – Linn County Auditor & Commissioner of Elections

Additional references to Arikkan by the SoS (updated 10/22/2019):
Primary Election Voters, Eighteen Year Olds at General Election
Secretary of State Annual Report 2015
Secretary of State Presentation, 3/1/2018

Saying I-Voters is secure isn’t enough

August 5, 2019

Reprinted from the print edition of The Gazette 8/4/2019

I am writing in response to Iowa Secretary of State Paul Pate’s July 30 guest column ‘A model for election security.’ And my purpose is to explain I-Voters and why you should be concerned about it.

I-Voters is our statewide voter registration system. It is a computer system maintained and operated by the Secretary of State’s Office. Voter registration records for more than 2 million voters now are stored in I-Voters.

Every county is required to store its voter registration records on IVoters and every county is required to pay the secretary of state an annual fee to maintain I-Voters. Normally, when you pay someone a fee, you are entitled to know what you are getting in return. That is not the case with I-Voters.

I-Voters went into service in Iowa in 2006. Cybersecurity did not become a hot topic until 2016 – 10 years later. Although I-Voters is running on newer hardware than it did in 2006, that just means the old software, including its flaws, is running faster – not more securely. Let me explain one flaw, which others view as a feature.

Imagine you show up to vote on Election Day and your name is not on the election register. You swear you voted at your precinct in the last election. Heck, you swear you voted in this precinct for the past 30 years. Some of the precinct officials know you and cannot explain why you are not listed on the election register. Yes, you still can vote. Unfortunately, you have to go through the Election Day registration process to register before you can vote.

That takes time and requires proof of who you are and where you reside. What if you don’t have time? Or proof? Now multiply this scenario by ten thousand voters across the state.

How could your name disappear from the election register? One feature of I-Voters is that it allows an election employee – an I-Voters user – in one county to pull your voter registration record from the losing county to the gaining county; e.g., when you relocate from Cedar Rapids to Iowa City.

One flaw of I-Voters is that one employee – not two employees – can pull your voter registration record from Cedar Rapids to Iowa City; i.e., from Linn County to Johnson County. What used to be a ‘feature’ before the age of cyberwarfare now is a ‘flaw.’ I do not know how many other flaws I-Voters has, but that is the one that keeps me awake at night.

When you pay someone a fee, you are entitled to know what you are getting in return. Unfortunately, I do not know what Pate is doing with the millions of dollars he has received to upgrade I-Voters. I thought I-Voters would be upgraded before the 2020 presidential election. On July 19, the Associated Press reported it would not be upgraded until after 2020.

I-Voters is the Achilles’ heel of elections in Iowa. Maliciously remove or relocate a thousand voter registration records in the system just before Election Day, and chaos will ensue.

Time is of the essence, Mr. Secretary.

Telling Iowa’s voters, taxpayers, and county auditors that I-Voters is ‘secure’ is not enough. County auditors do not know what is going on with I-Voters, and they are entitled to know.

I request that you hire a third party, independent cybersecurity firm to assess I-Voters and determine if it is ready for the 2020 elections. In addition, let me and my fellow county auditors on your Auditors’ Advisory Panel observe the assessment, see the results, and monitor the fixes. Nothing is more important.

 Joel Miller is Linn County auditor.

HAVA complaint filed on Iowa Secretary of State

July 20, 2019

When have you ever paid over $200,000 for something and did not know what you were receiving in return? That is the amount Linn County taxpayers have paid to the Iowa Secretary of State for I-Voters Maintenance Fees since 2010. And my office just received a bill for another $29,000 for the current fiscal year.

The reason for this complaint is simple. I and my fellow Iowa county auditors have been told for years that Iowa’s voter registration system, i.e., I-Voters, is secure. Yet, over the years we have received little factual information that allows us to draw the conclusion that I-Voters is secure.

On February 11, 2015, Secretary of State Paul Pate named me to his Auditors’ Advisory Group, a bi-partisan group of county auditors. I said then, “I appreciate Secretary Pate reaching out to me to gather input regarding elections, I look forward to working with him over the next few years to come up with solutions that make sense for Iowa.” The Advisory Group has not been convened by the Secretary in over two years.

Some of my peers have advised me to not talk about our voter registration system, fearing the public will misinterpret the talk. How can I assure the voters of Linn County that I-Voters and their voter registration records are secure when I do not know what is going on with it?

For example, has I-Voters been subjected to a cyber security vulnerability assessment? Or a penetration test? And were the tests performed by third party, ethical hackers who are committed to ensuring the system is secure for the next election? And why did the Secretary’s staff cutoff Linn County’s access to I-Voters after I announced I was going to conduct a vulnerability assessment on the election systems physically residing in Linn County.

I don’t know what I don’t know. And I am not going to be “high” on something that I have been kept “in the dark on”, i.e., I-Voters.

I am doing everything I can to keep the elections systems that I am responsible for secure from bad actors. I am a former IT director and a technology project manager, and the current commissioner of elections, and I need to hear more from the Secretary than the words “trust me”.

Again, the reason for this complaint is simple. I do not know what is going on with I-Voters and I need to know, and I am entitled to know.

Joel D. Miller
Linn County Auditor & Commissioner of Elections

REFERENCES:

Pate names Miller to Auditors’ Advisory Group https://sos.iowa.gov/news/2015_02_11.html

Iowa will keep voter registration system for 2020 elections https://www.timesunion.com/news/article/Iowa-will-keep-voter-registration-system-for-2020-14108004.php

HAVA Complaint Letter 7.16.19.pdf
HAVA complaint 7.17.19.pdf
Public Information Request 7.1.19.pdf


%d bloggers like this: