System Security

Voters can rest assured that Washington’s Election system is secure.

We have embarked on an unprecedented opportunity to work collaboratively with the Department of Homeland Security to ensure that our election systems remain secure. This partnership allows us to work together, elections and IT experts working hand in hand to ensure our systems are secure.

We are thrilled to partner with DHS to –

  •          Assess vulnerabilities and identify mitigation plans
  •          Share information
  •          Rely on DHS for local in person support
  •          Report incidents or threats

Some highlights of the programs already underway –

The Risk and Vulnerability Assessment (RVA) -  The RVA encompasses a wide range of security services including –

  • Penetration testing
  • Web application testing
  • Social engineering

Cyber Resilience Review (CRR) - The CRR measures and enhances the implementation of key cybersecurity capacities and capabilities of critical infrastructure and SLTT governmental entities. This is a non-technical assessment helps the assessed organization to develop an understanding of their operational resilience and ability to manage cyber risk to critical services during normal operations and times of operational stress or crisis.

This DHS partnership provides all of these services to us at no cost.

In addition, Washington employs the recommendations raised by security experts, and have done so for years. Such as –

  • Paper-based systems, including voter verifiable paper audit trails.
  • Independent testing.
  • Pre- and post-election audits.
  • Physical security of tabulation equipment.

Before a tabulation system can be used in Washington, we require testing at a federally approved independent testing lab. These expert testers include security reviews as a part of their overall testing efforts.  Then, systems are tested here at the state level and reviewed by our own voting systems certification board, comprised of technology experts, accessibility experts, and county election officials.

Counties must then perform acceptance testing and logic and accuracy testing prior to every election. In addition, we conduct post-election audits, where we draw precincts and races at random and compare the vote totals from the tabulator to a hand count of ballots before the election is certified.

Counties that optically scan ballots prior to Election Day have approved tabulation security plans in place and on file with our office. Additionally, counties maintain continuity of operations plans so that they can be ready in the event of a disruption. We are present at logic and accuracy tests where we review and ensure, both visually and through hash testing, that the equipment and software in use hasn’t changed from the version certified both federally and in Washington.

We use a paper-based system, which always allows Washington elections officials the opportunity to see first-hand the voter’s intent. We can go back to the paper ballot marked by the voter and hand count a race, particularly when the races are very close. And for the few voters who are voting on touch screen voting systems, we require a paper audit trail verified by the voter.

In addition, we work proactively and closely with IT and security experts to routinely review, identify, and correct any vulnerabilities with our technical systems.

Washington has a long-standing tradition of balancing this physical security with technical system security and providing accessible systems to our voters.

In addition to the security of our tabulation systems, Washington takes great pride in securing our other vital systems. The Voter registration Database (VRDB) and Washington Elections Information (WEI) systems are secured by highly skilled Office of the Secretary of State (OSOS) IT staff, using state of the art equipment and following IT industry best practices.

Network Based Security:

  • All elections systems are protected by state of the art Intrusion Prevention Systems (IPS) and firewalls. Only authorized Internet Protocol (IP) address are allowed access to these systems.  This access is running on a network that is only used by authorized partners and the accessible web servers are isolated on a network demilitarized zone (DMZ) with the database servers placed in another secured inside a isolated network. 

Physical Security:

  • The servers are housed in a secure single tenant modern facility with dual redundant alarms, security cameras, and FM200 protection.  Physical access to the data center is restricted to only three authorized OSOS full-time IT staff members using security proximity cards and unique keypad pin numbers.  The data center is located next door to the police station and response times for alarms average 2 to 8 minutes.

Patch Management:

  • The Quality Assurance (QA) system is patched the day after any “patches”, “hotfixes”, or “cumulative” updates are received from Microsoft.  Production (prod) servers are patched after the system updates are fully tested in QA and authorized for deployment. In most cases, the production system patched two weeks after QA to allow for testing and verification.

Security Audit:

  • Regular security scans by OSOS IT security staff are performed to test and verify the security of the firewalls, IPS, and servers.
  • Periodic 3rd party contracted security audits are performed to test and verify the security and effectiveness of the firewalls, IPS, servers, and facility.

Log Review:

  • Daily firewall logs are reviewed at least 4 times a day and weekend logs are reviewed every Monday morning. 
  • Daily system event logs are reviewed at least twice a day and weekend logs are reviewed every Monday morning.

Elections Results Site

  • The elections results are hosted in Microsoft’s Azure cloud, which provides server and geographic redundancy.
  • Results data is retrieved from a secure location provided by Washington Election Information System (WEI) at specified times (intervals).
  • Elections results data is parsed and presented to users graphically in read-only and compact web files (html) for speed and performance under heavy user access.
  • Graphic representation of the results is not connected to WEI system or network and is not dependent on it after results have been securely transmitted at aforementioned intervals.

Tabulation Systems

Before a system can be considered for state certification, it must be first tested by an independent testing authority that has been accredited by the Election Assistance Commission. There currently are three test labs (certified independent testing authorities) that are accredited by the Election Assistance Commission. NTS Huntsville,  Pro V&V, and SLI Compliance. You can find more information about those accreditations here: https://www.eac.gov/testing_and_certification/accredited_test_laboratories.aspx

All voting system testing documentation, which includes the test lab identification, can be found here: https://www.eac.gov/testing_and_certification/default.aspx. When reviewing these testing documents, keep in mind that not all of these systems are certified for use in the State of Washington.  The list of systems certified for using the State of Washington can be found here: https://www.sos.wa.gov/elections/research/Voting-System-Testing-and-Certification.aspx. A list of voting systems that are in use by county can be found here: https://www.sos.wa.gov/elections/research/Voting-Systems-by-County.aspx

No tabulation equipment is connected to the internet or capable of wireless communication. Additionally, WAC 434-261-045 requires that security measures be employed to detect any inappropriate access to protect the physical security of the system. That could include video surveillance, however, that is not required. Counties can employ multiple layers of physical security that would detect inappropriate access, for example, logs and seals.