ARC 3319C

ARC 3319C

SECRETARY OF STATE[721]

Notice of Intended Action

Twenty-five interested persons, a governmental subdivision, an agency or association of 25 or more persons may demand an oral presentation hereon as provided in Iowa Code section 17A.4(1)"b."

Notice is also given to the public that the Administrative Rules Review Committee may, on its own motion or on written request by any individual or group, review this proposed action under section 17A.8(6) at a regular or special meeting where the public or interested persons may be heard.

Pursuant to the authority of Iowa Code sections 17A.3 and 17A.4 and 2017 Iowa Acts, House File 516, section 37, the Secretary of State hereby gives Notice of Intended Action to amend Chapter 22, "Voting Systems," Iowa Administrative Code.

These amendments are necessary because the General Assembly has enacted 2017 Iowa Acts, House File 516. The Secretary of State has determined that as a result of this newly enacted law, the proposed amendments are necessary to keep the administrative rules in compliance with the Iowa Code. 2017 Iowa Acts, House File 516, section 37, creates a revolving loan fund to help counties with the purchase of electronic poll books, creating the need to update Chapter 22. Additionally, the amendments propose new rules governing e-poll book technological and operational requirements.

Any interested person may make written suggestions or comments on the proposed amendments on or before October 17, 2017. Written suggestions or comments should be directed to Eric R. Gookin, Election Administrator, Office of the Secretary of State, First Floor, Lucas State Office Building, Des Moines, Iowa 50319.

Persons who want to convey their views orally should contact the Secretary of State's office by telephone at (515)281-0145 or in person at the Secretary of State's office on the first floor of the Lucas State Office Building.

After analysis and review of this rule making, no impact on jobs has been found.

These amendments are intended to implement 2017 Iowa Acts, House File 516, section 37.

The following amendments are proposed.

Item 1. Amend 721—Chapter 22, title, as follows:

VOTING SYSTEMS AND ELECTRONIC POLL BOOKS

Item 2. Amend rule 721—22.1(52), definition of "De minimis change," as follows:

"De minimis change" means a change to a certified voting system's hardware, software, technical data package (TDP), or data, the nature of which will not materially alter the system's reliability, functionality, capability, security and or operation. In order for a change to qualify as a de minimis change, it must not alter the reliability, functionality, capability, security and operability of the system. A de minimis change shall also ensure that when the hardware is replaced, the original hardware and the replacement hardware are electronically and mechanically interchangeable and have identical functionality and tolerances. A Under no circumstances shall a change shall not be considered de minimis if it has reasonable and identifiable potential to affect impact the system's operation performance and compliance with the applicable voting system standards standard.

Item 3. Adopt the following new definitions of "Electronic ballot marking device" and "Electronic poll book" in rule 721—22.1(52):

"Electronic ballot marking device" means a component of an optical scan voting system designed to assist voters with disabilities by displaying audio and visual ballot information to the voter, providing accessible methods for the voter to make selections, and then printing the voter's choices on an optical scan ballot.

"Electronic poll book," "epollbook,""e-poll book," or "electronic register" means hardware and software components used to verify and process voting activity and changes in voter registration and to check in voters. This definition includes e-poll books in use in the commissioner's office. However, this definition does not apply to the I-Voters statewide voter registration database.

Item 4. Reserve rules 721—22.501 to 721—22.599.

Item 5. Adopt the following new rule 721—22.600(47) and heading:

e-poll books

721—22.600(47) Revolving loan fund. The purpose of this rule is to establish an e-poll book and polling place modernization panel to review applications submitted to the state commissioner for distribution of moneys from the revolving loan fund created by 2017 Iowa Acts, House File 516, section 37, to be codified at Iowa Code section 47.11.

22.600(1) Definitions.

"E-poll book" is as defined in rule 721—22.1(52).

"Vendor," for purposes of this rule, means a person or representative of a person developing, offering, or supporting an e-poll book.

22.600(2) In order to ensure that the public funds in this rule are used responsibly and efficiently, this rule creates a panel consisting of designees of the state commissioner of elections, the state auditor, and the director of the department of management. Attendance by two of the three members constitutes a quorum.

22.600(3) The state commissioner shall convene the panel whenever necessary to review loan applications received from county commissioners requesting moneys from the fund.

22.600(4) The state commissioner may convene the panel to review proposed expenditures for updating technology standards for elections. If the state commissioner determines that there is an urgent need that an expenditure of moneys from the fund be used to update technology standards, the state commissioner may spend the moneys without convening the panel. In such instance, the state commissioner shall report that expenditure at the next meeting of the panel.

22.600(5) The panel shall create guidelines for loaning moneys from the fund to county commissioners for the updating of polling place technology. The guidelines shall be published on the state commissioner's Web site.

22.600(6) Before distributing or loaning funds, the panel shall consider the published guidelines, but may take additional factors into consideration. The panel shall not waive any information technology security standards, but may waive other requirements. A majority vote of the panel members present is sufficient to approve funding.

22.600(7) Before any funds from the revolving loan fund are provided for the acquisition of e-poll books, the e-poll book system shall conform to the security requirements within this chapter.

This rule is intended to implement 2017 Iowa Acts, House File 516, section 37.

Item 6. Adopt the following new rule 721—22.601(47):

721—22.601(52) Operational features of e-poll books.

22.601(1) Definitions.

"E-poll book" is as defined in rule 721—22.1(52).

"Vendor," for purposes of this rule, means a person or representative of a person developing, offering, or supporting an e-poll book.

22.601(2) Operational features. When assessing applications for funding from the revolving loan fund established by 2017 Iowa Acts, House File 516, section 37, as implemented in rule 721—22.600(47), the e-poll book and polling place modernization panel shall consider whether the e-poll book sought includes the operational features described in this subrule. Commissioners using only county funds for the purchase of e-poll book systems are not subject to the operational features described below, but are subject to all of the security requirements set forth in rule 721—22.602(47). The panel shall consider:

a. Whether the e-poll book is able to accept a secure data file that imports voter registration data into the e-poll book application from the statewide voter registration system. This requirement may not be waived by the panel.

b. Whether the e-poll book is able to securely export data files that can be imported into the statewide voter registration system, including a file to update the voter activity portion of the statewide voter registration system.

c. Whether the e-poll book is able to scan the barcodes of driver's licenses, DOT-issued nonoperator identification cards, and the voter identification card issued pursuant to 2017 Iowa Acts, House File 516, section 18, to be codified at Iowa Code section 48A.10A.

d. Whether the e-poll book is able to verify the voter against the felon database.

e. Whether the e-poll book is able to process, record, and export the complete range of possible voter registration updates available to voters under Iowa law. The state commissioner shall maintain a form that lists the possible updates that are required by this subrule.

f. Whether the e-poll book is able to complete and print the following forms:

(1)State of Iowa Official Voter Registration Form.

(2)Election Day Voter Registration Form, including Voter's Oath and Attester's Oath, if applicable.

(3)Provisional Ballot Form, including the State of Iowa Official Voter Registration Form and Statement to Person Casting a Provisional Ballot.

(4)Challenger's Statement.

(5)Affidavit of Voter Requesting Assistance.

22.601(3) Certification. A vendor providing an e-poll book platform in this state shall certify in writing to the state commissioner that the requirements of subrule 22.601(2) are met. If any of the requirements are not met, the vendor shall note the exceptions conspicuously.

This rule is intended to implement 2017 Iowa Acts, House File 516, section 37.

Item 7. Adopt the following new rule 721—22.602(47):

721—22.602(47) Security features of e-poll books. All e-poll book systems in use in this state, including those funded by county moneys, shall conform to the following security standards.

22.602(1) Definitions.

"E-poll book" is as defined in rule 721—22.1(47).

"Secure," for purposes of this rule, means "encryption" as defined by Iowa Code section 715C.1(5).

"Vendor," for purposes of this rule, means a person or representative of a person developing, offering, or supporting an e-poll book.

22.602(2) Encryption of data at rest. The e-poll book system shall ensure that all voter data is encrypted at rest. "Encrypted at rest" includes encryption of the whole hard drive, database, application data deemed confidential, and removable media. The data encryption keys shall be stored separately from the e-poll book hardware and software.

22.602(3) Encryption of data in transit. The e-poll book system shall ensure that all voter data is encrypted in transit via secure transfer protocols.

22.602(4) Security updates. The commissioner shall ensure that the computer maintains the most recent security updates available for the computer's operating system. The vendor shall ensure that the e-poll book software remains compatible with all security updates issued for the computer's operating system. An e-poll book system in use in Iowa shall not be installed on an operating system that is no longer supported by the developer.

22.602(5) Authentication. Every e-poll book system shall require authentication to the operating system and to the e-poll book application separately through a minimum of a username-password combination. A commissioner shall use a unique username-password combination for each precinct.

22.602(6) Decommissioning. At the time of decommissioning, the hard drive from the computer shall be destroyed by the owner of the hardware. This shall occur before the commissioner or vendor resells, gifts, repurposes, or otherwise disposes of the equipment. A record of the destruction shall be kept by the owner.

22.602(7) Certification. A vendor providing an e-poll book platform in this state shall certify in writing to the state commissioner that all of the requirements in this rule are met.

This rule is intended to implement 2017 Iowa Acts, House File 516, section 37.