Adopted and Filed

Polling place technology revolving loan fund; electronic poll books, amendments to ch 22

Untitled document

ARC 3468C

SECRETARY OF STATE[721]

Adopted and Filed

Pursuant to the authority of Iowa Code sections 17A.3 and 17A.4 and 2017 Iowa Acts, House File 516, section 37, the Secretary of State hereby amends Chapter 22, "Voting Systems," Iowa Administrative Code.

These amendments are necessary because the General Assembly has enacted 2017 Iowa Acts, House File 516. The Secretary of State has determined that as a result of this newly enacted law, the amendments are necessary to keep the administrative rules in compliance with the Iowa Code. 2017 Iowa Acts, House File 516, section 37, creates a revolving loan fund to help counties with the purchase of electronic poll books, creating the need to update Chapter 22. Additionally, the amendments provide new rules governing e-poll book technological and operational requirements.

Notice of Intended Action was published in the Iowa Administrative Bulletin as ARC 3319C on September 27, 2017. The Secretary received written comments from the Iowa Precinct Atlas Consortium, as well as a letter cosigned by Auditors Miller (Linn County), Weipert (Johnson County), and Fitzgerald (Polk County). Based on the feedback in these comments, the Secretary made the following changes:

In Item 7, the language in subrule 22.602(7) was changed to clarify that a vendor needs to report to the state commissioner the cybersecurity standards utilized when the vendor signs the first contract with a county in the state and upon any changes to those security features. The subrule now reads as follows:

"22.602(7) Notification. A vendor upon offering a new e-poll book platform, or upon making a change to the security features of an existing e-poll book, shall notify the state commissioner of the encryption and authentication standards utilized."

Additionally, as a result of comments by Representative Nielsen at the Administrative Rules Review Committee meeting, the Secretary revised subrule 22.600(2) in Item 5 to add a sentence relating to gender and party balance. The subrule now reads as follows:

"22.600(2) In order to ensure that the public funds in this rule are used responsibly and efficiently, this rule creates a panel consisting of designees of the state commissioner of elections, the state auditor, and the director of the department of management. Attendance by two of the three members constitutes a quorum. The panel shall conform to the party and gender balance requirements of Iowa Code sections 69.16 and 69.16A."

Last, in Item 3, the definition of "electronic ballot marking device" as proposed in the Notice was not adopted because the definition as written is already contained in rule 721—22.1(52).

After analysis and review of this rule making, no impact on jobs has been found.

These amendments are intended to implement 2017 Iowa Acts, House File 516.

These amendments will become effective on December 31, 2017.

The following amendments are adopted.

Item 1. Amend 721—Chapter 22, title, as follows:

VOTING SYSTEMS AND ELECTRONIC POLL BOOKS

Item 2. Amend rule 721—22.1(52), definition of "De minimis change," as follows:

"De minimis change" means a change to a certified voting system's hardware, software, technical data package (TDP), or data, the nature of which will not materially alter the system's reliability, functionality, capability, security and or operation. In order for a change to qualify as a de minimis change, it must not alter the reliability, functionality, capability, security and operability of the system. A de minimis change shall also ensure that when the hardware is replaced, the original hardware and the replacement hardware are electronically and mechanically interchangeable and have identical functionality and tolerances. A Under no circumstances shall a change shall not be considered de minimis if it has reasonable and identifiable potential to affect impact the system's operation performance and compliance with the applicable voting system standards standard.

Item 3. Adopt the following new definition of "Electronic poll book" in rule 721—22.1(52):

"Electronic poll book," "epollbook,""e-poll book," or "electronic register" means hardware and software components used to verify and process voting activity and changes in voter registration and to check in voters. This definition includes e-poll books in use in the commissioner's office. However, this definition does not apply to the I-Voters statewide voter registration database.

Item 4. Reserve rules 721—22.501 to 721—22.599.

Item 5. Adopt the following new rule 721—22.600(47) and heading:

e-poll books

721—22.600(47) Revolving loan fund. The purpose of this rule is to establish an e-poll book and polling place modernization panel to review applications submitted to the state commissioner for distribution of moneys from the revolving loan fund created by 2017 Iowa Acts, House File 516, section 37, to be codified at Iowa Code section 47.11.

22.600(1) Definitions.

"E-poll book" is as defined in rule 721—22.1(52).

"Vendor," for purposes of this rule, means a person or representative of a person developing, offering, or supporting an e-poll book.

22.600(2) In order to ensure that the public funds in this rule are used responsibly and efficiently, this rule creates a panel consisting of designees of the state commissioner of elections, the state auditor, and the director of the department of management. Attendance by two of the three members constitutes a quorum. The panel shall conform to the party and gender balance requirements of Iowa Code sections 69.16 and 69.16A.

22.600(3) The state commissioner shall convene the panel whenever necessary to review loan applications received from county commissioners requesting moneys from the fund.

22.600(4) The state commissioner may convene the panel to review proposed expenditures for updating technology standards for elections. If the state commissioner determines that there is an urgent need that an expenditure of moneys from the fund be used to update technology standards, the state commissioner may spend the moneys without convening the panel. In such instance, the state commissioner shall report that expenditure at the next meeting of the panel.

22.600(5) The panel shall create guidelines for loaning moneys from the fund to county commissioners for the updating of polling place technology. The guidelines shall be published on the state commissioner's website.

22.600(6) Before distributing or loaning funds, the panel shall consider the published guidelines, but may take additional factors into consideration. The panel shall not waive any information technology security standards, but may waive other requirements. A majority vote of the panel members present is sufficient to approve funding.

22.600(7) Before any funds from the revolving loan fund are provided for the acquisition of e-poll books, the e-poll book system shall conform to the security requirements within this chapter.

This rule is intended to implement 2017 Iowa Acts, House File 516, section 37.

Item 6. Adopt the following new rule 721—22.601(47):

721—22.601(47) Operational features of e-poll books.

22.601(1) Definitions.

"E-poll book" is as defined in rule 721—22.1(52).

"Vendor," for purposes of this rule, means a person or representative of a person developing, offering, or supporting an e-poll book.

22.601(2) Operational features. When assessing applications for funding from the revolving loan fund established by 2017 Iowa Acts, House File 516, section 37, as implemented in rule 721—22.600(47), the e-poll book and polling place modernization panel shall consider whether the e-poll book sought includes the operational features described in this subrule. Commissioners using only county funds for the purchase of e-poll book systems are not subject to the operational features described below, but are subject to all of the security requirements set forth in rule 721—22.602(47). The panel shall consider:

a. Whether the e-poll book is able to accept a secure data file that imports voter registration data into the e-poll book application from the statewide voter registration system. This requirement may not be waived by the panel.

b. Whether the e-poll book is able to securely export data files that can be imported into the statewide voter registration system, including a file to update the voter activity portion of the statewide voter registration system.

c. Whether the e-poll book is able to scan the barcodes of driver's licenses, DOT-issued nonoperator identification cards, and the voter identification card issued pursuant to 2017 Iowa Acts, House File 516, section 18, to be codified at Iowa Code section 48A.10A.

d. Whether the e-poll book is able to verify the voter against the felon database.

e. Whether the e-poll book is able to process, record, and export the complete range of possible voter registration updates available to voters under Iowa law. The state commissioner shall maintain a form that lists the possible updates that are required by this subrule.

f. Whether the e-poll book is able to complete and print the following forms:

(1)State of Iowa Official Voter Registration Form.

(2)Election Day Voter Registration Form, including Voter's Oath and Attester's Oath, if applicable.

(3)Provisional Ballot Form, including the State of Iowa Official Voter Registration Form and Statement to Person Casting a Provisional Ballot.

(4)Challenger's Statement.

(5)Affidavit of Voter Requesting Assistance.

22.601(3) Certification. A vendor providing an e-poll book platform in this state shall certify in writing to the state commissioner that the requirements of subrule 22.601(2) are met. If any of the requirements are not met, the vendor shall note the exceptions conspicuously.

This rule is intended to implement 2017 Iowa Acts, House File 516, section 37.

Item 7. Adopt the following new rule 721—22.602(47):

721—22.602(47) Security features of e-poll books. All e-poll book systems in use in this state, including those funded by county moneys, shall conform to the following security standards.

22.602(1) Definitions.

"E-poll book" is as defined in rule 721—22.1(47).

"Secure," for purposes of this rule, means "encryption" as defined by Iowa Code section 715C.1(5).

"Vendor," for purposes of this rule, means a person or representative of a person developing, offering, or supporting an e-poll book.

22.602(2) Encryption of data at rest. The e-poll book system shall ensure that all voter data is encrypted at rest. "Encrypted at rest" includes encryption of the whole hard drive, database, application data deemed confidential, and removable media. The data encryption keys shall be stored separately from the e-poll book hardware and software.

22.602(3) Encryption of data in transit. The e-poll book system shall ensure that all voter data is encrypted in transit via secure transfer protocols.

22.602(4) Security updates. The commissioner shall ensure that the computer maintains the most recent security updates available for the computer's operating system. The vendor shall ensure that the e-poll book software remains compatible with all security updates issued for the computer's operating system. An e-poll book system in use in Iowa shall not be installed on an operating system that is no longer supported by the developer.

22.602(5) Authentication. Every e-poll book system shall require authentication to the operating system and to the e-poll book application separately through a minimum of a username-password combination. A commissioner shall use a unique username-password combination for each precinct.

22.602(6) Decommissioning. At the time of decommissioning, the hard drive from the computer shall be destroyed by the owner of the hardware. This shall occur before the commissioner or vendor resells, gifts, repurposes, or otherwise disposes of the equipment. A record of the destruction shall be kept by the owner.

22.602(7) Notification. A vendor upon offering a new e-poll book platform, or upon making a change to the security features of an existing e-poll book, shall notify the state commissioner of the encryption and authentication standards utilized.

This rule is intended to implement 2017 Iowa Acts, House File 516, section 37.

[Filed 11/1/17, effective 12/31/17]

[Published 11/22/17]

Editor's Note: For replacement pages for IAC, see IAC Supplement 11/22/17.

Secretary of State

Official Document

  • Polling place technology revolving loan fund; electronic poll books, amendments to ch 22
  • Published on 11/22/2017
  • 359 Views
  • Adopted and Filed

The official published PDF of this document is available from the Iowa General Assembly’s Administrative Rules page.

View Official PDF

View the Iowa Administrative Bulletin for 11/22/2017.

View Bulletin

Related Notices

Administrative Rule References

The following administrative rule references were added to this document. You may click a reference to view related notices.

Rule 721-22.1 Rule 721-22.501 Rule 721-22.599 Rule 721-22.600 Rule 721-22.601 Rule 721-22.602

Iowa Code References

The following Iowa code references were added to this document. You may click a reference to view related notices.

Iowa Code 69.16 Iowa Code 69.16A Iowa Code 715C.1(5)
Click To Comment