Overview of Security Procedures

2016 Presidential General Election

MONTGOMERY COUNTY BOARD OF ELECTIONS

September 19, 2016
2

Why this overview?

Overview of Security Procedures

2016 Presidential General Election
3

What happened?

Overview of Security Procedures

2016 Presidential General Election

August 2016:

FBI releases flash alert 

after voter data on state 

websites hacked in 

Illinois and Arizona

Incident: Identity theft. 

 Not vote theft.
4

What happened?

Overview of Security Procedures

2016 Presidential General Election

August 2016:

Department of Homeland Security holds call with 

state election officials, considers designating 

certain election systems as ‘critical infrastructure’
5

Overview of Security Procedures

2016 Presidential General Election

Baltimore Sun, “FBI warns state elections 

officials about hacking attempts” 

(August 29, 2016)

Maryland “already prepared”
Online voter registration

6

 OLVR a state system; county employees have no access

 OLVR data manually reviewed before entered into MDVOTERS

 As with any state database, cybersecurity protocols a state responsibility

Overview of Security Procedures

2016 Presidential General Election

Voter registration

 MDVOTERS also a state system; county employees have 

limited user access privileges

 Password security

 Paper records secured behind badge-entry doors 

 Cancelled records flagged but not deleted

 Copies of data secured in electronic pollbook using

numerically logged and verified tamper-evident seals

 Logic and accuracy testing

 Election Judges verify seals on Integrity Reports 
Security of county systems

7

 Department of Technology Services responsible for numerous gov databases

 All employees required to complete mandatory online training about

information security protocols

 Employees have tiers of access to electronic records

 Paper records secured behind badge-entry doors

Overview of Security Procedures

2016 Presidential General Election

Voting equipment

 Federally certified voting system (ES&S EVS 5.2.0.3)

 Dedicated workstations in secure server room used 

only for certified purposes (not even used for

election night reporting)

 Election media secured in scanner using numerically

logged and verified tamper-evident seals

 Data encrypted and digitally signed

 Logic and accuracy testing

 Election Judges verify seals on Integrity Reports
The good news (?)

8

Overview of Security Procedures

2016 Presidential General Election
Votes not connected to the Internet

9

Overview of Security Procedures

2016 Presidential General Election

Public demonstration of logic & accuracy testing for 

the 2016 presidential primary election

(April 8, 2016)
Electronic Pollbook Integrity Report

10

Overview of Security Procedures

2016 Presidential General Election
Scanning Unit Integrity Report

11

Overview of Security Procedures

2016 Presidential General Election
Scanning Unit Integrity Report

12

Overview of Security Procedures

2016 Presidential General Election
Scanning Unit Integrity Report

13

Overview of Security Procedures

2016 Presidential General Election
Security Seal Removal Report

14

Overview of Security Procedures

2016 Presidential General Election
Security Seal Removal Report

15

Overview of Security Procedures

2016 Presidential General Election
Ballot Bin Chain of Custody Form

16

Overview of Security Procedures

2016 Presidential General Election
Media Results Chain of Custody Form

17

Overview of Security Procedures

2016 Presidential General Election
BOE Chain of Custody Form

18

Overview of Security Procedures

2016 Presidential General Election
Election Day

19

Overview of Security Procedures

2016 Presidential General Election

 Coordination w/MCPD, OEMHS

 Police officer in call center

 Emergency Operations Center 

 Chiefs have facility security plan

 Call 911 first, then BOE

 Retrieve what you can

 Paper ballots

 Emergency paper pollbooks

 Emergency bin

 Federal resources in event of a cyberattack:

Linda Lamone serves on Technical Guidelines 

Development Committee @ EAC/NIST

for information, see www.eac.gov
Post-Election Audit

20

Overview of Security Procedures

2016 Presidential General Election
Questions? 

END OF BALLOT

Be sure to review your ballot selections