Maryland State Board of Elections Agreement Number MD18101001 Program Narrative Submission March 23 2018 – March 22 2023 Submitted July 11 2018 Overview The Maryland State Board of Elections SBE is pleased receive $7 063 699 in federal funds to “enhance election technology and make election security improvements ” With the State’s 5% match of funds SBE will have $7 416 884 available to fulfill Congress’ intent to improve election security and technology Securing systems and data is a continuous effort in Maryland’s elections community and the systems and data we use are protected by the industry accepted best practices for critical information systems From the voter registration process to the voting process to the posting of election results we have ways to protect monitor test and restore the systems and processes We are constantly looking for ways to enhance how we protect these systems and respond to new risks and these funds will enable Maryland’s election community to enhance the security measures protecting the systems and data we use to conduct elections Proposed Election Security Activities As requested by the U S Election Assistance Commission EAC proposed activities are assigned to six categories with 2018 activities and long-term activities described for each category Voting Equipment Replacement and Upgrades 1 Background In 2016 Maryland transitioned to a paper-based voting system statewide1 With this system voters mark a paper ballot by hand or use an accessible ballot marking device to create a paper ballot The voter then scans the paper ballot into a tabulator This voting system has been successfully tested against version 1 0 of the Voluntary Voting System Guidelines and is certified by the EAC Since 2006 State and local election officials have used electronic pollbooks to check in voters 2 2018 Election Activities Maryland will continue to use the paper-based voting system and electronic pollbooks for the 2018 elections Both systems will be thoroughly tested before the 2018 elections and security measures to protect the integrity of the system have been reviewed implemented and audited Paper ballots are securely stored and are available for auditing recounts or a contested election 3 2020 and Future Election Activities Before the 2020 elections SBE anticipates upgrading the software and firmware for the voting system and the software and hardware for the electronic pollbooks The voting system used in the State of Maryland is Election Systems Software’s EVS 5 2 0 3 EAC certification number ESSEVS5203 1 Page 1 of 4 Maryland State Board of Elections Agreement Number MD18101001 Program and Budget Narrative Submission Since State law requires the use of a paper-based voting system any voting system used in Maryland be a paper-based system SBE will continue its tradition of rigorous testing and strict security and chain of custody procedures 4 Budget Narrative SBE will use approximately $100 000 of federal funds to obtain a new server and upgrade an existing server for the electronic pollbooks Election Auditing 1 Background SBE developed with auditing experts a comprehensive audit program to verify the integrity of the election process in Maryland In addition with the introduction of a paper-based voting system for the 2016 elections SBE evaluated three different ways of auditing ballots2 and selected an independent software audit to verify the results of 100% of the ballot images from the 2016 General Election3 The ballot tabulation audit confirmed the accuracy of the results from the voting system and provided State and local election officials with valuable information about voting machine maintenance pollworker training and voter education 2 2018 Election Activities State law requires an independent software audit after each statewide election and a manual audit of sampled ballots after a general election4 As a result election officials will use the software audit to validate the election results for the 2018 Primary and General Elections and use the manual audit after the 2018 General Election 3 2020 and Future Election Activities Election auditing will continue in Maryland and will cover critical aspects of the election process including election results 4 Budget Narrative No federal funds have been allocated to election auditing activities SBE’s share5 of expenses related to the independent software audit for the 2018 Primary and General Elections will be used to meet the State’s 5% match obligation SBE expects that costs associated with the manual audit after a general election will be minimal and can be absorbed in existing budgets Voter Registration Systems and Management 1 Background State and local election officials implemented a statewide voter registration system in 2005 The functionality of this system has expanded and hardware and software upgrades have resulted in a more robust and secure system For the 2012 elections the State implemented an online system for voters to register to vote and update their registration information Additional functionality A report on the three audit methods evaluated is available at http elections maryland gov press_room documents Post%20Election%20Tabulation%20Audit%20Pilot %20Program%20Report pdf 3 Information about the post-election ballot tabulation audit of the 2016 General Election is available at https elections maryland gov voting_system ballot_audit_reports_PG16 html 4 See Chapter 523 of the 2018 Laws of Maryland House Bill 1274 of the 2018 Legislative Session 5 State law requires the voting system expenses be shared equally between the State and counties Since the independent audit software reviews the results from the voting system costs associated with this auditing activity will be shared between State and county funds 2 Page 2 of 4 Maryland State Board of Elections Agreement Number MD18101001 Program and Budget Narrative Submission was added to allow for online requests for absentee ballots and upgrades have resulted in a more robust and secure system 2 2018 Election Activities While no substantive changes to the system will be made in 2018 election officials have enhanced system monitoring activities will continue to prioritize protecting the systems and voter data and will implement two-factor authentication for all users of the statewide voter registration system The online voter registration and ballot request system now uses two-factor authentication for users with administrator privileges 3 2020 and Future Election Activities SBE plans to upgrade servers and software in off election years and continue to enhance the system monitoring activities 4 Budget Narrative SBE will use approximately $1 000 000 or 15% of the federal funds to upgrade equipment and software for its voter registration candidacy and election management system and online voter registration and ballot request system Cyber Vulnerabilities 1 Background Protecting election data and systems is a top priority for State and local election officials In the last five years all of the State’s election systems have been independently reviewed for vulnerabilities In 2017 SBE had a business impact analysis and risk assessment performed Election systems are continuously monitored and steps to mitigate risks and vulnerabilities are taken when necessary 2 2018 Election Activities Protecting election systems and data continues as one of SBE’s top priorities Regular security meetings occur with in-house resources and vendors supporting critical election systems and risk and vulnerability assessments are performed with each software release Alerts are generated for any unusual voter registration or absentee voting behavior and appropriate action is taken SBE scheduled various assessments available through the U S Department of Homeland Security and the Multi-State Information Sharing and Analysis Center The agency’s security and disaster recovery plan has been reviewed and updated and SBE has reviewed and made suggestions for the plans for the local boards of elections 3 2020 and Future Election Activities Identifying and mitigating vulnerabilities will continue to be a top priority for State and local elections officials Assessing and mitigating vulnerabilities is a continuous task and SBE will continue to perform these assessments regularly and address any identified issues immediately 4 Budget Narrative SBE will allocate about $3 500 000 or about 50% of its federal funds to identifying and mitigating vulnerabilities These actions include upgrading equipment and software implementing 2-factor authentication on workstations hiring an information security expert and automating SBE’s patch management process Training 1 Background The State’s Department of Information Technology previously offered monthly online security training and SBE coordinated information security Page 3 of 4 Maryland State Board of Elections Agreement Number MD18101001 Program and Budget Narrative Submission trainings for State and local election officials Several election officials have participated in and been trained to conduct table top exercises SBE has established an internal working group to review security issues provide training and document incident response plans 2 2018 Election Activities SBE conducted a table top exercise for senior SBE leadership before the 2018 Primary Election and plans to conduct another one before the 2018 General Election Before the 2018 General Election SBE will also conduct a table top exercise for State and local election officials SBE understands that the State of Maryland intends to resume its monthly online security training but if it is delayed SBE intends to offer an alternate way to provide this training for State and local election officials SBE’s internal working group will continue its work to increase security awareness and responses 3 2020 and Future Election Activities Security training and table top exercises will continue and SBE plans to offer local election officials two table top exercises each year SBE’s IT resources will continue to engage in professional development opportunities to enhance our election systems 4 Budget Narrative SBE will spend approximately $1 500 000 or 20% of the federal funds on training This training will include table top exercises and cybersecurity training for State and local election officials and professional training for SBE’s IT personnel Communication 1 2020 and Future Election Activities An incident management plan is critical to responding to an information security incident 2 Budget Narrative SBE will spend approximately $500 000 or 5% of the federal funds on the refinement of and training on an incident management plan and if needed in response to an information security incident implementation of this plan Grant Administration SBE has deposited into an interest-bearing account all federal funds Interest earned on these funds will be retained in the account and used for only allowable activities SBE agrees to provide in-kind contributions to meet its 5% match requirement $353 185 and meet this match requirement by March 23 2020 Annual Financial and Performance Reports SBE will file annually program narrative and expenditure reports covering activities and expenditures for the prior federal fiscal year Each narrative report will include a summary of expenditures aligned with budget categories in SBE’s plan a list of equipment obtained with these funds and a description of how the funded activities meet the goals of the plan Title to Property SBE understands that it acquires title to any property purchased using these funds and retains ownership of this property as long as SBE has the property Page 4 of 4 2018 HAVA ELECTION SECURITY GRANT Budget Information Name of Organization CFDA # 90 404 Non-Construction Program Maryland State Board of Elections Budget Period Start 3 23 2018 Budget Period End 3 23 2023 SECTION A - BUDGET SUMMARY Consolidated Budget for total project term-up to 5 years as defined by grantee FEDERAL NON-FEDERAL FUNDS Match PROGRAM CATEGORIES a Voting Equipment BUDGET CATEGORIES c Voter Registration Systems b Election Auditing 1 PERSONNEL including fringe $ - 2 EQUIPMENT $ 3 SUBGRANTS- to local voting jurisdictions $ - 4 TRAINING $ 5 All OTHER COSTS $ 6 TOTAL DIRECT COSTS 1-6 d Cyber Security e Communications f Other Training $ - $ 100 000 00 $ - $ $ - $ - $ - - $ - $ 808 000 00 $ 1 155 000 00 $ 500 000 00 $ 100 000 00 $ - $ 1 058 000 00 $ 3 509 352 00 $ 500 000 00 $ 1 500 000 00 $ 7 INDIRECT COSTS if applied $ 5 945 00 $ - $ 62 894 00 $ 208 616 00 $ 29 723 00 $ 89 169 00 8 Total Federal Budget $ 105 945 00 $ - $ 1 120 894 00 $ 3 717 968 00 $ 529 723 00 $ 1 589 169 00 $ $ 352 000 00 $ 775 00 $ 105 945 00 $ 352 000 00 $ 1 121 669 00 $ 11 Non-Federal Match 12 Total Program Budget 13 Percentage By Category Proposed State Match $ 1% - $ 250 000 00 $ - $ - $ 0% 16% 5 0% YES B Period Covered by the Indirect Cost Rate Agreement mm dd yyyy-mm dd yyy 10 31 11 - 7 31 17 C Approving Federal agency Department of Defense D If other than Federal agency please specify 1 96% - 354 352 00 - $ - $ $ A Do you have an Indirect Cost Rate Agreement approved by the Federal government or some other non-federal entity If yes please provide the following information E The Indirect Cost Rate is 2 000 000 00 $ g Other ______________ - $ - 1 500 000 00 - - 53% 529 723 00 $ 7% 1 589 169 00 $ 22% 0% % Fed Total $ 2 000 000 00 30% $ 704 352 00 11% $ 435 00 3 718 403 00 $ TOTALS - 0% $ 1 500 000 00 22% $ 2 463 000 00 37% $ 6 667 352 00 $ 396 347 00 $ 7 063 699 00 $ 353 210 00 $ 7 416 909 00 6%