Mac Warner Secretary ot'Slalc Stale ol' 'est lVirginia June 13 2018 Brian Newby Executive Director U 5 Election Assistance Commission 1335 East West Highway Suite 4300 Silver Spring MD 20910 Dear Mr Newby This letter offers a narrative of West Virginia s plan to expend HAVA funds out of the West Virginia Secretary of State s WVSOS Office In preparations of this narrative WVSOS surveyed local election officials for cyber and physical security assessments amended state law to authorize county grants for election systems and security upgrades and repurposed existing state resources to maximize election security from the state level On a personal note regarding current and future HAVA funds made available by the federal government i find it important that West Virginia s long-term preparations for cybersecurity protections and maintenance of our Statewide Voter Registration System should be funded with a dedicated source from our state budget not short term federal funds that may not exist in the future A major concern with such short-term federal funds is longevity for providing ongoing and future election systems protections especially as those funds run out With that acknowledgment lam grateful for this round of additional funding for local election officials to bolster local cyber and physical security and to help purchase new or updated voting systems in this respect the federal government can make a longer-term impact notwithstanding the fact that systems and equipment must be updated and upgraded on a regular basis In short with election systems being critical infrastructure I am hOpeful that this re-authorized release of the remaining 2002 HAVA funds is only the beginning of more regular federal funding for cybersecurity and equipment upgrades Without it our local election officials are left with a huge target on their offices but no armor to protect them Assessment of West Virginia s Security Profile Upon taking office as the incoming Secretary of State in January of 2017 WVSOS prioritized review of the 2016 election procedures and completed a full assessment of West Virginia s election security The assessment identified many areas for improvement upon which immediate action was taken to resolve previously unaddressed vulnerabilities of West Virginia election security In 2017 WVSOS immediately implemented cybersecurity training programs for local election officials that covered spear phishing password protections and best practices for using the Statewide Voter Registration System SVRS 'ilpilul 'lmrleslnn West Virginia 25305 rim-ii gt Important West Virginia election security practices include the ability to audit results and mandatory public testing of voting equipment by local election of cials Post-election audit procedures are possible due to the statutorily required voter verified paper trail WPT for all electronic tallying voting machines Thankfully each of West Virginia s 55 counties are in compliance As part of every statewide election logic and accuracy tests are run on each machine upon delivery from the vendor West Virginia also requires a post-election hand count audit of 3% of precincts selected at a random at canvass to ensure accuracy of the voting equipment If a variance ofjust 1% is identified or if the outcome of any race changes as a result of the audit the entire county must be recounted by hand Immediate Action Taken in Preparation of the 2018 Midterm Elections West Virginia took immediate preparing for the 2018 midterm elections without any additional HAVA funds To begin WVSOS enacted a holistic change in security culture that prioritizes all aspects of security and encouraged local election officials to do the same Actions taken by WVSOS and local election officials can be summarized into 5 distinct categories 1 Advanced Partnership with the West Virginia National Guard Coordinating resources between federal state and local agencies is the number one priority for election of cials when doing security preparations heading into the 2018 elections The communication barriers across federal agencies to state and local of cials proved dif cult in 2016 with the lack of information sharing platforms and not having sponsorships for clearance to classi ed information regarding election systems In the Fall of 2017 WVSOS entered a partnership with the West Virginia National Guard WVNG for a full-time Guard member with Top Secret clearance to monitor state-level cyber activity and give recommendations on WVSOS security efforts This advanced partnership is the first instance in the country to imbed a National Guard member in the elections arena as a cyber-expert Through this partnership the WVNG was also able to facilitate vulnerability testing on elections systems prior to the 2018 midterm primary elections at no additional expense to either agency The WVNG assets have also been successful in designing and managing an appropriate whitelist for online access to the state election systems 2 Participation in Multi-Agency and Multi-State Information Sharing Platforms In 2017 WVSOS partnered with the WV Fusion Center to merge WVSOS cyber resources and the WVSOS investigations unit with the state s multi-agency emergency responders to bolster state agencies communications efforts Additionally WVSOS joined two information sharing networks with the Multi-State Information Sharing and Analysis Center MS-ISAC and the Election Information Sharing and Analysis Center to monitor cyber activity and receive important noti cations and best practices from other states to increase West Virginia s awareness of the elections landscape on a macro level 3 ldenti Existing DHS Resources for State and Local Election Of cials WVSOS has been working diligently to identify all available resources prior to spending funds on election security needs The Department of Homeland Security DHS has provided at no cost to the state an Albert Sensor to allow off site monitoring of state level web traf c of our SVRS and elections systems servers WVSOS and DHS are also in discussions to perform an additional vulnerability scan prior to the 2018 midterm general elections as well as discussing a partnership to administer physical security assessments for local election officials to be complete by the end of July 2018 4 Securing Grant Funding for Local Election Of cials for Voting Systems and Securig During the 2018 Legislative Session WVSOS worked with the West Virginia Legislature to pass a bill that authorizes grant funding opportunities for local election of cials for election systems upgrades and additional security necessities ahead of the newest round of Federal funding The West Virginia Legislature added the granting opportunity to a previously existing HAVA loan fund for election systems totaling around $2 905 628 These funds will be used for improving the administration of elections for Federal of ce by enhancing election technology and security by purchasing election systems election system upgrades electronic voting systems or physical security These grants may be applied for beginning in July 2018 and will cover reimbursement for any local election official who intends to upgrade voting equipment of security efforts prior to the 2018 General Elections 5 Repurgosing HAVA 1 Funds for One Time Security Purchases Beginning FY19 WVSOS will repurpose previously existing HAVA funds which had been earmarked for SVRS maintenance to be used for one-time expenses such as 0 Increase cybersecurity protections of the - Offer additional security training for state and local election of cials - Offer the option for local election of cials to have cyber navigators who conduct in-house assessments and offer suggestions for security protections 0 Implement two-factor authentication for users of the - Penetration testing of the SVRS and other internet-facing election systems - To create a disaster recovery site and - To continue funding opportunities for ADA-compliant polling locations in 2018 midterms Use of HAVA 2 funds West Virginia s long-term security profile will be bolstered leading into the 2018 midterms with the repurposing of state funds for maintenance of the SVRS and the use of existing HAVA 1 funds for one- time upgrades to security from the State This will allow West Virginia to use the newly appropriated HAVA 2 funds exclusively as grants or loans directly to local election of cials to boost their purchasing power for elections systems and security The additional $3 611 943 of HAVA 2 funds will be added to the current County Grant and Loan Fund that upon amending the WV HAVA State Plan will have $2 905 628 available to grant totaling a fund balance of $6 517 571 available for the counties use Any new funds will be distributed by a HAVA Grant and Loan Board to the counties for election equipment up to 50% grant with a 50% local match physical security up to 85% grant with a 15% local match cybersecurity up to 85% grant with a 15% local match and e-pollbooks up to 85% grant with a 15% local match Our expectations of the total purchasing power is approximately $10 000 000 The Future of West Virginia s Election Security The move away from federal funding for maintenance of the SVRS and increasing our funding priorities to include election security has put the state-level systems in a position to have a long-term and stable funding source for cybersecurity We fully understand that any cyber system is only as good as the weakest link West Virginia will continue to stay dedicated to increasing our protections bolster our detection capabilities and stay prepared for corrective action if and when an attack occurs While West Virginia has leveraged every resource possible from existing funds and new funds to the County Grant and Loan Fund we estimate that local election official s efforts will result in only half of all registered voters having access to new or upgraded election systems by the 2020 elections I find the most important financial need moving forward is to replace local voting equipment with new more secure equipment West Virginia s economic situation since the first round of HAVA in 2002 has deteriorated and many less-populated counties simply do not have resources to prioritize funding election systems over debts that continue to rise such as increasing jail bills and underfunded road maintenance Even with the matching opportunities for voting equipment and cyber upgrades that we will offer West Virginia is just now beginning to recover from the economic storm of recent years Funds to acquire HAVA mandated machines that come with the latest and greatest technology and protections simply do not exist in many counties HAVA 2 funds are greatly appreciated and helpful to local election officials but I am hopeful that our local election officials needs remain in consideration when Congressional funding discussions resume Sincerely Mae Mac Warner West Virginia Secretary of State 2018 HAVA ELECTION SECURITY GRANT Budget Information CFDA it 90 404 Non-Construction Program Name of Organization Budget Period Start Budget Period End lWest Virginia Secretary of State I 3 3an SECTION A- BUDGET SUMMARY FEDERAL 8 NON-FEDERAL FUNDS Match Consolidated Budgerfor total project term-- up to 5 years as de ned by grantee PROGRAM CATEGORIES BUDGET CATEGORIES c 1 Voter Registration Systems Election Auditing Voting Equipment Cyber Security ie Communications HAVA Grant and Loan Board Distribution Other TOTALS 5'6 Fed Total I-h PERSONNEL including fringe 0% EQUIPMENT LIJ SUBGRAN TS- to local voting jurisdictions 3 611 943 00 3 611 943 00 100% TRAINING U'l All OTHER COSTS 01 TOTAL DIRECT COSTS 3 611 943 00 3 611 943 00 INDIRECT COSTSlifappliedl 0% 8 Total Federal Budget 5 5 - 5 - - 3 611 943 00 5 3 611 943 00 11 Non-Federal Match 3 769 500 00 12 Total Program Budget 169 500 00 5 - 5 - 5 3 511 943 00 5 4 381 443 00 13 Percentage By Category 0% 0% 0% 0% 0% 100% Proposed State Match 21 3% A Do you have an Indirect Cost Rate Agreement approved by the Federal government or some other non-federal entity If yes please provide the following information B Period Covered by the Indirect Cost Rate Agreement C Approving Federal agency D If other than Federal agency please specify E The indirect Cost Rate is No