BILL NUMBER: SB 1376 CHAPTERED 09/27/04 CHAPTER 813 FILED WITH SECRETARY OF STATE SEPTEMBER 27, 2004 APPROVED BY GOVERNOR SEPTEMBER 27, 2004 PASSED THE SENATE AUGUST 17, 2004 PASSED THE ASSEMBLY AUGUST 12, 2004 AMENDED IN ASSEMBLY JUNE 30, 2004 AMENDED IN ASSEMBLY JUNE 7, 2004 AMENDED IN SENATE MAY 4, 2004 INTRODUCED BY Senator Perata (Coauthor: Senator Vasconcellos) FEBRUARY 18, 2004 An act to amend Sections 19102, 19103, and 19201 of, and to add Sections 18564.5, 19214, 19214.5, and 19215 to, the Elections Code, relating to elections. LEGISLATIVE COUNSEL'S DIGEST SB 1376, Perata. Voting systems. (1) Existing law prohibits tampering with voting systems or equipment, making it a felony to tamper with or damage a voting machine, or to make or possess a key to a voting machine without authorization. This bill would authorize the Secretary of State, Attorney General, and any local elections official in the county in which the act occurs, to bring a civil action against an individual, business, or other legal entity that commits any specified act of tampering with a voting system or voting equipment before, during, or after an election. By imposing new duties on local elections officials, this bill would create a state-mandated local program. (2) Existing law requires the Secretary of State to study and adopt regulations governing the use of voting machines, voting devices, and vote tabulating devices. The Secretary of State is authorized to investigate any alleged violation of his or her regulations with the power to subpoena all necessary persons and records. This bill would authorize the Secretary of State to also investigate any alleged violation of the Elections Code. (3) Existing law requires an exact copy of the source code for all ballot tally software programs to be placed in an approved escrow facility prior to its use. The Secretary of State may seek injunctive relief requiring the elections officials to comply with this provision and related regulations. This bill would require an exact copy of the source code for all ballot tally software programs certified by the Secretary of State, including all changes or modifications and new or amended versions, to be placed in an approved escrow facility prior to its use. The bill would prohibit the use of a voting system for an election unless an exact copy of the ballot tally software program source codes is placed in escrow. The bill would further provide that the Secretary of State shall have reasonable access to the materials placed in escrow, under specified circumstances. The bill would authorize the Secretary of State to seek injunctive relief requiring the elections officials, or any vendor or manufacturer of a voting machine, voting system, or vote tabulating device, to comply with these provisions and related regulations. (4) Existing law prohibits the use of a voting system, in whole or in part, unless it has received the approval of the Secretary of State prior to any election at which it is to be first used. This bill would prohibit any jurisdiction from purchasing or contracting for a voting system, in whole or in part, unless it has received the approval of the Secretary of State. (5) Existing law prohibits the change or modification of any approved voting system or its parts until the Secretary of State has been notified in writing and makes a determination that the change does not impair the system's accuracy and efficiency, as specified. This bill would authorize the Secretary of State to seek injunctive, administrative, and certain other relief, including monetary damages, for an unauthorized change in hardware, software, or firmware to a voting system. The bill also would authorize the Secretary of State to seek injunctive relief requiring an elections official, or any vendor or manufacturer of a voting machine, voting system, or vote tabulating device, to comply with the requirements of the Elections Code, the regulations of the Secretary of State, and the specifications for voting machines, voting devices, vote tabulating devices, and any software used for each, including the programs and procedures for vote tabulating and testing. (6) The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement, including the creation of a State Mandates Claims Fund to pay the costs of mandates that do not exceed $1,000,000 statewide and other procedures for claims whose statewide costs exceed $1,000,000. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to these statutory provisions. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. This act shall be known as the "Voting System Security Act of 2004." SEC. 2. The Legislature finds and declares that the integrity of California's voting systems is of paramount concern to all state voters. Any action that undermines that integrity must be addressed in the most expeditious manner available to state authorities. The Secretary of State, elections officials, and legal authorities shall be empowered to thwart any effort that casts or could cast doubt on the validity of the elections process and each voter's right to have his or her vote counted. SEC. 3. Section 18564.5 is added to the Elections Code, to read: 18564.5. (a) The Secretary of State, Attorney General, and any local elections official in the county in which the act occurs, may bring a civil action against an individual, business, or other legal entity that commits any of the following acts before, during, or after an election: (1) Tampers, interferes, or attempts to interfere with the correct operation of, or willfully damages in order to prevent the use of, any voting machine, voting device, voting system, vote tabulating device, or ballot tally software. (2) Interferes or attempts to interfere with the secrecy of voting or interferes or attempts to interfere with ballot tally software program source codes. (3) Knowingly, and without authorization, gains access to or provides another person or persons with access to a voting machine for the purpose of committing one of the acts specified by this section. (4) Willfully substitutes or attempts to substitute forged, counterfeit, or malicious ballot tally software program source codes. (5) Knowingly, and without authorization, inserts or causes the insertion of uncertified hardware, software, or firmware, for whatever purpose, into any voting machine, voting device, voting system, vote tabulating device, or ballot tally software. (6) Fails to notify the Secretary of State prior to any change in hardware, software, or firmware to a voting machine, voting device, voting system, or vote tabulating device, certified or conditionally certified for use in this state. (b) A civil action may be brought pursuant to this section for a civil penalty not to exceed fifty thousand dollars ($50,000) for each act and for injunctive relief, if appropriate. SEC. 4. Section 19102 of the Elections Code is amended to read: 19102. The Secretary of State may investigate any alleged violation of this code or the Secretary of State's regulations with the power to subpoena all necessary persons and records. SEC. 5. Section 19103 of the Elections Code is amended to read: 19103. (a) An exact copy of the source code for all ballot tally software programs certified by the Secretary of State, including all changes or modifications and new or amended versions, shall be placed in an approved escrow facility prior to its use. No voting system may be used for an election unless an exact copy of the ballot tally software program source codes is placed in escrow. (b) The Secretary of State shall adopt regulations relating to the following: (1) The definition of source codes for ballot tally software. (2) Specifications for the escrow facility, including security and environmental specifications necessary for the preservation of the ballot tally software program source codes. (3) Procedures for submitting ballot tally software program source codes. (4) Criteria for access to ballot tally software program source codes. (c) The Secretary of State shall have reasonable access to the materials placed in escrow, under the following circumstances: (1) In the course of an investigation or prosecution regarding vote counting equipment or procedures. (2) Upon a finding by the Secretary of State that an escrow facility or escrow company is unable or unwilling to maintain materials in escrow in compliance with this section. (3) In order to fulfill the provisions of this chapter related to the approval of voting systems. (4) In order to verify that the software on a voting system, voting machine, or vote tabulating device is identical to the approved version. (5) For any other purpose deemed necessary to fulfill the provisions of this code or Section 12172.5 of the Government Code. (d) The Secretary of State may seek injunctive relief requiring the elections officials, or any vendor or manufacturer of a voting machine, voting system, or vote tabulating device, to comply with this section and related regulations. Venue for a proceeding under this section shall be exclusively in Sacramento County. (e) This section applies to all elections. SEC. 6. Section 19201 of the Elections Code is amended to read: 19201. (a) No voting system, in whole or in part, shall be used unless it has received the approval of the Secretary of State prior to any election at which it is to be first used. (b) No jurisdiction may purchase or contract for a voting system, in whole or in part, unless it has received the approval of the Secretary of State. SEC. 7. Section 19214 is added to the Elections Code, to read: 19214. The Secretary of State may seek injunctive and administrative relief when a voting system has been compromised by the addition or deletion of hardware, software, or firmware without prior approval. SEC. 8. Section 19214.5 is added to the Elections Code, to read: 19214.5. (a) The Secretary of State may seek all of the following relief for an unauthorized change in hardware, software, or firmware to any voting system certified or conditionally certified in California: (1) Monetary damages from the offending party or parties, not to exceed ten thousand dollars ($10,000) per violation. For purposes of this subdivision, each voting machine found to contain the unauthorized hardware, software, or firmware shall be considered a separate violation. Damages imposed pursuant to this subdivision shall be apportioned 50 percent to the county in which the violation occurred, if applicable, and 50 percent to the Office of the Secretary of State for purposes of bolstering voting systems security efforts. (2) Immediate commencement of decertification proceedings for the voting system in question. (3) Prohibiting the manufacturer or vendor of a voting system from doing any elections-related business in the state for one, two, or three years. (4) Refund of all moneys paid by a locality for a compromised voting system, whether or not the voting system has been used in an election. (5) Any other remedial actions authorized by law to prevent unjust enrichment of the offending party. (b) Prior to seeking any measure of relief under this section, the Secretary of State shall hold a public hearing. The Secretary of State shall give notice of the hearing in the manner prescribed by Section 6064 of the Government Code in a newspaper of general circulation published in Sacramento County. The Secretary of State also shall transmit written notice of the hearing, at least 30 days prior to the hearing, to each county elections official, the offending party or parties, any person that the Secretary of State believes will be interested in the hearing, and any person who requests, in writing, notice of the hearing. (c) The decision of the Secretary of State, to seek any relief under this section, shall be in writing and state the findings of the secretary. The decision shall be open to public inspection. SEC. 9. Section 19215 is added to the Elections Code, to read: 19215. (a) The Secretary of State may seek injunctive relief requiring an elections official, or any vendor or manufacturer of a voting machine, voting system, or vote tabulating device, to comply with the requirements of this code, the regulations of the Secretary of State, and the specifications for voting machines, voting devices, vote tabulating devices, and any software used for each, including the programs and procedures for vote tabulating and testing. (b) Venue for a proceeding under this section shall be exclusively in Sacramento County. SEC. 10. Notwithstanding Section 17610 of the Government Code, if the Commission on State Mandates determines that this act contains costs mandated by the state, reimbursement to local agencies and school districts for those costs shall be made pursuant to Part 7 (commencing with Section 17500) of Division 4 of Title 2 of the Government Code. If the statewide cost of the claim for reimbursement does not exceed one million dollars ($1,000,000), reimbursement shall be made from the State Mandates Claims Fund.