CHAPTER 3.5. Certification of Remote Accessible Vote By Mail Systems [19280 - 19295]
( Heading of Chapter 3.5 amended by Stats. 2016, Ch. 75, Sec. 6. )
The Secretary of State shall not certify or conditionally approve a remote accessible vote by mail system, or part of a remote accessible vote by mail system, unless it fulfills the requirements of this code and the regulations of the Secretary of State.
(Amended by Stats. 2016, Ch. 75, Sec. 7. (AB 2252) Effective January 1, 2017.)
(a) A remote accessible vote by mail system, in whole or in part, shall not be used unless it has been certified or conditionally approved by the Secretary of State before the election at which it is to be first used. The Secretary of State may impose additional conditions of approval as deemed necessary for the certification of the remote accessible vote by mail system.
(b) All other uses of a remote accessible vote by mail system shall be subject to the provisions of Section 19202.
(Amended by Stats. 2024, Ch. 605, Sec. 14. (SB 1328) Effective September 25, 2024.)
(a) The Secretary of State shall adopt and publish standards and regulations governing the use of remote accessible vote by mail systems.
(b) Remote accessible vote by mail system standards adopted by the Secretary of State pursuant to subdivision (a) shall include, but not be limited to, all of the following requirements:
(1) The machine or device and its software shall be suitable for the purpose for which it is intended.
(2) The remote
accessible vote by mail system shall preserve the secrecy of the ballot.
(3) The remote accessible vote by mail system shall be safe from fraud or manipulation.
(4) The remote accessible vote by mail system shall be accessible to voters with disabilities and to voters who require assistance in a language other than English if the language is one in which a ballot or ballot materials are required to be made available to voters.
(Amended by Stats. 2016, Ch. 75, Sec. 10. (AB 2252) Effective January 1, 2017.)
(a) A person, corporation, or public agency owning or having an interest in the sale or acquisition of a remote accessible vote by mail system or a part of a remote accessible vote by mail system may apply to the Secretary of State for certification or conditional approval that includes testing and examination of the applicant’s system and a report on the findings, which shall include the accuracy and efficiency of the remote accessible vote by mail system. As part of its application, the applicant of a remote accessible vote by mail system or a part of a remote accessible vote by mail system shall notify the Secretary of State in writing of any known defect, fault, or failure of the version of the hardware, software, or firmware of the remote accessible
vote by mail system or a part of the remote accessible vote by mail system submitted. The Secretary of State shall not begin his or her certification process until he or she receives a completed application from the applicant of the remote accessible vote by mail system or a part of the remote accessible vote by mail system. The applicant shall also notify the Secretary of State in writing of any defect, fault, or failure of the version of the hardware, software, or firmware of the ballot marking system or a part of the ballot marking system submitted that is discovered after the application is submitted and before the Secretary of State submits the report required by Section 19288. The Secretary of State shall complete his or her examination without undue delay.
(b) After receiving an applicant’s written notification of a defect, fault,
or failure, the Secretary of State shall notify the United States Election Assistance Commission or its successor agency of the problem as soon as practicable so as to present a reasonably complete description of the problem. The Secretary of State shall subsequently submit a report regarding the problem to the United States Election Assistance Commission or its successor agency. The report shall include any report regarding the problem submitted to the Secretary of State by the applicant.
(c) As used in this chapter:
(1) “Defect” means any flaw in the hardware or documentation of a remote accessible vote by mail system that could result in a state of unfitness for use or nonconformance to the manufacturer’s specifications or applicable law.
(2) “Failure” means a discrepancy between the external results of the operation of any software or firmware in a
remote accessible vote by mail system and the manufacturer’s product requirements for that software or firmware or applicable law.
(3) “Fault” means a step, process, or data definition in any software or firmware in a ballot marking system that is incorrect under the manufacturer’s program specification or applicable law.
(Amended by Stats. 2016, Ch. 75, Sec. 11. (AB 2252) Effective January 1, 2017.)
The Secretary of State shall use a state-approved testing agency or expert technicians to examine remote accessible vote by mail systems proposed for use or sale in this state. He or she shall furnish a complete report of the findings of the examination and testing to the Governor and the Attorney General.
(Amended by Stats. 2016, Ch. 75, Sec. 12. (AB 2252) Effective January 1, 2017.)
The person, corporation, or public agency applying for certification of a remote accessible vote by mail system is responsible for all costs associated with the testing and examination of the remote accessible vote by mail system.
(Amended by Stats. 2016, Ch. 75, Sec. 13. (AB 2252) Effective January 1, 2017.)
(a) Prior to publishing his or her decision to certify, conditionally approve, or withhold certification of a remote accessible vote by mail system, the Secretary of State shall provide for a 30-day public review period and conduct a public hearing to give interested persons an opportunity to review testing and examination reports and express their views for or against certification or conditional approval of the remote accessible vote by mail system.
(b) The Secretary of State shall give notice of the public review period and hearing in the manner prescribed in Section 6064 of the Government Code in a newspaper of general circulation published in Sacramento County. The Secretary
of State shall also provide notice of the hearing on his or her Internet Web site. The Secretary of State shall transmit written notice of the hearing, at least 14 days prior to the public review period and hearing, to each county elections official, to any person that the Secretary of State believes will be interested in the public review period and hearing, and to any person who requests, in writing, notice of the public review period and hearing.
(c) The decision of the Secretary of State to certify, conditionally approve, or withhold certification of a remote accessible vote by mail system shall be in writing and shall state the findings of the Secretary of State. The decision shall be open to public inspection.
(Amended by Stats. 2016, Ch. 75, Sec. 14. (AB 2252) Effective January 1, 2017.)
Within 60 days after the completion of the examination of a remote accessible vote by mail system, the Secretary of State shall make publicly available a report stating whether the remote accessible vote by mail system has been certified or conditionally approved, or whether certification has been withheld.
(Amended by Stats. 2016, Ch. 75, Sec. 15. (AB 2252) Effective January 1, 2017.)
Within 10 days after issuing and filing a certification decision and associated testing reports, the Secretary of State shall make available to the public a full and complete copy of the certification report and all associated documentation, except that portions of the report or documentation that contain information that the Secretary of State determines to be confidential or proprietary shall not be made publicly available. The Secretary of State shall notify the board of supervisors and elections official of each county of the availability of the report and associated documentation.
(Added by renumbering Section 19269 by Stats. 2013, Ch. 602, Sec. 82. (SB 360) Effective January 1, 2014.)
(a) If a remote accessible vote by mail system has been certified or conditionally approved by the Secretary of State, the vendor or, in cases where the system is publicly owned, the jurisdiction shall notify the Secretary of State and all local elections officials who use the system in writing of any defect, fault, or failure of the hardware, software, or firmware of the system or a part of the system within 30 calendar days after the vendor or jurisdiction learns of the defect, fault, or failure.
(b) After receiving written notification of a defect, fault, or failure pursuant to subdivision (a), the Secretary of State shall notify the United States Election Assistance Commission or its successor
agency of the problem as soon as practicable so as to present a reasonably complete description of the problem. The Secretary of State shall subsequently submit a report regarding the problem to the United States Election Assistance Commission or its successor agency. The report shall include any report regarding the problem submitted to the Secretary of State.
(Amended by Stats. 2016, Ch. 75, Sec. 16. (AB 2252) Effective January 1, 2017.)
If a remote accessible vote by mail system has been certified or conditionally approved by the Secretary of State, it shall not be changed or modified until the Secretary of State has been notified in writing and has determined that the change or modification does not impair its accuracy and efficiency sufficient to require a reexamination and recertification or reapproval pursuant to this chapter. The Secretary of State may adopt rules and regulations governing the procedures to be followed in making his or her determination as to whether the change or modification impairs accuracy or efficiency.
(Amended by Stats. 2016, Ch. 75, Sec. 17. (AB 2252) Effective January 1, 2017.)
The Secretary of State may seek injunctive and administrative relief if a remote accessible vote by mail system has been compromised by the addition or deletion of hardware, software, or firmware without prior approval or is defective due to a known hardware, software, or firmware defect, fault, or failure that has not been disclosed pursuant to Section 19284 or 19290.
(Amended by Stats. 2016, Ch. 75, Sec. 18. (AB 2252) Effective January 1, 2017.)
(a) The Secretary of State may seek all of the following relief for an unauthorized change in hardware, software, or firmware in a remote accessible vote by mail system certified or conditionally approved in California:
(1) A civil penalty from the offending party or parties, not to exceed ten thousand dollars ($10,000) per violation. For purposes of this subdivision, each remote accessible vote by mail system component found to contain the unauthorized hardware, software, or firmware shall be considered a separate violation. A penalty imposed pursuant to this subdivision shall be apportioned 50 percent to the county in which the violation occurred, if applicable, and 50 percent to
the office of the Secretary of State for purposes of bolstering remote accessible vote by mail system security efforts.
(2) Immediate commencement of proceedings to withdraw certification or conditional approval for the remote
accessible vote by mail system in question.
(3) Prohibiting the manufacturer or vendor of a remote accessible vote by mail system from doing elections-related business in the state for one, two, or three years.
(4) Refund of all moneys paid by a local agency for a remote accessible vote by mail system or a part of a
remote accessible vote by mail system that is compromised by an unauthorized change or modification, whether or not the
remote accessible vote by mail system has been used in an election.
(5) Any other remedial actions authorized by law to prevent unjust enrichment of the offending party.
(b) (1) The Secretary of State may seek all of the following relief for a known but undisclosed defect, fault, or failure in a remote accessible vote by mail system or part of a remote accessible vote by mail system certified or conditionally approved in California:
(A) Refund of all moneys paid by a local agency for a remote accessible vote by mail system or part of a remote accessible vote by mail system that is defective due to a known but undisclosed defect, fault, or failure, whether or not the remote
accessible vote by mail system has been used in an election.
(B) A civil penalty from the offending party or parties, not to exceed fifty thousand dollars ($50,000) per violation. For purposes of this subdivision, each defect, fault, or failure shall be considered a separate violation. A defect, fault, or failure constitutes a single violation regardless of the number of remote accessible vote by mail system units in which the defect, fault, or failure is found.
(C) In addition to any other penalties or remedies established by this section, the offending party or parties shall be liable in the amount of one thousand dollars ($1,000) per day after the applicable deadline established in Section 19290 until the required disclosure is filed with the Secretary of State.
(2) A penalty imposed pursuant to subparagraph (B) or (C) of paragraph (1) shall be deposited in the General Fund.
(c) Before seeking any measure of relief under this section, the Secretary of State shall hold a public hearing. The Secretary of State shall give notice of the hearing in the manner prescribed by Section 6064 of the Government Code in a newspaper of general circulation published in Sacramento County. The Secretary of State also shall transmit written notice of the hearing, at least 30 days prior to the hearing, to each county elections official, the offending party or parties, any persons that the Secretary of State believes will be interested in the hearing, and any persons who request, in writing, notice of the hearing.
(d) The decision of the Secretary of State to seek relief under this section shall be in writing and state his or her findings. The decision shall be open to public inspection.
(Amended by Stats. 2016, Ch. 75, Sec. 19. (AB 2252) Effective January 1, 2017.)
(a) The Secretary of State may seek injunctive relief requiring an elections official, or any vendor or manufacturer of a remote accessible vote by mail system, to comply with the requirements of this code, the regulations of the Secretary of State, and the specifications for the ballot marking system and its software, including the programs and procedures for vote marking and testing.
(b) Venue for a proceeding under this section shall be exclusively in Sacramento County.
(Amended by Stats. 2016, Ch. 75, Sec. 20. (AB 2252) Effective January 1, 2017.)
A remote accessible vote by mail system or part of a remote accessible vote by mail system shall not do any of the following:
(a) Have the capability, including an optional capability, to use a remote server to mark a voter’s selections transmitted to the server from the voter’s computer via the Internet.
(b) Have the capability, including an optional capability, to store any voter identifiable selections on any remote server.
(c) Have the capability, including the optional capability, to tabulate votes.
(Amended by Stats. 2016, Ch. 75, Sec. 21. (AB 2252) Effective January 1, 2017.)