Sen. Bill Cunningham
Filed: 3/14/2019
| |||||||
| |||||||
| |||||||
1 | AMENDMENT TO SENATE BILL 18
| ||||||
2 | AMENDMENT NO. ______. Amend Senate Bill 18 by replacing | ||||||
3 | everything after the enacting clause with the following:
| ||||||
4 | "Section 5. The Election Code is amended by changing | ||||||
5 | Section 1A-8 and by adding Section 1A-39 as follows:
| ||||||
6 | (10 ILCS 5/1A-8) (from Ch. 46, par. 1A-8)
| ||||||
7 | Sec. 1A-8. The State Board of Elections shall exercise the | ||||||
8 | following
powers and perform the following duties in addition | ||||||
9 | to any powers or duties
otherwise provided for by law:
| ||||||
10 | (1) Assume all duties and responsibilities of the State | ||||||
11 | Electoral Board
and the Secretary of State as heretofore | ||||||
12 | provided in this Code;
| ||||||
13 | (2) Disseminate information to and consult with | ||||||
14 | election authorities
concerning the conduct of elections | ||||||
15 | and registration in accordance with the
laws of this State | ||||||
16 | and the laws of the United States;
|
| |||||||
| |||||||
1 | (3) Furnish to each election authority prior to each | ||||||
2 | primary and general
election and any other election it | ||||||
3 | deems necessary, a manual of uniform
instructions | ||||||
4 | consistent with the provisions of this Code which shall be | ||||||
5 | used
by election authorities in the preparation of the | ||||||
6 | official manual of
instruction to be used by the judges of | ||||||
7 | election in any such election. In
preparing such manual, | ||||||
8 | the State Board shall consult with representatives
of the | ||||||
9 | election authorities throughout the State. The State Board | ||||||
10 | may
provide separate portions of the uniform instructions | ||||||
11 | applicable to
different election jurisdictions which | ||||||
12 | administer elections under different
options provided by | ||||||
13 | law. The State Board may by regulation require
particular | ||||||
14 | portions of the uniform instructions to be included in any
| ||||||
15 | official manual of instructions published by election | ||||||
16 | authorities. Any
manual of instructions published by any | ||||||
17 | election authority shall be
identical with the manual of | ||||||
18 | uniform instructions issued by the Board, but
may be | ||||||
19 | adapted by the election authority to accommodate special or | ||||||
20 | unusual
local election problems, provided that all manuals | ||||||
21 | published by election
authorities must be consistent with | ||||||
22 | the provisions of this Code in all
respects and must | ||||||
23 | receive the approval of the State Board of Elections
prior | ||||||
24 | to publication; provided further that if the State Board | ||||||
25 | does not
approve or disapprove of a proposed manual within | ||||||
26 | 60 days of its
submission, the manual shall be deemed |
| |||||||
| |||||||
1 | approved.
| ||||||
2 | (4) Prescribe and require the use of such uniform | ||||||
3 | forms, notices, and
other supplies not inconsistent with | ||||||
4 | the provisions of this Code as it shall
deem advisable | ||||||
5 | which shall be used by election authorities in the conduct
| ||||||
6 | of elections and registrations;
| ||||||
7 | (5) Prepare and certify the form of ballot for any | ||||||
8 | proposed amendment to
the Constitution of the State of | ||||||
9 | Illinois, or any referendum to be
submitted to the electors | ||||||
10 | throughout the State or, when required to do so
by law, to | ||||||
11 | the voters of any area or unit of local government of the | ||||||
12 | State;
| ||||||
13 | (6) Require such statistical reports regarding the | ||||||
14 | conduct of elections
and registration from election | ||||||
15 | authorities as may be deemed necessary;
| ||||||
16 | (7) Review and inspect procedures and records relating | ||||||
17 | to conduct of
elections and registration as may be deemed | ||||||
18 | necessary, and to report
violations of election laws to the | ||||||
19 | appropriate State's Attorney or the Attorney General;
| ||||||
20 | (8) Recommend to the General Assembly legislation to | ||||||
21 | improve the
administration of elections and registration;
| ||||||
22 | (9) Adopt, amend or rescind rules and regulations in | ||||||
23 | the performance of
its duties provided that all such rules | ||||||
24 | and regulations must be consistent
with the provisions of | ||||||
25 | this Article 1A or issued pursuant to authority
otherwise | ||||||
26 | provided by law;
|
| |||||||
| |||||||
1 | (10) Determine the validity and sufficiency of | ||||||
2 | petitions filed under
Article XIV, Section 3, of the | ||||||
3 | Constitution of the State of Illinois of 1970;
| ||||||
4 | (11) Maintain in its principal office a research | ||||||
5 | library that includes,
but is not limited to, abstracts of | ||||||
6 | votes by precinct for general primary
elections and general | ||||||
7 | elections, current precinct maps and current precinct
poll | ||||||
8 | lists from all election jurisdictions within the State. The | ||||||
9 | research
library shall be open to the public during regular | ||||||
10 | business hours. Such
abstracts, maps and lists shall be | ||||||
11 | preserved as permanent records and shall
be available for | ||||||
12 | examination and copying at a reasonable cost;
| ||||||
13 | (12) Supervise the administration of the registration | ||||||
14 | and election laws
throughout the State;
| ||||||
15 | (13) Obtain from the Department of Central Management | ||||||
16 | Services,
under Section 405-250 of the Department of | ||||||
17 | Central Management
Services Law (20 ILCS 405/405-250) ,
| ||||||
18 | such use
of electronic data processing equipment as may be | ||||||
19 | required to perform the
duties of the State Board of | ||||||
20 | Elections and to provide election-related
information to | ||||||
21 | candidates, public and party officials, interested civic
| ||||||
22 | organizations and the general public in a timely and | ||||||
23 | efficient manner;
| ||||||
24 | (14) To take such action as may be necessary or | ||||||
25 | required to give
effect to directions of the national | ||||||
26 | committee or State central committee of an established
|
| |||||||
| |||||||
1 | political party under Sections 7-8, 7-11, and 7-14.1 or | ||||||
2 | such other
provisions as may be applicable pertaining to | ||||||
3 | the selection of delegates
and alternate delegates to an | ||||||
4 | established political party's national
nominating | ||||||
5 | conventions or, notwithstanding any candidate | ||||||
6 | certification
schedule contained within this Code, the | ||||||
7 | certification of the
Presidential and Vice
Presidential | ||||||
8 | candidate selected by the established political party's | ||||||
9 | national nominating
convention;
| ||||||
10 | (15) To post all early voting sites separated by | ||||||
11 | election authority and hours of operation on its website at | ||||||
12 | least 5 business days before the period for early voting | ||||||
13 | begins; | ||||||
14 | (16) To post on its website the statewide totals, and | ||||||
15 | totals separated by each election authority, for each of | ||||||
16 | the counts received pursuant to Section 1-9.2; and | ||||||
17 | (17) To post on its website, in a downloadable format, | ||||||
18 | the information received from each election authority | ||||||
19 | under Section 1-17 ; and . | ||||||
20 | (18) On or by February 15 of each year, to provide a | ||||||
21 | single, consolidated report to the Governor and the General | ||||||
22 | Assembly that includes a detailed analysis and accounting | ||||||
23 | from all divisions of all activities from the preceding 12 | ||||||
24 | months, the current state of each division, and a detailed | ||||||
25 | statement of goals and expectations for the coming year | ||||||
26 | from the following divisions of the State Board of |
| |||||||
| |||||||
1 | Elections: Office of Executive Director, Office of the | ||||||
2 | General Counsel, Election Operations, Information | ||||||
3 | Technology, Voting and Registrations Systems, and Campaign | ||||||
4 | Disclosure; the Voting and Registrations Systems division | ||||||
5 | must include in the report an analysis of all activities | ||||||
6 | from the preceding 12 months undertaken to maintain the | ||||||
7 | State's voter registration system and changes resulting | ||||||
8 | from those activities; this analysis shall encompass | ||||||
9 | activities undertaken to update voter registration | ||||||
10 | information and voter status based on: | ||||||
11 | (A) deaths and Social Security Administration | ||||||
12 | data; | ||||||
13 | (B) data exchanged with neighboring states as part | ||||||
14 | of a bilateral data sharing agreement; | ||||||
15 | (C) data exchanged as part of a multi-state data | ||||||
16 | sharing agreement; | ||||||
17 | (D) felony convictions; | ||||||
18 | (E) federal convictions; | ||||||
19 | (F) adjudicated incompetent persons; | ||||||
20 | (G) noncitizens; | ||||||
21 | (H) voter cancellations; | ||||||
22 | (I) change of address; | ||||||
23 | (J) the current state of automatic voter | ||||||
24 | registration; and | ||||||
25 | (K) an analysis of all bilateral and multi-state | ||||||
26 | voter registration data sharing programs to |
| |||||||
| |||||||
1 | demonstrate compliance with the governance, data | ||||||
2 | quality, and security standards set forth in the | ||||||
3 | Electronic Registration Information Center Membership | ||||||
4 | Agreement. | ||||||
5 | The State Board of Elections' report shall contain the | ||||||
6 | methodology used in gathering and analyzing the data; the | ||||||
7 | Executive Director of the State Board of Elections shall | ||||||
8 | certify that the data included in the State Board of | ||||||
9 | Elections' report is accurate and reliable. The State Board | ||||||
10 | of Elections shall post its report on its website on or | ||||||
11 | before February 15. On or before March 31 of each year, the | ||||||
12 | General Assembly shall request the Executive Director of | ||||||
13 | the State Board of Elections and all division heads serving | ||||||
14 | underneath the Executive Director to provide an in-person | ||||||
15 | briefing to a committee of each chamber of the General | ||||||
16 | Assembly, as determined by the leadership of each chamber, | ||||||
17 | concerning the information provided in the report required | ||||||
18 | under this paragraph (18). | ||||||
19 | The Board may by regulation delegate any of its duties or
| ||||||
20 | functions under this Article, except that final determinations | ||||||
21 | and orders
under this Article shall be issued only by the | ||||||
22 | Board.
| ||||||
23 | The requirement for reporting to the General Assembly shall | ||||||
24 | be satisfied
by filing copies of the report as required by | ||||||
25 | Section 3.1 of the General Assembly Organization Act, and
| ||||||
26 | filing such additional copies with the State Government Report |
| |||||||
| |||||||
1 | Distribution
Center for the General Assembly as is required | ||||||
2 | under paragraph (t) of
Section 7 of the State Library Act.
| ||||||
3 | (Source: P.A. 100-623, eff. 7-20-18; 100-863, eff. 8-14-18; | ||||||
4 | 100-1148, eff. 12-10-18.)
| ||||||
5 | (10 ILCS 5/1A-39 new) | ||||||
6 | Sec. 1A-39. Data sharing agreements. | ||||||
7 | As used in this Section: | ||||||
8 | "Information system" means a discrete set of electronic | ||||||
9 | information resources organized for the collection, | ||||||
10 | processing, maintenance, use, sharing, dissemination, or | ||||||
11 | disposition of electronic information. | ||||||
12 | "Multi-factor authentication" means authentication through | ||||||
13 | verification of at least 2 of the following types of | ||||||
14 | authentication factors: | ||||||
15 | (1) knowledge factor, such as a password; | ||||||
16 | (2) possession factor, such as a token or USB key; or | ||||||
17 | (3) inherence factor, such as a biometric | ||||||
18 | characteristic. | ||||||
19 | "Nonpublic voter information" means the following data | ||||||
20 | elements that are not publicly available information: | ||||||
21 | (1) date of birth; | ||||||
22 | (2) full or partial social security number; or | ||||||
23 | (3) driver's license number or non-driver | ||||||
24 | identification card number. | ||||||
25 | "Penetration testing" means a test methodology in which |
| |||||||
| |||||||
1 | assessors attempt to circumvent or defeat the security features | ||||||
2 | of an information system by attempting penetration of systems, | ||||||
3 | networks, databases, software applications, or controls from | ||||||
4 | outside or inside the information system undergoing | ||||||
5 | assessment. | ||||||
6 | (a) The State Board of Elections may enter into the | ||||||
7 | following types of data sharing agreements: | ||||||
8 | (1) multi-state voter data sharing agreements; and | ||||||
9 | (2) bilateral voter data sharing agreements with | ||||||
10 | bordering states that do not participate in a multi-state | ||||||
11 | voter data sharing agreement in which Illinois also | ||||||
12 | participates. | ||||||
13 | (b) A multi-state voter data sharing program that enters | ||||||
14 | into a multi-state voter data sharing agreement with the State | ||||||
15 | Board of Elections must comply with the following governance | ||||||
16 | requirements: | ||||||
17 | (1) The multi-state voter data sharing program must be | ||||||
18 | governed by a board consisting of at least 10 members | ||||||
19 | comprised of election officials from the member states | ||||||
20 | (governing board). | ||||||
21 | (2) Upon joining the multi-state voter data sharing | ||||||
22 | program, an Illinois election official must be appointed to | ||||||
23 | the governing board. | ||||||
24 | (3) The operation of the multi-state voter data sharing | ||||||
25 | program must be performed by an independent team or entity | ||||||
26 | as approved by the governing board, and no single member |
| |||||||
| |||||||
1 | state may absorb any operational responsibility for the | ||||||
2 | overall program. | ||||||
3 | (4) The operational costs of the multi-state voter data | ||||||
4 | sharing program must be collectively funded by all member | ||||||
5 | states. | ||||||
6 | (5) The multi-state voter data sharing program must | ||||||
7 | share security policies, procedures, and relevant | ||||||
8 | certifications with Illinois election officials sufficient | ||||||
9 | to demonstrate compliance with the International | ||||||
10 | Organization for Standardization and the International | ||||||
11 | Electrotechnical Commission 2700 Family of Standards. | ||||||
12 | (6) The multi-state voter data sharing program must | ||||||
13 | have documented policies and procedures to notify all | ||||||
14 | participating state election officials immediately in the | ||||||
15 | event of a data breach or an inadvertent exposure of data. | ||||||
16 | (c) A multi-state voter data sharing program that enters | ||||||
17 | into a multi-state voter data sharing agreement with the State | ||||||
18 | Board of Elections must comply with the following minimum | ||||||
19 | requirements for security and data accuracy: | ||||||
20 | (1) Nonpublic voter information may not be sent to a | ||||||
21 | multi-state voter data sharing program without the | ||||||
22 | application of a cryptographic hash. | ||||||
23 | (2) The multi-state voter data sharing program must | ||||||
24 | require participating states to include, at a minimum, | ||||||
25 | voter name, address, date of birth, and partial social | ||||||
26 | security number (when available on a voter record). |
| |||||||
| |||||||
1 | (3) No voter's unencrypted nonpublic voter information | ||||||
2 | may be transmitted through email or stored in an email | ||||||
3 | system in the course of participation in the multi-state | ||||||
4 | voter data sharing program. | ||||||
5 | (4) Multi-factor authentication must be used by | ||||||
6 | Illinois election officials and staff to access any of the | ||||||
7 | multi-state data sharing program's user interfaces. | ||||||
8 | (5) The multi-state voter data sharing program must | ||||||
9 | conduct a third-party security audit, including | ||||||
10 | penetration testing and a vulnerability assessment. The | ||||||
11 | results of the security audit shall be shared with the | ||||||
12 | Illinois member of the governing board. | ||||||
13 | (6) Before joining a multi-state voter data sharing | ||||||
14 | program, the governing body of the multi-state voter data | ||||||
15 | sharing program must provide the State Board of Elections | ||||||
16 | evidence of the multi-state voter data sharing program's | ||||||
17 | compliance with the security requirements of this | ||||||
18 | subsection. | ||||||
19 | (7) The State Board of Elections shall maintain records | ||||||
20 | sufficient to demonstrate the multi-state voter data | ||||||
21 | sharing program meets all requirements set forth in this | ||||||
22 | Section on an ongoing basis. | ||||||
23 | (8) The multi-state voter data sharing program must | ||||||
24 | provide a data quality report to the governing board that | ||||||
25 | evaluates the quality of the data the multi-state voter | ||||||
26 | data sharing program provides members. The first such |
| |||||||
| |||||||
1 | report must be submitted to the governing body on or before | ||||||
2 | March 1, 2021, and then annually thereafter. | ||||||
3 | (d) A bilateral voter data sharing agreement entered into | ||||||
4 | by the State Board of Elections must comply with the following | ||||||
5 | requirements: | ||||||
6 | (1) Nonpublic voter information may not be shared with | ||||||
7 | election authorities without the application of a | ||||||
8 | cryptographic hash. | ||||||
9 | (2) No voter's unencrypted voter information data may | ||||||
10 | be transmitted through email or stored in an email system | ||||||
11 | in the course of participation of the agreement. | ||||||
12 | (3) If any shared system of data exchange is used, such | ||||||
13 | as a file transfer protocol server or any third-party file | ||||||
14 | storage system, then multi-factor authentication must be | ||||||
15 | used by any Illinois personnel or personnel of the partner | ||||||
16 | state to access or transfer any portions of the voter data | ||||||
17 | exchanged. | ||||||
18 | (4) Illinois must conduct a third-party security audit | ||||||
19 | on an annual basis that includes penetration testing and a | ||||||
20 | vulnerability assessment. | ||||||
21 | (5) The State Board of Elections shall maintain records | ||||||
22 | sufficient to demonstrate that the bilateral voter data | ||||||
23 | agreement meets all requirements of this Section. | ||||||
24 | (e) The State Board of Elections is required to monitor | ||||||
25 | compliance with the governance, security, and reporting | ||||||
26 | requirements of this Section. |
| |||||||
| |||||||
1 | (f) Participation in a multi-state voter data sharing | ||||||
2 | program or a bilateral voter data sharing agreement must be | ||||||
3 | reaffirmed by a majority vote of the State Board of Elections, | ||||||
4 | a majority being defined as a minimum of 5 affirmative votes, | ||||||
5 | on an annual basis. Before a vote, the State Board of Elections | ||||||
6 | must provide documented evidence of the multi-state voter data | ||||||
7 | sharing program's or the bilateral voter data sharing | ||||||
8 | agreement's compliance with the governance, security, and | ||||||
9 | reporting requirements of this Section. A failure to reach a | ||||||
10 | majority affirmation shall result in the immediate termination | ||||||
11 | of the voter data sharing agreement. | ||||||
12 | (g) A multi-state voter data sharing program or a bilateral | ||||||
13 | voter data sharing agreement shall be subject to a | ||||||
14 | cybersecurity audit as provided under Section 3-2.4 of the | ||||||
15 | Illinois State Auditing Act. | ||||||
16 | (h) The State Board of Elections must request an analysis | ||||||
17 | of the partnering states' compliance with the federal National | ||||||
18 | Voter Registration Act of 1993 as it pertains to voter roll | ||||||
19 | maintenance activities from the
Office of the Attorney General. | ||||||
20 | This report must be delivered to the State Board of Elections | ||||||
21 | at least 60 days before any vote to enter into a bilateral | ||||||
22 | voter data sharing agreement or to continue an existing | ||||||
23 | bilateral voter data sharing agreement. The report must be made | ||||||
24 | a part of the public record in a public State Board of | ||||||
25 | Elections meeting before a vote. | ||||||
26 | (i) If a multi-state voter data sharing program no longer |
| |||||||
| |||||||
1 | complies with the governance requirements of subsection (b): | ||||||
2 | (1) The State Board of Elections must immediately cease | ||||||
3 | data exchanges with the multi-state voter data sharing | ||||||
4 | program and initiate any agreed upon withdrawal process. | ||||||
5 | (2) If the issue of non-compliance is corrected, the | ||||||
6 | State Board of Elections may resume participation in the | ||||||
7 | multi-state voter data sharing program by a majority vote. | ||||||
8 | (j) If a multi-state voter data sharing program no longer | ||||||
9 | complies with the security requirements of this Section, has | ||||||
10 | incurred a data breach, or has inadvertently exposed data: | ||||||
11 | (1) The State Board of Elections must immediately cease | ||||||
12 | data exchanges with the multi-state voter data sharing | ||||||
13 | program and initiate any agreed upon withdrawal process. | ||||||
14 | (2) If the issue of noncompliance is corrected, the | ||||||
15 | State Board of Elections may resume participation in the | ||||||
16 | multi-state voter data sharing program or bilateral voter | ||||||
17 | data sharing agreement by a majority vote. | ||||||
18 | (k) If a partner state in a bilateral voter data sharing | ||||||
19 | agreement no longer complies with the security requirements of | ||||||
20 | this Section, has incurred a data breach, or has inadvertently | ||||||
21 | exposed data: | ||||||
22 | (1) The State Board of Elections shall immediately | ||||||
23 | cease exchanging data and request the permanent | ||||||
24 | destruction of any and all Illinois voter data in the | ||||||
25 | possession of the partner state. | ||||||
26 | (2) If the issue of noncompliance is corrected, the |
| |||||||
| |||||||
1 | State Board of Elections may resume participation in the | ||||||
2 | bilateral agreement by majority vote of the State Board of | ||||||
3 | Elections. | ||||||
4 | (l) If a multi-state voter data sharing program does not | ||||||
5 | produce a data quality report within the specified time frame | ||||||
6 | of this Section: | ||||||
7 | (1) The State Board of Elections must immediately cease | ||||||
8 | data exchanges with the multi-state voter data sharing | ||||||
9 | program. | ||||||
10 | (2) If the issue of noncompliance is not corrected | ||||||
11 | within 90 days, the State Board of Elections must initiate | ||||||
12 | any agreed upon withdrawal process. | ||||||
13 | (3) If the issue of noncompliance is corrected, the | ||||||
14 | State Board of Elections may resume participation in the | ||||||
15 | multi-state voter data sharing program by a majority vote. | ||||||
16 | (m) The State Board of Elections may adopt rules to execute | ||||||
17 | voter data sharing agreements.
| ||||||
18 | Section 99. Effective date. This Act takes effect January | ||||||
19 | 1, 2020.".
|