SB0018sam001 101ST GENERAL ASSEMBLY

Sen. Bill Cunningham

Filed: 3/14/2019

10100SB0018sam001 LRB101 06157 SMS 57597 a

AMENDMENT TO SENATE BILL 18

AMENDMENT NO. ______. Amend Senate Bill 18 by replacing everything after the enacting clause with the following:

"Section 5. The Election Code is amended by changing Section 1A-8 and by adding Section 1A-39 as follows:

(10 ILCS 5/1A-8) (from Ch. 46, par. 1A-8)

Sec. 1A-8. The State Board of Elections shall exercise the following powers and perform the following duties in addition to any powers or duties otherwise provided for by law:

(1) Assume all duties and responsibilities of the State Electoral Board and the Secretary of State as heretofore provided in this Code;

(2) Disseminate information to and consult with election authorities concerning the conduct of elections and registration in accordance with the laws of this State and the laws of the United States;

(3) Furnish to each election authority prior to each primary and general election and any other election it deems necessary, a manual of uniform instructions consistent with the provisions of this Code which shall be used by election authorities in the preparation of the official manual of instruction to be used by the judges of election in any such election. In preparing such manual, the State Board shall consult with representatives of the election authorities throughout the State. The State Board may provide separate portions of the uniform instructions applicable to different election jurisdictions which administer elections under different options provided by law. The State Board may by regulation require particular portions of the uniform instructions to be included in any official manual of instructions published by election authorities. Any manual of instructions published by any election authority shall be identical with the manual of uniform instructions issued by the Board, but may be adapted by the election authority to accommodate special or unusual local election problems, provided that all manuals published by election authorities must be consistent with the provisions of this Code in all respects and must receive the approval of the State Board of Elections prior to publication; provided further that if the State Board does not approve or disapprove of a proposed manual within 60 days of its submission, the manual shall be deemed approved.

(4) Prescribe and require the use of such uniform forms, notices, and other supplies not inconsistent with the provisions of this Code as it shall deem advisable which shall be used by election authorities in the conduct of elections and registrations;

(5) Prepare and certify the form of ballot for any proposed amendment to the Constitution of the State of Illinois, or any referendum to be submitted to the electors throughout the State or, when required to do so by law, to the voters of any area or unit of local government of the State;

(6) Require such statistical reports regarding the conduct of elections and registration from election authorities as may be deemed necessary;

(7) Review and inspect procedures and records relating to conduct of elections and registration as may be deemed necessary, and to report violations of election laws to the appropriate State's Attorney or the Attorney General;

(8) Recommend to the General Assembly legislation to improve the administration of elections and registration;

(9) Adopt, amend or rescind rules and regulations in the performance of its duties provided that all such rules and regulations must be consistent with the provisions of this Article 1A or issued pursuant to authority otherwise provided by law;

(10) Determine the validity and sufficiency of petitions filed under Article XIV, Section 3, of the Constitution of the State of Illinois of 1970;

(11) Maintain in its principal office a research library that includes, but is not limited to, abstracts of votes by precinct for general primary elections and general elections, current precinct maps and current precinct poll lists from all election jurisdictions within the State. The research library shall be open to the public during regular business hours. Such abstracts, maps and lists shall be preserved as permanent records and shall be available for examination and copying at a reasonable cost;

(12) Supervise the administration of the registration and election laws throughout the State;

(13) Obtain from the Department of Central Management Services, under Section 405-250 of the Department of Central Management Services Law (20 ILCS 405/405-250), such use of electronic data processing equipment as may be required to perform the duties of the State Board of Elections and to provide election-related information to candidates, public and party officials, interested civic organizations and the general public in a timely and efficient manner;

(14) To take such action as may be necessary or required to give effect to directions of the national committee or State central committee of an established political party under Sections 7-8, 7-11, and 7-14.1 or such other provisions as may be applicable pertaining to the selection of delegates and alternate delegates to an established political party's national nominating conventions or, notwithstanding any candidate certification schedule contained within this Code, the certification of the Presidential and Vice Presidential candidate selected by the established political party's national nominating convention;

(15) To post all early voting sites separated by election authority and hours of operation on its website at least 5 business days before the period for early voting begins;

(16) To post on its website the statewide totals, and totals separated by each election authority, for each of the counts received pursuant to Section 1-9.2; and

(17) To post on its website, in a downloadable format, the information received from each election authority under Section 1-17; and .

(18) On or by February 15 of each year, to provide a single, consolidated report to the Governor and the General Assembly that includes a detailed analysis and accounting from all divisions of all activities from the preceding 12 months, the current state of each division, and a detailed statement of goals and expectations for the coming year from the following divisions of the State Board of Elections: Office of Executive Director, Office of the General Counsel, Election Operations, Information Technology, Voting and Registrations Systems, and Campaign Disclosure; the Voting and Registrations Systems division must include in the report an analysis of all activities from the preceding 12 months undertaken to maintain the State's voter registration system and changes resulting from those activities; this analysis shall encompass activities undertaken to update voter registration information and voter status based on:

(A) deaths and Social Security Administration data;

(B) data exchanged with neighboring states as part of a bilateral data sharing agreement;

(C) data exchanged as part of a multi-state data sharing agreement;

(D) felony convictions;

(E) federal convictions;

(F) adjudicated incompetent persons;

(G) noncitizens;

(H) voter cancellations;

(I) change of address;

(J) the current state of automatic voter registration; and

(K) an analysis of all bilateral and multi-state voter registration data sharing programs to demonstrate compliance with the governance, data quality, and security standards set forth in the Electronic Registration Information Center Membership Agreement.

The State Board of Elections' report shall contain the methodology used in gathering and analyzing the data; the Executive Director of the State Board of Elections shall certify that the data included in the State Board of Elections' report is accurate and reliable. The State Board of Elections shall post its report on its website on or before February 15. On or before March 31 of each year, the General Assembly shall request the Executive Director of the State Board of Elections and all division heads serving underneath the Executive Director to provide an in-person briefing to a committee of each chamber of the General Assembly, as determined by the leadership of each chamber, concerning the information provided in the report required under this paragraph (18).

The Board may by regulation delegate any of its duties or functions under this Article, except that final determinations and orders under this Article shall be issued only by the Board.

The requirement for reporting to the General Assembly shall be satisfied by filing copies of the report as required by Section 3.1 of the General Assembly Organization Act, and filing such additional copies with the State Government Report Distribution Center for the General Assembly as is required under paragraph (t) of Section 7 of the State Library Act.

(Source: P.A. 100-623, eff. 7-20-18; 100-863, eff. 8-14-18; 100-1148, eff. 12-10-18.)

(10 ILCS 5/1A-39 new)

Sec. 1A-39. Data sharing agreements.

As used in this Section:

"Information system" means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic information.

"Multi-factor authentication" means authentication through verification of at least 2 of the following types of authentication factors:

(1) knowledge factor, such as a password;

(2) possession factor, such as a token or USB key; or

(3) inherence factor, such as a biometric characteristic.

"Nonpublic voter information" means the following data elements that are not publicly available information:

(1) date of birth;

(2) full or partial social security number; or

(3) driver's license number or non-driver identification card number.

"Penetration testing" means a test methodology in which assessors attempt to circumvent or defeat the security features of an information system by attempting penetration of systems, networks, databases, software applications, or controls from outside or inside the information system undergoing assessment.

(a) The State Board of Elections may enter into the following types of data sharing agreements:

(1) multi-state voter data sharing agreements; and

(2) bilateral voter data sharing agreements with bordering states that do not participate in a multi-state voter data sharing agreement in which Illinois also participates.

(b) A multi-state voter data sharing program that enters into a multi-state voter data sharing agreement with the State Board of Elections must comply with the following governance requirements:

(1) The multi-state voter data sharing program must be governed by a board consisting of at least 10 members comprised of election officials from the member states (governing board).

(2) Upon joining the multi-state voter data sharing program, an Illinois election official must be appointed to the governing board.

(3) The operation of the multi-state voter data sharing program must be performed by an independent team or entity as approved by the governing board, and no single member state may absorb any operational responsibility for the overall program.

(4) The operational costs of the multi-state voter data sharing program must be collectively funded by all member states.

(5) The multi-state voter data sharing program must share security policies, procedures, and relevant certifications with Illinois election officials sufficient to demonstrate compliance with the International Organization for Standardization and the International Electrotechnical Commission 2700 Family of Standards.

(6) The multi-state voter data sharing program must have documented policies and procedures to notify all participating state election officials immediately in the event of a data breach or an inadvertent exposure of data.

(c) A multi-state voter data sharing program that enters into a multi-state voter data sharing agreement with the State Board of Elections must comply with the following minimum requirements for security and data accuracy:

(1) Nonpublic voter information may not be sent to a multi-state voter data sharing program without the application of a cryptographic hash.

(2) The multi-state voter data sharing program must require participating states to include, at a minimum, voter name, address, date of birth, and partial social security number (when available on a voter record).

(3) No voter's unencrypted nonpublic voter information may be transmitted through email or stored in an email system in the course of participation in the multi-state voter data sharing program.

(4) Multi-factor authentication must be used by Illinois election officials and staff to access any of the multi-state data sharing program's user interfaces.

(5) The multi-state voter data sharing program must conduct a third-party security audit, including penetration testing and a vulnerability assessment. The results of the security audit shall be shared with the Illinois member of the governing board.

(6) Before joining a multi-state voter data sharing program, the governing body of the multi-state voter data sharing program must provide the State Board of Elections evidence of the multi-state voter data sharing program's compliance with the security requirements of this subsection.

(7) The State Board of Elections shall maintain records sufficient to demonstrate the multi-state voter data sharing program meets all requirements set forth in this Section on an ongoing basis.

(8) The multi-state voter data sharing program must provide a data quality report to the governing board that evaluates the quality of the data the multi-state voter data sharing program provides members. The first such report must be submitted to the governing body on or before March 1, 2021, and then annually thereafter.

(d) A bilateral voter data sharing agreement entered into by the State Board of Elections must comply with the following requirements:

(1) Nonpublic voter information may not be shared with election authorities without the application of a cryptographic hash.

(2) No voter's unencrypted voter information data may be transmitted through email or stored in an email system in the course of participation of the agreement.

(3) If any shared system of data exchange is used, such as a file transfer protocol server or any third-party file storage system, then multi-factor authentication must be used by any Illinois personnel or personnel of the partner state to access or transfer any portions of the voter data exchanged.

(4) Illinois must conduct a third-party security audit on an annual basis that includes penetration testing and a vulnerability assessment.

(5) The State Board of Elections shall maintain records sufficient to demonstrate that the bilateral voter data agreement meets all requirements of this Section.

(e) The State Board of Elections is required to monitor compliance with the governance, security, and reporting requirements of this Section.

(f) Participation in a multi-state voter data sharing program or a bilateral voter data sharing agreement must be reaffirmed by a majority vote of the State Board of Elections, a majority being defined as a minimum of 5 affirmative votes, on an annual basis. Before a vote, the State Board of Elections must provide documented evidence of the multi-state voter data sharing program's or the bilateral voter data sharing agreement's compliance with the governance, security, and reporting requirements of this Section. A failure to reach a majority affirmation shall result in the immediate termination of the voter data sharing agreement.

(g) A multi-state voter data sharing program or a bilateral voter data sharing agreement shall be subject to a cybersecurity audit as provided under Section 3-2.4 of the Illinois State Auditing Act.

(h) The State Board of Elections must request an analysis of the partnering states' compliance with the federal National Voter Registration Act of 1993 as it pertains to voter roll maintenance activities from the Office of the Attorney General. This report must be delivered to the State Board of Elections at least 60 days before any vote to enter into a bilateral voter data sharing agreement or to continue an existing bilateral voter data sharing agreement. The report must be made a part of the public record in a public State Board of Elections meeting before a vote.

(i) If a multi-state voter data sharing program no longer complies with the governance requirements of subsection (b):

(1) The State Board of Elections must immediately cease data exchanges with the multi-state voter data sharing program and initiate any agreed upon withdrawal process.

(2) If the issue of non-compliance is corrected, the State Board of Elections may resume participation in the multi-state voter data sharing program by a majority vote.

(j) If a multi-state voter data sharing program no longer complies with the security requirements of this Section, has incurred a data breach, or has inadvertently exposed data:

(1) The State Board of Elections must immediately cease data exchanges with the multi-state voter data sharing program and initiate any agreed upon withdrawal process.

(2) If the issue of noncompliance is corrected, the State Board of Elections may resume participation in the multi-state voter data sharing program or bilateral voter data sharing agreement by a majority vote.

(k) If a partner state in a bilateral voter data sharing agreement no longer complies with the security requirements of this Section, has incurred a data breach, or has inadvertently exposed data:

(1) The State Board of Elections shall immediately cease exchanging data and request the permanent destruction of any and all Illinois voter data in the possession of the partner state.

(2) If the issue of noncompliance is corrected, the State Board of Elections may resume participation in the bilateral agreement by majority vote of the State Board of Elections.

(l) If a multi-state voter data sharing program does not produce a data quality report within the specified time frame of this Section:

(1) The State Board of Elections must immediately cease data exchanges with the multi-state voter data sharing program.

(2) If the issue of noncompliance is not corrected within 90 days, the State Board of Elections must initiate any agreed upon withdrawal process.

(3) If the issue of noncompliance is corrected, the State Board of Elections may resume participation in the multi-state voter data sharing program by a majority vote.

(m) The State Board of Elections may adopt rules to execute voter data sharing agreements.

Section 99. Effective date. This Act takes effect January 1, 2020.".