HF 2174 (LSB 5801YH (4) 89)

HOUSE FILE 2174

BY  SALMON, CISNEROS, SHIPLEY, and WESTRICH

A BILL FOR

An Act relating to the auditing of election management systems and including effective date provisions.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  ELECTION MANAGEMENT SYSTEMS —— AUDITING.
   1.  The state commissioner of elections shall commission an independent private cyber security firm to perform an audit of election management systems in nine counties, randomly selected as follows:
   a.  Three counties with a population of forty thousand or greater, one of which utilizes systems manufactured by unisyn, one of which utilizes systems manufactured by election systems and software, and one of which utilizes systems manufactured by dominion.
   b.  Three counties with a population of greater than ten thousand but fewer than forty thousand, one of which utilizes systems manufactured by unisyn, one of which utilizes systems manufactured by election systems and software, and one of which utilizes systems manufactured by dominion.
   c.  Three counties with a population of ten thousand or fewer, one of which utilizes systems manufactured by unisyn, one of which utilizes systems manufactured by election systems and software, and one of which utilizes systems manufactured by dominion.
   2.  The audit shall capture a forensic image of examined election management systems, which shall include voting machines, software, and servers, and which shall cover the time period beginning on September 1, 2020, and ending on the day the image is created. The server traffic of the forensic image shall be analyzed, including packet captures showing whether all activity was authorized and showing the origin of each internet service protocol address present on the image.
   3.  The state commissioner of elections shall publish necessary qualifications that an independent private cyber security firm must meet to perform an audit under this section.
   4.  The state commissioner shall request proposals from independent private cyber security firms to perform an audit under this section, and shall select a firm that meets the requirements published pursuant to subsection 3.
   5.  The independent private cyber security firm selected by the state commissioner of elections shall submit a report of its findings to the state commissioner of elections and general assembly by October 1, 2022.
    Sec. 2.  EFFECTIVE DATE.  This Act, being deemed of immediate importance, takes effect upon enactment.
EXPLANATION
The inclusion of this explanation does not constitute agreement with
the explanation’s substance by the members of the general assembly.
   This bill relates to audits of county voting systems. The bill requires the state commissioner of elections to request proposals from independent cyber security firms to perform forensic audits of county voting systems. The bill includes requirements for which systems shall be audited. The state commissioner of elections shall publish requirements that an independent cyber security firm must meet in order to perform the audit. The firm selected by the state commissioner of elections shall capture a forensic image of the voting systems to be examined and shall analyze the server traffic in the image, including packet captures and the origin of each internet security protocol address that accessed the server. The firm shall submit a report of its findings to the state commissioner of elections and the general assembly by October 1, 2022.
   The bill takes effect upon enactment.