ELVIS

1
ELVIS

• 2007 KS PKI Clinic
• 10-22-2007
• Mike Stewart
• Chief Information Officer
• Kansas Secretary of State
• Kathy Peckman
• Master County Clerk, Miami County, KS

2
The Law
Each state, acting through
its chief state election official,
shall implement, in a uniform
and nondiscriminatory manner,
a
3
uniform,
single,
centralized,
official,
interactive,
computerized
statewide
voter registration list
4
defined,
maintained,
and administered
at the state level
Public Law 107-252, Title III, Sec. 303(a)
5
EL
ection
V
oter
I
nformation
S
ystem
6
The ELVIS System

• Requirements set by county workgroup
• Voter Registration, Election Management
• Designed to meet the core requirements of every
  county large, medium, small
• Election Systems Software (ESS)
• HAVA requirements implemented 12/2005
• Automated processing
• Agency Interfaces KDOR, KDOC, KDHE
• Statewide Duplicate Check

7
Risk Assessment

• Security
• Voter registration data
• interfaces to driver license, death felon
  records
• Authentication
• I am who I say I am, cant say didnt do it
  audit log
• Vetting of Identity

8
Requirements

• Included in RFP
• Must have KS PKI certificate to see ELVIS
  system
• Portability
• Election office front counter, temporary workers

9
Implementation

• Vetting contracts between SOS, counties
• Verisign USB Token Based system
• Portability
• Certificate private key not exportable from token
• PIN for two factor authentication
• Certificate must have additional
• field, same as in active directory
• Lessons Learned
• Technical process, must follow instructions
  EXACTLY
• Software on workstation
• Token lifecycle forgotten PIN, distribution,
  temp workers

10
ELVIS Security
11
I do NOT like security!

• My job is to get people registered to vote!
• My other job is to run a clean election!
• My other job is . . . Well. . . . 5 other things
  you dont want to know about!

12
HOWEVER.

• My office IS responsible for good, clean, private
  records that are OPEN records.
• With PKI the integrity of MY records is
  maintained
• AND I dont have to be a security expert!

13
PKI and the Election Officer

• I can control who has input to my countys data
  because I have control of who has a token and a
  certificate
• Permanent staff and temporary staff can be
  monitored for accuracy with PKI
• PKI lets me be do MY job.
• PKI is 24/7 even when Im not

14
Questions?