CHAPTER 04 – VOTING EQUIPMENT
SECTION .0100 - USE OF MECHANICAL VOTING MACHINES
08 ncac 04 .0101 TYPE OF VOTING MACHINES ALLOWED
08 ncac 04 .0102 CUSTODY OF VOTING MACHINES
08 ncac 04 .0103 INSTRUCTING PRECINCT OFFICIALS ON THE USE OF VOTING MACHINES
08 ncac 04 .0104 BALLOT LABELS FOR USE ON VOTING MACHINES
08 ncac 04 .0105 ARRANGEMENT OF POLLING PLACE WHERE VOTING MACHINES ARE USED
08 ncac 04 .0106 DELIVERY AND INSPECTION OF VOTING MACHINES
08 ncac 04 .0107 DIRECTIONS FOR VOTING WHEN MACHINES ARE USED
08 ncac 04 .0108 COUNTING OF VOTES AND PREPARING RETURNS; ABSENTEE VOTES
08 ncac 04 .0109 COLLECTION OF VOTING MACHINES AND KEYS AFTER ELECTION
History Note: Authority G.S. 163-160; 163-161;
Eff. March 12, 1976;
Temporary Repeal Eff. April 15, 2002;
Repealed Eff. August 1, 2004.
SECTION .0200 ‑ USE OF PUNCH‑CARD VOTING EQUIPMENT
08 ncac 04 .0201 DEFINITIONS
08 ncac 04 .0202 AUTHORITY TO PURCHASE AND LEASE EQUIPMENT
08 ncac 04 .0203 VOTE RECORDERS:TABULATING:COUNTING DEVICES
08 ncac 04 .0204 BALLOT LABELS:IDENTIFICATIONS
08 ncac 04 .0205 PREPARATION FOR ELECTIONS:PRECINCT ELECTION OFFICERS
08 ncac 04 .0206 PROCEDURE AT THE POLLING PLACE
08 ncac 04 .0207 COLLECTION OF VOTING EQUIPMENT AFTER ELECTION
08 ncac 04 .0208 MANUFACTURERS REQUIRED TO PRESENT RULES
History Note: Authority G.S. 163-160; 163-161;
Eff. March 12, 1976;
Temporary Repeal Eff. April 15, 2002;
Repealed Eff. August 1, 2004.
section .0300 – approval and operation of voting systems
08 ncac 04 .0301 REQUIREMENTS OF VOTING SYSTEMS
Any voting system used in any election in North Carolina shall be constructed to fulfill the following requirements:
(1) It shall be designed to reasonably secure secrecy of the voter in the act of voting;
(2) It shall enable the voter to vote a straight party ticket in a general election;
(3) It shall require the voter to vote for the candidates for president and vice-president separately from the straight party vote;
(4) It shall provide capacity for listing of all nominees of all recognized political parties and other lawful candidates;
(5) It shall, except in primary elections, permit the voter to vote for all the candidates of one party, or in part for the candidates of one or more other parties;
(6) It shall permit the voter to vote for only as many persons for an office as the voter chooses and is lawfully entitled to vote for;
(7) It shall prevent the voter from voting for the same persons more than once for the same office;
(8) It shall permit the voter to vote for or against only the question(s) the voter may have the right to vote;
(9) It shall permit each voter in a general election but not in a primary, to write in the name of persons for whom he desires to vote, whose names do not appear upon the ballot, except where prohibited by G.S. 163-123 or other statutes;
(10) It shall be equipped for use in primary elections so that the voter may vote only in the primary election to which the voter is entitled to vote;
(11) When properly operated, it shall correctly register or record, and accurately count all votes cast for all ballot items;
(12) It shall contain a visible public counter that shall show at all times during an election the number of persons who have voted;
(13) It shall clearly indicate to the voter during the act of voting the ballot items the voter has selected;
(14) Vote totals for each ballot item shall be contained by a method that is locked and concealed at all times during the time the polls are open;
(15) It shall meet current Federal Voting System Standards or other applicable Federal Standards;
(16) It shall be suitably designed and durably constructed for the conduct of elections; and
(17) It shall be equipped to provide retrievable ballots during absentee voting where an absentee voter's ballot is linked to that voter for possible retrieval if it becomes necessary to take action as to that cast ballot.
History Note: Authority G.S. 163-22; 163-165.7;
Temporary Adoption Eff. April 15, 2002;
Eff. August 1, 2004.
08 NCAC 04 .0302 APPROVAL OF VOTING SYSTEMS
(a) Before approving a voting system for use in North Carolina, the State Board of Elections shall do all of the following:
(1) Obtain a current financial statement from the proposed vendor and manufacturer's contact information (mail address, telephone and fax numbers, email address);
(2) Cause staff to review and appraise the voting system;
(3) Witness a demonstration of the voting system by the proposed vendor;
(4) Obtain a copy of Independent Testing Authority certification as authorized by National Association of State Elections Directors or Federal Agency;
(5) Ensure that a copy of the system's source code is held in escrow by a third party approved by the State Board of Elections for the purpose of taking custody of all source codes, including all revisions or modifications of source codes. Proprietary information is not subject to North Carolina Public Records laws;
(6) Any discussion of proprietary information by the State Board of Elections shall take place in Closed Session as authorized by the Open Meetings requirements of North Carolina law;
(7) Ensure performance of system complies with North Carolina laws and rules related to voting systems;
(8) Obtain a copy of the manufacturer's instructions and maintenance manual;
(9) Obtain a list of all jurisdictions currently using the voting system; and
(10) Review any other information made available to the Board.
(b) Modifications or Enhancement of Voting Systems. A change to any voting system or unit, including software and hardware modification, shall be submitted in writing for the review of the Executive Director of the State Board of Elections. Following the review, the Executive Director shall determine whether the change is a modification of the voting system as certified by the State Board of Elections. If it is determined to be a modification, the voting system as modified shall be submitted to the State Board of Elections for approval. If the Executive Director shall determine the change is an enhancement that does not substantially alter the voting system as certified by the State Board of Elections, the Executive Director may approve the enhancement and the review of the State Board of Elections shall not be required.
(c) Disapproval of Voting System. The State Board of Elections shall have the right to hear and act on complaints arising by petition or otherwise, on the failure or neglect of a voting system or vendor marketing a system to comply with any part of the election laws of the State of North Carolina or for any other satisfactory cause, including but not limited to, performance of the system in an election setting. Before exercising this power, the State Board of Elections shall notify the voting system vendor and/or county boards of elections affected and give opportunity to be heard at a hearing to be set by the State Board of Elections.
History Note: Authority G.S. 163-22; 163-165.7;
Temporary Adoption Eff. April 15, 2002;
Eff. August 1, 2004.
08 ncac 04 .0303 OFFICIAL BALLOT(S) TO BE USED ON VOTING SYSTEM
History Note: Authority G.S. 163-22; 163-165.6;
Temporary Adoption Eff. April 15, 2002;
Eff. August 1, 2004;
Expired Eff. February 1, 2017 pursuant to G.S. 150B-21.3A.
08 ncac 04 .0304 OPERATION AND MATTER OF VOTING ON VOTING SYSTEMS
(a) Prior to the opening of the polls, the precinct officials shall open the voting system and examine the ballot for accuracy and examine the counters or other method to determine there is a zero balance. Any persons interested in viewing this procedure may observe but shall not interfere or impede the process. If the system prints a zero tape or other paper document, the document shall be maintained and secured in the manner prescribed by the manufacturer and the county board of elections.
(b) The voter shall follow the instructions contained on the voting system. Only official ballots shall be introduced into the voting system. Spoiled or damaged ballots shall not be introduced into the voting system. If a voter improperly marks or damages a ballot, it shall be returned to the precinct official, marked as spoiled and maintained as specified by the county board of elections. The voter may not receive a replacement ballot until the spoiled or damaged ballot is returned to the precinct official. The voter shall not be given more than three replacement ballots.
(c) Except as provided for curbside voting in G.S. 163-166.9, official ballots shall not leave the voting enclosure during the time that voting is being conducted there.
History Note: Authority G.S. 163-22; 163-165.7;
Temporary Adoption Eff. April 15, 2002;
Eff. August 1, 2004;
Readopted Eff. June 1, 2019.
08 ncac 04 .0305 INSTRUCTION OF PRECINCT OFFICIALS AND VOTERS IN THE USE OF VOTING SYSTEMS
(a) The chair of the county board of elections in a county where a voting system is used shall conduct an instructional meeting before any primary or election to instruct the precinct officials in the use of the voting system. The chair may use any persons deemed knowledgeable or useful to the instruction of the precinct officials. The instructions on the use and operation of the voting system shall be according to manufacturer's instructions furnished with the voting system, whether the system is purchased or leased by the county board of elections. The training shall be sufficient such that the precinct officials shall be qualified to instruct the voters on the use of the voting system.
(b) The chair of the county board of elections shall not permit a voting system to be used in any precinct in any election unless the chair is satisfied that the precinct officials of the precinct have learned to use and operate the system in accordance with the manufacturer's instructions. The county board of elections may require that precinct officials receive additional instruction on the use and operation of voting systems.
(c) A voter may request instruction for the proper use of the voting system from a precinct official. The precinct official shall provide such technical instruction to the voter but shall not seek to influence or intimidate the voter in any manner.
History Note: Authority G.S. 163-22; 163-165.7;
Temporary Adoption Eff. April 15, 2002;
Eff. August 1, 2004;
Readopted Eff. June 1, 2019.
08 ncac 04 .0306 DUTIES OF CUSTODIANS OF VOTING SYSTEMS
(a) The chair of the county board of elections shall be responsible for the safekeeping, storage, maintenance and care of the voting system. The voting system shall be stored in a location such that access is restricted to county board of elections staff and the system cannot be tampered with when not in use on election day. The county board of elections may appoint as many persons as determined necessary for the maintenance, storage and care of the voting system and for the preparation and testing of the voting system and delivery to the voting precincts preceding a primary or an election. Persons employed for this purpose shall be compensated for their services as authorized by the county board of elections.
(b) On election day when the system is used for voting purposes and until the chair of the county board collects the system, the voting system shall be under the supervision and control of the chief judge unless the county board of elections authorizes another elections official to have supervision and control.
History Note: Authority G.S. 163-23; 163-165.7;
Temporary Adoption Eff. April 15, 2002;
Eff. August 1, 2004;
Readopted Eff. June 1, 2019.
08 ncac 04 .0307 TESTING OF VOTING SYSTEM BEFORE USE IN AN ELECTION
(a) The county board of elections shall test, or supervise the testing, of each voting system or unit that will be used in the election to ensure that the system is operational and has been programmed to count votes accurately. For the purpose of this Rule, "accurately" means in accordance with the procedures for Logic and Accuracy Testing as outlined in the North Carolina State Topical Elections Processes and Procedures (STEPPS) manual. There shall be a record maintained along with the voted and unvoted ballots at the county board of elections office that shall include, at a minimum, the following information:
(1) the dates, times and method of testing used;
(2) the results of the test; and
(3) the names of the persons conducting the test.
(b) Any interested person may observe the testing of the voting system but shall not interfere with or impede the process. For the purpose of testing a voting system prior to the purchase or lease of the system, testing at a one-stop absentee voting site shall fulfill the requirement to test the voting system in a precinct within the county.
History Note: Authority G.S. 163-22; 163-165.7;
Temporary Adoption Eff. April 15, 2002;
Eff. August 1, 2004;
Readopted Eff. June 1, 2019.
08 NCAC 04 .0308 AUTHORIZED ACCESS TO VOTING SYSTEM INFORMATION IN ESCROW
(a) Subject to the provisions of this Rule, upon written request from a person or entity authorized under G.S. 163-165.7(a)(6) to a vendor of a certified voting system in this state, the vendor shall make available for review and examination any information placed in escrow under G.S. 163-165.9A to an authorized person. The person or entity making the request shall simultaneously provide a copy of the request to the State Board. Any request from the State chairs of a political party recognized under G.S. 163-96 shall be made no later than 90 days before the start of early voting in the state. This Rule does not address or restrict the pre-certification review of a vendor's source code under G.S. 163-165.7(e).
(b) Authorized Persons. Only authorized persons may review and examine the information placed in escrow by a voting system vendor. For the purpose of this Rule, "authorized person" means a person who:
(1) Is an agent:
(A) designated by majority vote in a public meeting by the State Board or a purchasing county's board of commissioners;
(B) designated in writing by the chair of a political party recognized under G.S. 163-96; or
(C) designated in writing by the Secretary of Department of Information Technology. No more than three people may be designated by an authorized entity under G.S. 163-165.7(f)(9);
(2) Has submitted to a criminal history record check, to be facilitated by the State Board, as provided for in G.S. 163-27.2(b) and has not been convicted of a disqualifying offense. Disqualifying offenses shall be all felonies, and any misdemeanors that involve theft, deception, the unlawful concealment or dissemination of information, falsification or destruction of records, or the unlawful access to information or facilities. The requirement to submit to a criminal history record check does not apply to State employees who have already submitted to a criminal history record check for State employment;
(3) Has submitted to the State Board a résumé detailing the person's experience with voting systems and information technology, to include any training or experience pertaining to computer code development or analysis;
(4) Has submitted to the State Board a sworn affidavit, under penalty of perjury, attesting that the person:
(A) has never been found by a court of law, administrative body, or former or current employer to have disclosed without authorization confidential information that the person had access to;
(B) has never been, either in their private capacity or in any capacity as an agent for another person or entity, subject to any civil or criminal claims alleging misappropriation of a trade secret, violation of confidentiality agreement or nondisclosure agreement, copyright infringement, patent infringement, or unauthorized disclosure of any information protected from disclosure by law, except to the extent any such claims were dismissed with prejudice and not pursuant to a settlement agreement;
(C) has never had a security clearance issued by a federal agency revoked for any reason other than expiration of the clearance;
(D) if granted access to review and examine the information placed in escrow, will not disclose or reveal any proprietary information to which the Authorized Person is granted access, pursuant to G.S. 132-1.2, to any person outside of the individuals or entities identified in G.S. 163-165.7(a)(6), testing and certification program staff at the U.S. Election Assistance Commission, election infrastructure security staff for the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security, or a court of law using the court's procedures to file such information under seal;
(E) will not disclose or reveal any feature, component, or perceived flaw or vulnerability of the information placed in escrow by a voting system vendor, pursuant to G.S. 132-1.7(a2), G.S. 132-1.7(b), and G.S. 132-6.1(c), to any person outside of other persons authorized under this Rule, the State Board, the vendor, testing and certification program staff at the U.S. Election Assistance Commission, election infrastructure security staff for the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security, or a court of law using the court's procedures to file such information under seal;
(F) will submit copies of any notes taken during the examination of the information in escrow to the State Board;
(G) acknowledges that, should the person disclose any information placed in escrow that is protected under state or federal law in contravention of Part (b)(4)(D) or (E) of this Rule, the person will be subject to any remedies provided by law which could include monetary damages; and
(H) will provide the vendor and the State Board with prompt written notice if the person becomes or is likely to be compelled by law to disclose any of the escrow information, will cooperate with the vendor and the State Board to obtain a protective order or other appropriate remedy, and, in the event any escrow information must be disclosed pursuant to legal compulsion, will disclose only the portion of information that the person is legally required to disclose in the written opinion of its counsel; and
(5) Consents in writing to searches of their person and effects, similar in nature to searches that members of the public submit to when entering the office buildings of the General Assembly, to be conducted upon entry into the secure facility described in Subparagraph (d)(1) of this Rule; and
(6) Is a citizen of the United States.
(c) Within 30 days of meeting the definition of an authorized person in Paragraph (b) of this Rule, the Executive Director of the State Board shall issue a written authorization to the person or entity making the request under Paragraph (a) of this Rule to review and examine information placed in escrow by a voting system vendor. The authorization shall be presented by the person or entity to the vendor prior to gaining access to such information under this Rule.
(d) Conditions of Access. When providing access to information in escrow pursuant to this Rule, the State Board and vendor shall ensure the following conditions are met:
(1) The information in escrow shall be made available by the vendor on up to three computers provided by the vendor (one for each potentially designated agent under G.S. 163-165.7(f)(9)) that are not connected to any network and are located within a secure facility, as described in Subparagraph (d)(3) of this Rule , designated by the State Board of Elections. Such computers shall be preloaded with software tools necessary for use in viewing, searching, and analyzing the information subject to review, including tools permitting automated source code review. Such computers shall have the following access controls:
(A) Credentials shall be traceable to individuals. Generic login accounts are not authorized. Sharing of accounts and reuse of credentials is prohibited. Each user must have their own assigned login account.
(B) Only one administrative account shall be present on the system to allow for the initial provisioning of necessary applications and setup of security controls.
(C) Where passwords are used to authenticate authorized individuals, login accounts shall use complex passwords. A sufficiently complex password is one that is not based on common dictionary words and includes no fewer than 10 characters, and includes at least one uppercase letter, one lowercase letter, one number, and a special character.
(D) Screen lock times shall be set to no longer than 10 minutes.
(E) All computers shall be locked or logged out from whenever they are not being attended and used.
(F) The entire hard drive on any computer must have full disk encryption. Where possible, the minimum encryption level shall be AES-256.
(G) After the information subject to review and software tools for viewing are loaded on the computers, all ports shall be sealed with tamper-evident seals.
(H) After the ports are sealed, no input/output or recording devices may be connected to the computers. The State Board shall provide for the secure storage of any equipment used for the duration of the review.
(2) The computers shall be air-gapped and shall not be connected to a network, and any feature allowing connection to a network shall be disabled. Prohibited network connections include the Internet, intranet, fax, telephone line, networks established via modem, or any other wired or wireless connection.
(3) The secure facility designated by the State Board under Subparagraph (1) of this Paragraph is the specific location where the computing equipment will be stored and the review conducted, and may be a secured portion of a building. All conduct within the facility shall meet the following conditions:
(A) For the entire review period, the facility shall be secured from access by any person not designated under Subparagraph (b)(1), Part (d)(3)(G), and Subparagraph (d)(7) of this Rule.
(B) Only individuals authorized under Subparagraph (b)(1), Part (d)(3)(G), and Subparagraph (d)(7) of this Rule may enter the facility. Such individuals shall present government-issued photo identification upon initial entry, and may be asked to show identification multiple times throughout the review period.
(C) Each time an individual accesses the facility, the State Board or its designee shall record the name of the individual, the time of their entry, the time of their departure, and a description of any materials brought in or out of the facility.
(D) All equipment used in the review, as specified in Subparagraph (d)(1) of this Rule, must remain in the facility during the review period.
(E) No authorized person pursuant to this Rule shall possess any removable media device, cell phone, computer, tablet, camera, wearable, or other outside electronic device within the facility where the person is accessing information in escrow.
(F) No authorized person shall attempt to connect the computers used in the review to any network.
(G) State personnel who are designated by the Executive Director of the State Board of Elections and who also satisfy the conditions set forth in Subparagraphs (b)(2) through (b)(5) shall have access to the facility where the review is being conducted at all times, to monitor the process and ensure that all requirements of this Rule are complied with.
(H) Persons entering the facility shall submit to inspection, as provided for in Subparagraph (b)(5), and shall be denied entry if they possess any unauthorized devices.
(I) State personnel designated pursuant to this subsection shall inspect the computers used in the review before and after the review for compliance with Subparagraphs (d)(1) and (d)(2).
(4) Authorized persons are permitted to perform manual source code review, and use code analysis tools as provided in Subparagraph (1) of this Paragraph, to analyze the source code. This source code review shall be performed using "read only" access and any authorized person shall use only the analysis tools preloaded on the computers, as described in Subparagraph (1) of this Paragraph, to examine the information placed in escrow.
(5) Any review performed pursuant to this Rule shall occur during the State Board's regular business hours and shall last no longer than 10 business days. Such review shall not occur during the period from the start of early voting through the conclusion of statewide canvassing of the vote.
(6) Authorized persons and the vendor are each responsible for bearing their own costs in conducting the review pursuant to G.S. 163-165.7(a)(6).
(7) Up to three representatives of the vendor may be designated in writing to the State Board by a corporate executive of the vendor to supervise the review at all times. Such representatives shall not interfere with the review and shall be afforded an opportunity to inspect the facility for compliance with these conditions prior to the review commencing. State Board staff designated under Subparagraph (3) of this Paragraph shall monitor the review, without obstructing the review process.
(e) Dispute Resolution. Any dispute that arises between an authorized person and a vendor concerning the execution of review pursuant to this Rule may be presented to the State Board of Elections in the form of a petition seeking relief. The party seeking such relief shall serve their petition on the opposing party, and the opposing party shall have 14 days to respond. The State Board shall make a decision on the petition based on the written submissions, or it may schedule a hearing to consider the petition.
History Note: Authority G.S. 132-1.2; 132-1.7; 132-6.1; 163-22; 163-27.2; 163-165.7; 163-165.9A; 163-166.7; 163-275; 42 U.S.C. 5195c;
Eff. February 1, 2024.
section .0400 – approval of electronic poll books
08 NCAC 04 .0401 STANDARDS FOR CERTIFICATION OF eLECTRONIC POLL BOOKS
(a) As used in this Chapter, an "electronic poll book" is a system (including hardware, software, and firmware) used to check the registration of voters who appear to vote in person, to assign voters their correct ballots, and to record the voters' check-in and acceptance of ballots. An electronic poll book shall, to qualify for certification by the State Board for use in any election in North Carolina, fulfill the following requirements:
(1) It shall record all information a voter is required by law to provide when presenting to vote and be equipped so that voters and election workers can complete the steps required by law for checking a voter's registration and the distribution of ballots to checked-in voters.
(2) It shall be equipped for use on any day the polls are open for in-person voting and shall contain the list of registered voters eligible to vote in the election.
(3) It shall verify a voter's eligibility to receive a ballot, confirm a voter has not previously voted in the election based on available records, and record a voter's check-in and receipt of a ballot.
(4) It shall log all user activity and that log shall be secured from unauthorized alteration and be available only to authorized users. It shall require the use of individual user accounts assigned to individual authorized users and not allow shared accounts for access to the electronic poll book. As used in this Chapter, an "authorized user" is an individual designated by the State Board or a purchasing county board of elections to operate and maintain the electronic poll book.
(5) It shall secure the data of the electronic poll book such that the data is stored in a manner that an unauthorized party will not be able to access the data.
(6) It shall secure the data contained within the electronic poll book such that the data is not transmitted or transported for any purpose except for official use in the conduct of an election or as otherwise authorized by law.
(7) It shall ensure that the voter data contained within the electronic poll book is not deleted without prompting by an authorized user, so that county elections personnel can comply with all applicable laws pertaining to records retention.
(8) It shall not allow access to confidential voter data, except for official use by authorized users.
(9) It shall meet applicable federal requirements for electronic poll books.
(10) It shall be reviewed by an independent testing authority accredited by or partnered with a federal agency for compliance with applicable state law.
(11) It shall be simple for election workers to set up and use, and any hardware shall be transportable to voting locations.
(12) It shall be compatible with systems, equipment, and software utilized by the State Board and county boards of elections for storing and processing voter registration and voting data.
(13) It shall allow for a wired connection to peripherals approved by the State Board, when certifying an electronic poll book pursuant to Rule .0402 of this Chapter, that are required for the operation of the electronic poll book and, as minimally required for functionality, allow for a secure network connection for the secure transmission of data with the state's electronic information management system, provided that the connection to the network is not automatically enabled by default upon powering on or opening the electronic poll book. All other forms of connectivity are prohibited.
(b) A vendor applying for certification by the State Board of Elections of an electronic poll book shall, as part of the certification application, fulfill the following requirements:
(1) The vendor shall submit the electronic poll book for examination, testing, and evaluation by the State Board. The vendor shall initiate the certification process by submitting a letter of application directed to the Executive Director of the State Board. A corporate officer or designee of the vendor shall sign the letter, and the letter shall include:
(A) The name and contact information of the company and the name and title of the corporate officer signing the application and all corporate information requested by the State Board.
(B) The vendor's corporate information. Corporate information shall include a history and description of the business, year established, products and services offered, areas served, branch office locations, and subsidiary or parent companies; a list of owners or shareholders with a five percent or greater interest or share in each of the vendor's company, subsidiary companies, and parent company; a description of management and staff organization, number of full-time employees by category, number of part-time employees by category, and resumes of employees to be tasked with assisting purchasing counties; documentation demonstrating that the vendor meets the same level of security compliance required for vendors connected to the State Network, as that term is defined in G.S. 143B-1370(a)(5)g.; a report showing the results of an independent audit of the business for its most current fiscal year; a comfort letter from the vendor's primary bank; and a description of the vendor's financial history including a financial statement for the past three fiscal years. If the vendor is not the manufacturer of the equipment for which application is made, the vendor shall include the vendor's financial statement for the past three fiscal years.
(C) The name and version number of the electronic poll book to be certified, and a list of all jurisdictions that have certified, have used, or are currently using the electronic poll book.
(D) An attestation that the corporate officer signing the application has reviewed and confirmed that the electronic poll book meets all legal requirements of electronic poll book systems under state and federal law.
(2) The vendor shall provide a listing of all software, hardware, and consumables necessary for operation of the electronic poll book, a technical data package, an accounting of any prior submission of the electronic poll book to another jurisdiction for certification, an accounting of any decertification of the vendor's electronic poll book or other voting product, and a demonstration of the system. The vendor shall provide access to the information required to be placed in escrow by a vendor pursuant to G.S. 163-165.9A.
(3) The vendor shall submit documentation of any review of the electronic poll book by an independent testing authority for compliance with federal or state standards, requirements, or guidance applicable to electronic poll books.
(4) The vendor shall provide a copy of its standard purchase contract and shall quote a statewide uniform price for each unit of the electronic poll book, including peripherals, consumables, and software required for operation of the electronic poll book.
(5) The vendor shall post a bond or letter of credit to cover damages resulting from defects in the electronic poll book, sufficient to cover any costs of conducting a new statewide election attributable to those defects. The State Board shall survey the county boards of elections in April of every odd-numbered year following an election held at the time prescribed in G.S. 163-1(c) to determine each county's costs for conducting its most recent general election, and the State Board shall aggregate those amounts to arrive at the cost of conducting a new statewide election. That aggregate amount shall determine the bond or letter of credit requirement, and it shall be effective June 1 of the year the survey is conducted and remain in effect until an amount is likewise calculated in a subsequent odd-numbered year following an election held at the time prescribed in G.S. 163-1(c) and is made effective.
(6) The vendor shall bear all of its costs associated with certification.
(c) The State Board shall terminate a pending certification process if:
(1) The vendor fails to respond to a State Board request for information or other resources required to be provided under Paragraph (b) of this Rule for the certification process.
(2) The State Board identifies the lack of a necessary quality or element in the electronic poll book system, vendor, or certification application that cannot be remedied by the vendor and is required for certification under this Rule.
(3) The vendor withdraws from the certification process.
(d) A vendor, to maintain certification by the State Board of Elections of the vendor's electronic poll book, shall fulfill the following requirements for the duration of the electronic poll book's certification and use in North Carolina:
(1) The vendor shall conduct a presentation to demonstrate for a county board of elections, as part of that county board's procurement and acceptance of a certified electronic poll book, the system's ability to execute its designed functionality as presented and tested during State-level certification and the vendor's ability to fulfill the duties required by G.S. 163-165.9A.
(2) The vendor shall submit to the State Board any escrow-related affidavits and other information required by G.S. 163-165.9A.
(3) The vendor's contract with each purchasing county shall include the agreement required by G.S. 163-165.7(c)(4) and the following training and support:
(A) Operational training for a purchasing county's elections personnel;
(B) Operational support prior to and during any election in which the certified electronic poll book will be in use; and
(C) End-of-life and end-of-service-life planning for the certified electronic poll book system, including guaranteed support until the system has reached the vendor's stated end-of-life date, optional extended support until the system has reached the end-of-service-life date, and sanitization of the electronic poll book once it has reached its end-of-service-life. End-of-life shall mean the point in time in which the vendor will no longer sell or market the electronic poll book. End-of-service-life shall mean the point in time in which the vendor will no longer provide maintenance or support for the electronic poll book.
(4) The vendor shall provide, upon request by the State Board or a purchasing county, memory devices or USB drives, sufficient in number to support the operation of the certified electronic poll book in an election setting, that meet industry standards for sanitization and security requirements for cryptographic modules, use cryptographic hashing algorithms of Secure Hash Algorithm 256-bit (SHA-256) or higher, and meet all applicable North Carolina Department of Information Technology information security standards. The standard for sanitization shall be as prescribed in National Institute of Standards and Technology (NIST) SP 800-88 Guidelines for Media Sanitization, including subsequent amendments and editions. A copy of the SP 800-88 Guidelines are available for inspection in the offices of the State Board of Elections and may also be obtained at no cost by accessing the NIST website at https://csrc.nist.gov/pubs/sp/800/88/r1/final. The security requirements for cryptographic modules shall be as prescribed in the National Institute of Standards and Technology's Federal Information Processing Standards 140-3 (FIPS 140-3), including subsequent amendments and editions. A copy of the FIPS 140-3 is available for inspection in the offices of the State Board of Elections and may also be obtained at no cost by accessing the NIST website at https://csrc.nist.gov/pubs/fips/140-3/final.
(5) The vendor shall allow the State Board to examine the certified electronic poll book at any time to ensure compliance with state and federal election laws and certification standards. To facilitate this requirement, the vendor shall make available to the State Board, upon request and at no cost to the agency, a certified electronic poll book model. The vendor shall, upon request, assist in the State Board's examination and submit requested changes to the electronic poll book to the State Board to ensure continued compliance with state and federal law.
(6) The vendor shall submit documentation to the State Board identifying and describing a proposed change to a certified electronic poll book in use in North Carolina. The vendor shall, upon request, assist in the State Board's review of proposed changes. No vendor shall provide a county board of elections any software, firmware, hardware, or instruction that will change a certified electronic poll book unless that change has first been approved in accordance with Rule .0402(b) of this Chapter.
(7) The vendor shall provide electronic notice to the State Board of another United States jurisdiction's decision to decertify or halt the use of its electronic poll book or other voting product within 24 hours of the jurisdiction's decision. The vendor shall provide electronic notice to the State Board of any incident, anomaly, or defect in the same system known to have occurred anywhere, and of any relevant defect known to have occurred in similar systems, within 24 hours of knowledge of the incident, anomaly, or defect.
(8) The vendor shall maintain the required bond or letter of credit on a continuous basis, without interruption.
(9) The vendor shall, on a quarterly basis, provide the State Board a quote for a statewide uniform price for each unit of the electronic poll book. The vendor shall, on a quarterly basis, furnish the State Board with an accounting of purchases of certified electronic poll books by a jurisdiction within North Carolina.
(e) In accordance with G.S. 163-165.7, compliance with this Rule shall not be required of an electronic poll book which is developed or maintained by the State Board of Elections for that electronic poll book to be used in an election in North Carolina.
History Note: Authority G.S. 163-22; 163-165.7; 163-165.9A; 163-166.7;
Eff. April 1. 2024.
08 NCAC 04 .0402 PROCEDURES FOR CERTIFICATION OF ELECTRONIC POLL BOOKS
(a) Before certifying an electronic poll book for use in North Carolina, the State Board shall do the following:
(1) Evaluate the electronic poll book for compliance with North Carolina laws and rules related to electronic poll books.
(2) Examine an electronic poll book's system functions, operational procedures, user guides and maintenance manuals, certification reports from other states, reviews from product users, and any other documentation provided by the vendor.
(3) Test the electronic poll book for its ability to meet the requirements in Rule .0401 of this Chapter.
(4) Obtain from the proposed vendor a current financial statement and the manufacturer's contact information.
(b) Changes to Certified Electronic Poll Books. A vendor shall submit in writing for the review of the Executive Director of the State Board of Elections any change to a certified electronic poll book, including changes to its software, firmware, or hardware, prior to implementation in a certified electronic poll book in use in any county's elections. Following the review, the Executive Director shall determine whether the change is a modification or minor change of the certified electronic poll book. "Minor change" shall have the same meaning as that term is defined in Section 3.5 of Version 3.0 of the United States Election Assistance Commission's Voting System Testing & Certification Program Manual, not including subsequent amendments and editions. Minor changes can include manufacturer enhancements. A copy of the Manual is available for inspection in the offices of the State Board of Elections. A copy of the Manual may be obtained at no cost by accessing the website of the Election Assistance Commission at https://www.eac.gov/voting-equipment/manuals-and-forms. A "modification" is a change to a certified electronic poll book that is not a minor change. Based on this determination, the Executive Director shall proceed as follows:
(1) If it is determined to be a modification, the vendor shall submit the electronic poll book as modified to the State Board of Elections for full review of its ability to meet the requirements in Rule .0401 of this Chapter.
(2) A vendor that proposes to implement a minor change to a certified electronic poll book shall, when submitting the proposal to the Executive Director for review and approval, identify whether the proposed minor change has been submitted to an independent testing authority accredited by or partnered with a federal agency for review and endorsement. If the State Board is unable to determine the nature and extent of a proposed minor change on the certified electronic poll book, the State Board may require the vendor to obtain review and endorsement by an independent testing authority accredited by or partnered with a federal agency before approving the minor change. The Executive Director shall make a written recommendation for administrative decision on the proposed minor change to the State Board. The State Board will then act on the recommendation as follows:
(A) If, after two calendar days following the transmission of the recommendation, no State Board member has raised an oral or written objection to the Executive Director's recommendation, the recommendation will become effective.
(B) If a State Board member raises an oral or written objection to the Executive Director's recommendation within two calendar days following the transmission of the recommendation, the State Board shall hear the matter or require the change to be reviewed as a modification.
A county board of elections using an electronic poll book certified by the State Board shall not implement a change to the electronic poll book until that change has been approved in accordance with this Paragraph.
(c) Decertification of Electronic Poll Book. The State Board of Elections shall hear and act on complaints, arising by petition or otherwise, that may result in the decertification of an electronic poll book in use in North Carolina. The State Board shall base its decision to decertify an electronic poll book on any of the following grounds:
(1) The failure or neglect of an electronic poll book or its vendor to comply with any part of the election laws of the State of North Carolina, including a failure to adhere to and fulfill the requirements of Rule .0401 of this Chapter.
(2) The implementation by a vendor of a change to a certified electronic poll book prior to State Board review and approval pursuant to Paragraph (b) of this Rule.
(3) The failure or neglect of a vendor to update and maintain the operability and security of the electronic poll book.
(4) The failure of the electronic poll book to satisfy all performance standards in Rule .0401 of this Chapter in examination and testing, or in an election setting.
(5) The failure of the vendor to comply with the requirement in Rule .0401(d)(7) of this Chapter to provide electronic notice to the State Board of an incident or anomaly affecting the electronic poll book in any jurisdiction. As used in this Chapter, an "incident" is an event related to the security or functioning of the electronic poll book that contributed to, caused, or may have caused any of the following:
(A) An interruption to the voter check-in process, reporting process, or both processes.
(B) An unauthorized disclosure of voter information.
(C) An unauthorized access to the electronic poll book.
(D) The software or data of the electronic poll book to become unreliable or corrupt.
As used in this Chapter, an "anomaly" is an unexpected functioning of the electronic poll book in its operation.
(6) The failure of the vendor to report in writing to the State Board a change in the vendor's corporate information provided with the certification application. The vendor shall make the report within 30 calendar days of the change.
(7) The electronic poll book reaching its end-of-service-life date.
Before exercising its power to decertify an electronic poll book, the State Board shall notify the electronic poll book vendor and any affected county boards of elections, and shall give the opportunity for the vendor and county boards to be heard at a hearing to be set by the State Board. The State Board's written decision to decertify an electronic poll book shall be considered a final decision for purposes of seeking judicial review. An electronic poll book that has been decertified by the State Board cannot be used for elections held in the State of North Carolina and cannot be purchased by a county board of elections. Upon decertification of an electronic poll book, the memory of those units in the possession of a county board of elections shall be sanitized by the county board of elections in accordance with the applicable North Carolina Department of Information Technology information security standard for media sanitization, including subsequent amendments and editions, prior to disposition.
(d) Suspension of Electronic Poll Book. The Executive Director of the State Board shall, in the event of a threat to the integrity of an election or the privacy of voter information, issue a written order to a county board of elections to suspend the use of a certified electronic poll book system, or individual unit, for a term not to exceed one month. The Executive Director shall give written notice of the suspension to the electronic poll book vendor.
(e) In accordance with G.S. 163-165.7, this Rule shall not apply to an electronic poll book which is developed or maintained by the State Board of Elections.
History Note: Authority G.S. 163-22; 163-165.7; 163-165.9A; 163-166.7;
Eff. April 1, 2024.