MC EMS 2020 - Failure to Follow Basic Cyber Security Practices

From Corrective Action Plan AZ

In your exploration of election-related anomalies, you are here:

This page seeks to explain potential governance gaps with respect to allegations from the Arizona Senate, specifically for allegation #3 Maricopa County Election Department - Election Management System anomalies. These were investigated by the Arizona Attorney General's Office 2020 General Election Investigation Report. This topic is listed on Election Anomalies page, which lists various election-related anomalies that illustrate poor governance.

Governance Gaps are reported on and compared to a standard so that you may visualize how poorly managed County services can have an adverse impact without any criminal wrongdoing. We chose the United States Government Accountability Office's (GAO) Standards for Internal Control in the Federal Government (also known as the Green Book) because it represents the ideal standard for governance practices since it is specifically written for government entities, not the business sector. Maricopa County has no obligation or commitments to adhere to any governance-related standards, including the Green Book. Regardless, the Green Book is a representation of what good governance looks like and deviations from that standard are worthy of consideration, not prosecution. 

The Governance Gap Assessment Team are not IT security experts. The technical aspects of the IT configuration are not being disputed. The assessment for governance gaps sought to understand how data and information was being treated with respect to the US GAO's Standards for Internal Control in the Federal Government.

Maricopa Election Management Server (2020)

Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County Election Department - Election Management Server (EMS) issues.

MC EMS 2020 - Failure to Follow Basic Cyber Security Practices

Governance gaps were identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations #3 Maricopa County Election Department - Election Management Server (EMS) issues, which consisted of ten separate allegations. MC EMS 2020 - Election Management System Database Purged is an assessment of one of the ten sub-allegations associated with the EMS.

Allegation

The Basic Cyber Security Practices were allegedly not followed. The allegation originated from Cyber Ninjas. They explained the Department of Homeland Security's Cybersecurity & Infrastructure Security Agency (CISA) has guidelines, which MC was not following.

Relevant Inspector Notes
  • The EMS server along other election equipment is configured in an air gapped standalone system (no outside connectivity outside of the control access room).
  • CISA guidelines are not applicable because of the air gapped configuration.
  • The EMS server along with the other election equipment resides inside a controlled access room under 24-hour video monitoring.
  • A two-person rule is required to enter the room.
Inspector's Finding

Unfounded Allegation. The inspector found no indication of malicious or criminal acts performed by Maricopa County Elections Officials.

Governance Gaps Assessment
  • The AZ AG's inspector explains the equipment is under 24-hour surveillance. However, the inspector did not claim to have reviewed the surveillance videos. In fact, the surveillance videos were likely unavailable given the common practice to overwrite the video data with new surveillance video data after a sufficient time has elapsed to retrieve video data from the suspected time frame. Without an independent review of the surveillance video by the inspector, there seems to be an overreliance on the simple existence of the 24-hour camera to make the assertion of "no malicious or criminal acts.
  • The AZ AG's inspector relied on the MC leadership team claiming that a two-person rule is required to enter the room. There is no indication that the 24-hour video data was reviewed to confirm the two-person rule was always applied.
  • The AZ AG's inspector did not report on the existence of an entry and exit log for each person, which was maintained by a third independent person uninvolved with the EMS activities.
  • The AZ AG's inspector had already noted that procedure violations had occurred during drop box collections. It would have seemed critical for the inspector to claim "no indication of malicious or criminal acts" if objective data was not reviewed to confirm compliance with the two-person rule.
  • The AZ AG's inspector was told of a two-person rule. During the inspector's investigation of the drop box collection allegations, the two-person rule was more specific. One member of each political party (i.e., Democrat and Republican) had to be assigned to a collection team. The consequence of malicious and criminal performed on the EMS would be far more serious than a drop box collection, but the teaming requirement is less restrictive. In this case, the two-person rule is being questioned as being too lenient for the associated risk.
  • The AZ AG's inspector was told the Maricopa County within compliance of state and federal law as it pertains to these areas. Federal laws and Arizona Statutes are essentially policy statements, which affected entities are obligated to follow. Laws and statutes do not typically provide the necessary details form implementation of the laws and statutes. The inspector did not identify any IT standards for data security that MC Elections were following. They only claim to be in compliance with laws and statutes without any standard.

Potential Governance Gap(s):

  • Principle 1 - Demonstrate Commitment to Integrity and Ethical Values
  • Principle 2 - Exercise Oversight Responsibility
  • Principle 3 - Establish Structure, Responsibility, and Authority
    • Attribute(s):
  • Principle 4 - Demonstrate Commitment to Competence
    • Attribute(s):
  • Principle 5 - Enforce Accountability
  • Principle 6 - Define Objectives and Risk Tolerances
    • Attribute(s):
  • Principle 7 - Identify, Analyze, and Respond to Risks
  • Principle 8 - Assess Fraud, Improper Payment, and Information
  • Principle 9 - Identify, Analyze, and Respond to Change
    • Attribute(s):
  • Principle 10 - Design Control Activities
  • Principle 11 - Design General Control Activities over Information
  • Principle 12 - Implement Control Activities
    • Attribute(s):
  • Principle 13 - Use Quality Information
    • Attribute(s):
  • Principle 14 - Communicate Internally
    • Attribute(s):
  • Principle 15 - Communicate Externally
  • Principle 16 - Perform Monitoring Activities
  • Principle 17 - Evaluate Issues and Remediate Deficiencies
    • Attribute(s):
Retrieved from "https://arizonacitizenvoice.com/index.php?title=MC_EMS_2020_-_Failure_to_Follow_Basic_Cyber_Security_Practices&oldid=2088"