Cyber Security - Frequently Asked Questions

System Security

What is Santa Barbara County Elections currently doing to ensure the security of their systems?

  • Meeting regularly with Department of Homeland Security and the FBI to understand the threat landscape and how to mitigate those threats;
  • Meeting regularly with other Election Officials and system vendors to share information and best practices around cyber security;
  • Attended DefCon 2017 (annual hacking conference) to observe their first ever Voting Systems Hacking Village. This was quite informative as it led to many ideas about how an election could be disrupted, including various social engineering attacks. This has led to internal discussions on how to mitigate these disruptions;
  • Worked with Department of Homeland Security on a Cyber Resilience Review. This review showed that we had many good practices;
  • Working with Department of Homeland Security on Cyber Hygiene scans and a Risk and Vulnerability Assessment;
  • Expanded our contact with the County Information and Communication Technology Division's Cyber Security team to help ensure that if any issues are found they are mitigated as quickly as possible; and,
  • Conduct Cyber Security training department wide.
  • The equipment Santa Barbara County uses to count ballots is NOT connected to the Internet or on the county network.
  • We follow strict security practices in alignment with the law and the California Secretary of State regulations, use procedures and best practices.

Voting System

How can I be sure that no one is tinkering with the computer programs that count the ballots on election night?

The Secretary of State certifies all voting systems. Each county, before and after counting ballots, must run a number of pre-marked ballots through the computer as part of a legally required test, known as the "Logic and Accuracy" check. In addition, each county must file their Logic and Accuracy tapes with the Secretary of State, as well as place the source code of the software used in escrow with a third party vendor in case the voting system vendor goes out of business. These safeguards were designed to test the system before the actual counting of the real ballots on Election Day. During the canvass period, prior to certifying the election, we conduct a 1% manual tally of ballots cast to verify the accuracy of the voting system.

What safeguards has the County of Santa Barbara put in place to secure voting?

Santa Barbara County and most counties in California use paper ballots which provides the most accurate form of an audit.

Ballots cast at the polls are counted at the County Elections Office on Election Night. No ballot counting systems are at the polling locations and therefore are not vulnerable to intrusion.

The equipment Santa Barbara County uses to count ballots is NOT connected to the Internet or on the county network. The ballot counting system is physically secured when not in use. All access to the ballot counting server must be done in dual custody and only critical staff have access to the server room and server logins. The room in which the server is housed is under 24-7 camera surveillance and is only accessible by encoded cards to limited staff. The County Elections building also has security alarms.

Logic and accuracy testing is conducted for each election. During the canvass process, a manual tally of the votes cast in 1% of the precincts selected at random is conducted to ensure the votes were accurately read and tallied.

Ballot handling is done in a manner to protect the confidentiality of the voter's ballot. When handling vote by mail ballots, ballots are only counted if the signature on the return envelope matches the signature on the voter's registration record, any rejected ballots are triple checked. Only red pens are allowed in the room where ballots are being opened and prepared for counting because red ink is not picked up by the tabulating equipment. When duplicating ballots, staff works in teams of three: one calling, one marking and one verifying. Access to the ballot room is controlled by encoded cards and cameras are recording all actions.

Can anyone observe the voting process at the polling place and the Elections Office?

Yes. To learn more about observing the process and the details of our processes and the canvass, please visit our Upcoming Elections page at www.sbcvote.com to view the Observer Plan for our County along with the Secretary of State's guidance to observers.

Please contact the office at (805) 696-8963 or email any concerns to electionssupport@co.santa-barbara.ca.us.

Voter Registration Database

Does the State of California have a centralized Statewide Voter Registration Database?

The State of California has a statewide voter registration database named VoteCal. VoteCal was implemented in Santa Barbara County in October of 2015. VoteCal processing reduces the risk of duplicate records throughout the State.

What type of security is in place for Voter Registration Database used in the State of California?

VoteCal was built to meet or exceed industry standard security controls. Network safeguards are in place and server hardening techniques have been employed to protect the system from outside intrusion. The Secretary of State conducts routine security assessments and utilizes monitoring tools. Any electronic registrations received are processed at the local level by the elections officials and transactions are sent to and from VoteCal via encrypted messaging.

What type of security is in place for Voter Registration Database used in Santa Barbara County?

  • We have worked with Department of Homeland Security on conducting a Cyber Resilience Review, Cyber Hygiene scans and a Risk and Vulnerability Assessment;
  • We have expanded our contact with the County Information and Communication Technology Division's Cyber Security team to help ensure that any issues are found and mitigated as quickly as possible;
  • We conduct Cyber Security training department wide;
  • We limit access to VoteCal to permanent employees of the Elections Office only;
  • We do not list voter information on our public facing website and instead link to the Secretary of State's voter status lookup; and,
  • We do not display confidential voter information on the public kiosk located in our Elections Office.

List Maintenance

How does Santa Barbara County Elections ensure deceased voters are removed from the registration list?

The Department of Health Services provides lists of deceased individuals through VoteCal which are used to cancel deceased voters. Additionally, the local County Clerk-Recorder database of deceased individuals is also used to cancel voters.

How does Santa Barbara County Elections ensure felons are removed from the registration list?

Felon lists provided by the California Department of Corrections through VoteCal are used to cancel ineligible voters.

How does Santa Barbara County Elections know if a voter has moved?

The County Elections Office receives updates to voter address information from:

  • Completed Voter Registration Cards/Applications;
  • National Change of Address files from the United States Postal Service;
  • Department of Motor Vehicle change of address files;
  • Notices from other states or counties; and
  • Letters from the voter.

If we receive a notification of a change of address originated from someone other than the voter, we send a card to the voter to confirm the change.