Safeguarding Critical Election Infrastructure

Voting System Safeguards

San Francisco’s voting system is certified by the California Secretary of State and is fully compliant with California Voting System Standards. The voting system’s components are the ImageCast Evolution Ballot-Scanning Machine, the ImageCast X Ballot-Marking Device, and the ImageCast Central Scanner. The Department follows strict physical security protocols to prevent tampering with the voting equipment. No part of voting system or equipment is connected to an outside network or the internet, nor is it capable of being connected to wireless technology.

The Department conducts Logic and Accuracy (L&A) testing prior to every election to confirm that all machines properly record and tabulate votes. The L&A Testing Board, comprised of members of the public, reviews and approves both the L&A plan and the L&A results for each election. To confirm the accuracy of the vote count after each election, the Department conducts a manual count of all standard ballots cast in 1% of randomly chosen precincts, as well as 1% of randomly-chosen vote-by-mail and provisional ballots. The Department also conducts a risk-limiting audit as an extra check. Any member of the public can observe these processes.

To provide transparency into the voting system’s operations, the Department posts transaction logs from the ballot scanning equipment that show the machines’ internal operations during the election, as well as images of every ballot which include an explanation of how the system counted each vote. Members of the public can view and sort these ballot images for comparison against official election results.

Securing and Processing Voted Ballots

The Department adheres to all local and state laws governing the transport, storage, and counting of ballots cast in the election.

San Francisco voters use paper ballots, which is the most secure form of voting. Voters with disabilities, or those who prefer audio or touchscreen ballot interfaces, can mark a ballot using the accessible vote-by-mail system or at a polling place using the ballot-marking device. Both systems generate paper ballots and do not store, track, or count any votes. Online voting is prohibited by state law.

The Department adheres to all rules regarding the design, placement, maintenance, and use of official ballot drop-boxes. All ballot boxes are constructed of durable material, bolted to the ground, tamper-resistant, and assigned unique identifying numbers. San Francisco Deputy Sheriffs transfer vote-by-mail ballots from the city’s official drop boxes to the Department of Elections.

When processing ballots, Department staff follow consistent and comprehensive internal guidelines, which are rooted in relevant state regulations. These regulations cover various aspects of ballot processing, including, for example, current state rules for signature verification, ballot processing and ballot counting. All ballot envelopes are audited against the statewide voter database prior to opening to prevent double-voting. In the unlikely event that a voter returns a second ballot, the second ballot will be rejected. Voters can track their own ballots using the Voter Portal, sign up for tracking notifications, or contact the Department.

By law, the Department archives all vital election materials after each election, including ballots, for the periods of time specified by law.

IT Infrastructure

The Department’s website utilizes industry leading protections against Denial-of-Service (DDoS) attacks, data theft, malicious bots, and website availability issues. The City’s unified Cyber Command continuously monitors the City’s technologies such as websites and servers to assess for possible threats or intrusions.

To allow the public to verify the integrity of election results posted on its website, all preliminary and final results reports are cryptographically hashed.

The Department uses an Election Management System (EMS) certified by the Secretary of State to maintain voter records and other critical election data. This system works in tandem with the statewide system of record, VoteCal, to maintain accuracy of voter information, detect duplicate registration records, and remove ineligible voters from the voter rolls. To facilitate non-citizen voting in local Board of Education elections, which is allowed by local law, the Department uses an entirely separate EMS to maintain non-citizen voter records.