STATE BOARD OF ELECTIONS STATE OF ILLINOIS 2329 S MacArthur Blvd Spring eld Illinois 62704-4503 217N824141 Fax 217 782-5959 BOARD MEMBERS William J Cadigan Chairman John R Keith Vice Chairman Andrew K Carruthers Ian K Linnabary William M McGuffage Katherine S O Brien Charles W Scholz Casandra B Watson James R Thompson Center 100 W Randolph St Ste 14-100 Chicago Illinois 60601-3232 3121814-6440 Fax 312I814-6485 EXECUTIVE DIRECTOR Steven S Sandvoss 2018 HAVA Election Security Grants Program Narrative and Budget Submission The State of Illinois was awarded $13 232 290 00 as authorized under Section 101 of the Help America Vote Act of 2002 P L 107-252 HAVA and provided for in the Consolidated Appropriations Act 2018 Public Law 115-141 the purpose of this award is to improve the administration of elections for Federal of ce including to enhance election technology and make election security improvements to the systems equipment and processes used in federal elections The State of Illinois is required to provide a 5% state match of $561 615 00 prior to March 23 2020 The entire 5% state match of $661 615 00 will be vouchered from the general revenue fund to the Help Illinois Vote fund by July 20 2018 The physical transfer of funds could take an additional 3-4 months based on current pay cycles Illinois Governor Bruce Rauner signed into law Public Act 100-0587 effective June 4 2018 which requires the SBE to implement a Cyber Navigator Program for local election authorities Due to this legislation the SBE is working with stakeholders to implement a cyber navigator program to provide direction to the election of cials in the state for both short and long term use of the funding Public Act 100-0587 10 ILCS 5l1A-55 new Sec 1A-55 Cyber security efforts The State Board of Elections shall provide by rule after at least 2 public hearings of the Board and in consultation with the election authorities 3 Cyber Navigator Program to support the efforts of election authorities to defend against cyber breaches and detect and recover from cyber-attacks The rules shall include the Board's plan to allocate any resources received in accordance with the Help America Vote Act and provide that no less than half of any such funds received shall be allocated to the Cyber Navigator Program The Cyber Navigator Program should be designed to provide equal support to all election authorities with allowable modi cations based on need The remaining half of the Help America Vote Act funds shall be distributed as the State Board of Etections may determine but no grants may be made to election authorities that do not participate in the Cyber Navigator Program As required by law no less than half of any such funds received shall be allocated to the Cyber Navigator Program to support efforts of election authorities to defend against cyber breaches and detect and recover from cyber-attacks Under PA100-0587 $6 946 952 50 must be used to provide equal support to all Illinois election authorities with allowable modi cations based on need In order to provide equal support to all election authorities the SBE is proposing the following components 1 Infrastructure- Illinois Century Network ICN Expansion Project The ICN is a state managed network delivering network and internet services to government agencies in Illinois The network allows DolT Department of Innovation and Technology to provide centralized monitoring mitigation and security services to participating agencies The goal of the ICN is to provide agencies with a cleaner safer internet The SBE plan would bring all network traf c to and from election authorities in to an internal 10 dot lP internal network system and whitelisting IP addresses for access to the statewide voter registration database IVRS Currently we are unable to whitelist connectivity to IVRS because many of the election authorities do not receive their intemet connection via a static IP The Department of Innovation and Technology DolT through inter-agency agreement would perform the on-site construction and build out to the network DolT will also provide to each election authority on the ICN Currently provided only to state agencies A rewall for the purpose of protecting local election authorities Distributed Denial of Service Attack protection Security Operation Center SOC 24 7 monitoring Albert sensor intrusion detection The cost of implementation and fees is estimated at $1 500 per month per site over three years These costs would be paid for with a portion of the $6 946 952 50 Implementation is expected to take 2-3 years Participation would be required to maintain a secure connection to IVRS Cost $2 000 000 for initial connection which is re ected as part of the sub-grants to local voting jurisdictions 2 Outreach- Cyber Security Information Sharing Program In partnership with the Illinois State Police s division of Statewide Terrorism and Intelligence Center STIC through inter-agency agreement the SBE will assist in overseeing the Cyber Security Information Sharing Program through the hiring of a Program Manager The program manager will assist in coordinating efforts with Dolt s Risk Assessments Team Cyber Navigators will be introduced to the local election authorities by the SBE and will begin an outreach effort to educate the local election authorities on the necessity of working with and cooperating with the Program Manager While the salary for the program manager will be funded from GRF funds the hardware software and training services used to create support for the Cyber Security Information Sharing Program will be supported with HAVA funds 3 Personnel-Cyber Navigator Advisor The Cyber Navigator Advisor would assist the local election authorities by performing onsite risk assessments and providing resources to ensure the Election Security Posture for the upcoming November 2018 mid-term election and continuing into the 2020 Election cycle The SBE would enter into an interagency agreement with DolT to provide the staff necessary to perform the duties of the Cyber Navigator Adviser The most critical role of the Cyber Navigator Advisor would be to perform Risk Assessments for each local election authority a Risk Assessment DolT through interagency agreement would provide 9 individuals on a personal services contract basis for the initial 12 month startup phase The ongoing need will be evaluated as the program matures The agreement will propose the SBE agreeing to pay with HAVA grant funds the associated costs payroll travel etc The duties of these individuals would be de ned as providing risk assessment to the local election authorities and provide cyber related training at the direction procurement and legal team are currently working with SBE staff drafting the agreement Cost $1 420 312 32 for 2-month period and projected 5 staff for 12 months at $813 980 total of 2 years 4 Providin additional ber securi resources for local election authorities SBE staff is in discussions with of cials from other local state and federal agencies to secure any available resources regarding cyber security matters These discussions will continue to evolve to increase the cyber security posture through 2020 5 Participation in the Cyber Navigator Program If the local election authorities meet participation requirements outlined in the Cyber Navigator Program Rules they will be eligible to apply for sub-grants offered by the SBE The sub-grants will be funded with any remaining HAVA funds that are not utilized for the operational costs associated with administering the Program Since participation in the Cyber Navigator Program is mandated and the timeframe projected for creation and implementation is not fully known $8 747 998 00 has been budgeted for sub-grants over the 5 year grant period The sub-grants could include direct grants offered to local election authorities after Program participation has been veri ed Non-operational costs sub-grants etc could include direct contracts with vendors to address vulnerabilities discovered during the on-site risk assessments The SBE is required to hold public hearings in consult with local election of cials while developing this program The rst hearing was held July 10 2018 and the second hearing was held August 1 2018 Proposed Components of the Internal SBE Use of HAVA Grant Funds We propose the amount of $1 2 million be retained by the SBE in the Help Illinois Vote fund for the following uses consulting contracts that would include services such as cyber security consultants audit rms or additional IT consultants for new application development After additional assessments are completed on the Board s overall cyber security posture it is anticipated that additional hardware and or software will be needed to further strengthen the Board s overall network security Year 1 through year 3 Consulting contracts $185 000 year IT Hardware Software $100 000 year Travel 15 000 year Year 4 and year 5 Consulting contracts $90 000lyear IT Hardware Software $50 000 year Travel $1 0 000 year Total 5-year estimate $1 200 000 201B HAVA ELECTION SECURITY GRANT Budget In formation lam a sum Non-Construction am Name or Omar-lumen sum loud or Imam nudge Perlod sun am A BUDGET Consolidated Budgelfor Murmur ten-rh- MM End r NON-FEDERAL runns Match up to 5 year as de ned by grantee PROGRAM CATEGORIES 1 Mar mm om 1 Touts Fed Total BUDGET CATEGORIES EQUIPMENT 650M113 A 8 1 99313 n' gunman sgl l i I I All 0mm cosrs 3 134 293 00 050% 5 rmums 700 030 00 13 231 1301333139000 u-i TOTAL COSTS US13 232 29000 9 cm Toni Federal 5 13 232 293 03 5 a Non-Fedenl PERSONNEL lnrJudmg hinge 5 Nan-federal Cash Mulch 5 651 615 10 Match 5 661 15 11 5 611161503 13189390500 In 11 1mm mm and 1 3 905 00 12 Petr-mag By Car-gory Proposed State Match I soul A Do you hm an Indirect Con lute Agreement approved 01- the Federal government or other non-federal unity No If yrs 9km prov-dc the Following lnlormnron 8 Period Covered by the Indll'tct Cos Rate Agreement A f WWII Federal new WA 0 If other than federal arty pleur- specily MA E The Co Role is u 5 when 0 for 5 wean 5100 000 We'll 5300 000 In muvmnt 8 5100 000 0 software ICN Hardware lhrough lnteragenq agreemem 5350 000 Hardware 5300 000 a Remalm'n 0 be swurltwI parllon' of overall gram funds Assumed $65 per minlng Ilnclud'm lac-Inn a travel comyour $650 000 dmlonmenl $700 000 4L 565 000 53 software om annulled wi lh 5 Cmvmu tumult-n unites $735 000 $900 000