skull-UH - - rm 555% mun STATE OF MINNESOTA Of ce of Minnesota Secretary of State Steve Simon July 2 2018 Brian Newby Executive Director United States Election Assistance Commission 1335 East-West Highway Suite 4300 Silver Spring MD 20910 Executive Director Newby Enclosed is the brief narrative and tentative budget for the state of Minnesota pursuant to the terms of agreement CFDA 90 404 As we have previously noted Minnesota is in a position where the funds cannot be spent except as appropriated by the Legislature and agreed to by the Governor which has not yet occurred The enclosed plan provides more detail on our plan going forward Thank you for your cooperation with our state in this matter Best regards STEVE SIMON Secretary of State of Minensota C Mark Abbott 180 State O ice Building 100 Rev Dr Martin Luther King Jr Blvd Saint Paul MN 55155 1299 Phone 65l 201-l324 or 1-877-600-8683 Fax 651-215 0682 i MN Relay Service 71 1 E-mail secretary slalc u slulemnns Web site EAC Brief Narrative and Budget - Minnesota To Brian Newby Executive Director United States Election Assistance Commission 1335 East West Highway Suite 4300 Silver Spring MD 20910 This is the brief narrative and budget required under the terms of the 2018 HAVA grant A The State of Minnesota is one of the states where the Legislature must appropriate all inds expended from the Help America Vote Act Account The Legislature adjourned on May 20 2018 without reaching agreement with the governor on legislation containing the required appropriation of the federal funds in Minnesota s case $6 595 610 with a match requirement of $329 78 1 Accordingly the Office of the Secretary of State 088 will not have access to the funds until a er the Legislature convenes again in January 2019 Secretary of State Steve Simon had presented plans to the Legislature for the use of $1 532 million for a project to rewrite the code of the Statewide Voter Registration System SVRS rst developed in 2003 and 2004 with the initial HAVA funds provided in Title I and a small amount of Title funds This remains the highest initial priority a four year project requiring three additional staff as well as certain hardware and software described below The uses of the remainder of the 2018 HAVA funds are yet to be determined The 088 is in the process of convening a Working Group consisting of stakeholders in the election system which is scheduled to meet several times between July 2018 and the end of calendar 2018 and which will make recommendations to the Secretary of State as to the priorities and amounts to be spent 'om the 2018 grant The working group will address hardware software local elections of cials training for cybersecurity accessibility and other similar issues and make recommendations on priorities and funding to Secretary Simon The Secretary will be bringing his proposals once determined including the $1 532 million for SVRS to the 2019 Minnesota Legislature which convenes January 8 2019 The 2019 Legislature will adjourn no later than May 20 2019 This narrative and budget will be updated as recommendations to and proposals by the Secretary are made and as the Minnesota Legislature appropriates funds B The proposed detailed plan for the rewrite of SVRS is as follows 1 Purchase licenses to allow for additional systems scanning testing of Of ce websites Regular and comprehensive scanning and testing of the 088 public facing websites is a direct recommendation from the Department of Homeland Security and is a National Institute of Standards and Technology N IST standard Currently the OSS maintains four licenses to scan online absentee ballot application and voter registration tools the Minnesota Business and Lien System and the notary services online portal Additional licenses are needed to ensure that all of the office s public facing websites and online tools can be scanned for vulnerabilities The $30 000 allows the of ce to purchase 20 additional licenses per year so that all of the public websites can be scanned and a full vulnerability review of the underlying code can be done 2 Purchase next generation antivirus software As viruses and malware advance so must the of ce s antivirus software The additional antivirus so ware the office would like to purchase will detect new viruses and malware without daily hourly signature updates and is needed to augment current signature based antivirus software with next generation behavior based so ware Signature based so ware looks at speci c known or previously identified malicious coding and then blocks that malicious coding Behavior based software analyzes what that coding does even if the coding has not been previously identified as a known malicious code and instead blocks the code based on the malicious behavior This cost will cover antivirus software for a three-year period for all of the Of ce s approximately 200 workstations and servers at $44 81 device and is a recommendation from MN IT Security the state s IT agency 3 Provide for ongoing support for multi-factor authentication Multi-factor authentication is a security system recommended by the Department of Homeland Security and a NIST standard that requires more than one piece of information to verify a user s identity for a login Implementing and maintaining a multi-factor authentication system is crucial because Minnesota s SVRS is a state system to which all Minnesota counties and various cities have access Each county or city s computer system with access to SVRS is a possible entry point for hackers Multi-factor authentication provides an additional layer of security to protect SVRS from malicious actors that may attempt to compromise a county or city workstation or computer system With the actual security system already purchased by the office the ongoing support for the system includes maintenance version upgrades security patches and live support By purchasing ongoing support the OSS protects the multi-factor authentication system and the 5 000 licenses purchased 'om expiring 4 Purchase the services of contract policy writer The Department of Homeland Security recommends that the office hire a part-time contract policy writer to develop written based cybersecurity policies and procedures A er consultation with the Department of Homeland Security the of ce anticipates that a contract policy writer could complete these services in approximately six months and the of ce estimates an hourly rate of $l40 hour Once initial policies are complete the of ce believes current staff will be able to handle the yearly reviews and updates 5 Strengthening securing and modernizing the Statewide Voter Registration System SVRS The office is requesting funds to hire three additional staff starting in FY2019 These three additional staff wouldjoin two current office staff to strengthen secure and modernize Minnesota s voter registration system Speci cally the of ce is requesting funds to hire in FY2019 an IT Business Analyst an IT Developer and an Elections Administration Specialist These three additional staff would work with two current of ce IT staff a System Architect and a Project Manager as well as current election administration staff to overhaul SVRS lmportantly the of ce is not proposing building an entirely new statewide system from scratch but is instead proposing a re-write of each component of SVRS and updating those re-writes on a basis The of ce estimates that with the addition of three staff the of ce can nish a complete overhaul of SVRS in a four-year period after which there would be no need for these additional staff positions and corresponding funds Secretary of State FY2019 FY2020 FY2021 FY2022 Supplemental Budget Request Breakdown 1 Licensing for 30 000 30 000 30 000 5 30 000 System Scanning and Testing 2 Next Generation 5 9 000 -0- -0- 9 000 Antivirus Software 3 Multifactor 18 000 20 000 5 20 000 22 000 Authentication 4 Policy Writer 5 30 000 -0- -O- -0- 5 SVRS Modernization BA Position $121 000 $128 260 $135 956 $144 113 Developer Position $134 590 $142 665 $151 225 $160 299 Election Position 5 38 000 40 280 42 696 5 45 258 TOTAL $380 590 $361 205 $379 877 $410 670