Election Security

Safeguarding the integrity of every election is paramount to the San Diego County Registrar of Voters’ mission.

As the official election information source in San Diego County, the Registrar of Voters wants to provide you with all the steps we take to ensure the protection of every ballot that is cast, including implementing the necessary safeguards, security, chain of-custody, and quality assurance procedures.

Lifecycle of Your Ballot

1. Your ballot is printed.

Ballots are printed and inserted into ballot packets by our print vendor that has met the California Secretary of State’s certification requirements to produce ballots for elections conducted in the State of California. Ballots are printed using strict requirements, such as proper paper weight and registration of the ballot image on paper. The image contains an election specific tint and watermark designated by the Secretary of State’s office for the current election.

Printed ballots are inserted into a mail ballot packet and the voter’s name and unique barcode is imprinted onto the outside of the outgoing and return envelope – not the ballot. This complex process requires computer generated databases and insertion machinery because every active voter must be sent a ballot that corresponds to their correct precinct and ballot type.

2. Your ballot is mailed.

In San Diego County, ballots are automatically mailed to all active registered voters through the U.S. Postal Service nearly a month before Election Day. Addresses of registered voters are updated regularly using information from the National Change of Address database, the Department of Motor Vehicles, and voters themselves, to ensure ballots are being mailed to current addresses. In addition, official election mail is never forwarded.

If you receive official election mail for a previous or non-resident at your household, please write on the item “return to sender – does not live at this address” and return the item to the U.S. Postal Service. ^*

Any ballot packets mailed to voters no longer living at an address are returned to the Registrar’s office and this voter’s registration status is flagged as “inactive”. Official election mail will no longer be sent to that voter until they have confirmed their new address.

^*It is important for voters to update their voter registration any time they move or change their name. You can do this by completing a new voter registration online at sdvote.com. Make sure the Registrar of Voters has your correct information so you can receive your election materials timely. Check your voter registration status here. Verify your residence address, and if different, your mailing address.

3. Vote and return your ballot to a trusted source.

Voted ballots sealed inside the provided return envelope are postage-paid and can be returned through U.S. Postal Service, the Registrar’s official ballot drop boxes, at the Registrar’s office, or at any Vote Center. Mail ballot envelopes returned through the U.S. Postal Service are scanned in at the post office and picked up by the Registrar’s office almost daily. Closer to Election Day, the Registrar’s office picks up ballots from the post office twice daily.

4. We receive your ballot.

Returned ballot envelopes are run through an industrial mail sorter that dates and time stamps the ballot return envelope, compares the barcode on the envelope to data from the voter registration database, and captures an image of the voter’s signature on the envelope. The mail sorter will also isolate returned envelopes that are too heavy. These will be reviewed manually and if more than one ballot is found inside the envelope, neither ballot will be counted unless two signatures are found on the outside of the envelope, in which case both signatures must be verified as valid. Only one ballot can be counted per active voter record. There may be a one or two card ballot depending on the election.

5. We verify your signature.

The principal method used to detect and prevent fraud is the ballot return envelope itself. Registrar staff compare the signature from the ballot return envelope to the signature on file for the voter from their voter registration record. If the signature is comparable, the ballot return envelope is accepted. Accepted ballots move on to be extracted from their envelopes and then counted in the tabulation process. During signature verification, the ballot return envelope is checked against the statewide voter database to ensure the voter has not voted anywhere else in California.

If the signature is not comparable, the envelope is not opened, and the Registrar’s office sends the voter a letter and form to sign and affirm that they are the person who voted their ballot. When the signed form is received by the Registrar’s office, it goes through the signature verification process and if the signature is comparable to the voter’s signature on file, their ballot return envelope is accepted and moves on to extraction, sorting and tabulation.

6. We sort your mail ballot by jurisdiction.

Once your signature is verified, ballot return envelopes will go through the sorting machine a second time. The ballot return envelopes are sorted into batches containing 100 to 200 envelopes, depending on whether the ballot for that election is a one or two-card ballot, and are then sorted by jurisdiction to be opened.

7. We open your ballot return envelope.

Ballots are removed from envelopes manually or with a high-speed envelope opener/extractor. Your ballot remains secret throughout this process. The voter information side of the envelope is never viewed during extraction and remains anonymous. Empty mail ballot return envelopes are sent to a secure room to be filed and stored. Ballots are placed in a secure carton and moved to the Ballot Tabulation Room to be tabulated.

One of the hallmarks of the Voter Bill of Rights (Election Code, Section 2300) is that every voter is entitled to cast their ballot in secrecy and free from intimidation. The official ballot does not have the voter’s information on it nor any information that can be traced back to a particular voter. The Registrar of Voters does not know how a particular voter may have voted and there would never be a record as to how a person voted.

8. We tabulate your ballot.

Registrar of Voter’s staff run batches of ballots through scanners that read the marks on the ballots that indicate a voter’s choice for contests, propositions and/or measures, then results are passed to a tabulation computer.

Any damaged ballots that cannot be read by a scanner are sent to the Registrar’s duplication staff. The ballot will be examined to determine voter intent, and then duplicated by marking a blank ballot. Each damaged ballot is duplicated by a team of two Registrar of Voters staff. Documentation is kept with information about each duplicated ballot and both the original and duplicated ballots are numbered the same so they can be identified later if necessary. The duplicated ballot is then returned to the Ballot Tabulation Room to be tabulated.

If a voter has voted for too many or for too few candidates in a contest, if intent is unclear, or the voter provided a write-in candidate, an image of the ballot is sent electronically to Registrar of Voters staff that will review and resolve the ballot so that it can be counted as intended by the voter. The Registrar’s staff determines which selections the voter intended to mark by using the Secretary of State’s Uniform Vote Counting Standards.

The Ballot Tabulation Room is highly secure with very limited access.

9. We report election results.

Ballot tabulation is conducted on a computer located in the Ballot Tabulation Room. The results from each scanner are sent to the ballot tabulation server through an isolated secure network that has no connection to any other network nor the Internet. Results are printed and downloaded to an external USB drive so they can be uploaded to the Registrar of Voter’s website for public/media consumption and reported to the Secretary of State. As a safeguard, the external USB drive is wiped clean and formatted after each results upload.

Once counted, ballots are securely placed in storage. By law, they can only be accessed again for a recount or by order of the court.

Ballot Security

Two people are required to accompany voted ballots during transfer from Vote Centers or ballot drop boxes to the Registrar’s office.
All voted ballots are returned from the Vote Centers each night after closing.
All voted ballots are stored in secured, locked areas with security camera coverage.
Canvass: After election night, Registrar of Voters staff carefully go through all materials and voted ballots from every Vote Center to reconcile the number of voted ballots.

Election Equipment Security

LOGIC & ACCURACY TEST

State-mandated Logic & Accuracy Testing is done before each election to ensure the accuracy of the voting system. A Logic & Accuracy Test (L&A) is the process by which the Registrar of Voter’s office is able to validate that all contests on the ballot have been programmed accurately and the tabulation system is accurately reading the votes from the ballot. A logical pattern is devised and voted test ballots are generated and run through the tabulation scanners.
- The results produced from the tabulation system must match the expected results from the voted test ballots. In order to verify the tabulation system is accurately recording votes, specific precincts containing all contests/candidates across all languages and rotation of contests are selected to make the test ballots.

PUBLIC LOGIC & ACCURACY TEST

A Public Logic & Accuracy test is done approximately two weeks before each election and prior to any live official ballots being scanned into the voting system. The public is allowed to hand mark the test ballot for the first phase of the test. For the second phase, the public utilize the ballot marking device (BMD) to mark their selections, then prints their ballot. In both phases the ballots are scanned into the voting system to generate tabulation results. The public hand tallies all the ballot totals per contest and then confirms they match the voting system results.
Prior to each election we invite the public to observe and participate in this abbreviated tabulation test that represents the contests and candidates on the ballot for an election. The test ballots are identical to official ballots and are secured and destroyed following the retention schedule prescribed by the CA Elections Code.
- San Diego County utilizes an optical scan system to record the votes for an election by reading either of two types of ballots. The majority of ballots are those cast by filling in an oval on a paper ballot. Another method of voting is to use a Ballot Marking Device (BMD) which allows a voter to mark their choices on a touchscreen device, and then print an official ballot showing their selections. These devices are fully compliant with the Americans with Disabilities Act and are provided at the Registrar’s office and every vote center. In addition, the BMD contains all ballot types, federally required languages, and political party ballots (when needed).
- Blank test ballots have been printed in each of the five federally mandated languages. Attendees will be asked to take a mail ballot of their choice and vote by filling in the oval for their selection. Then, each attendee will also vote using a BMD, again casting the same vote on a vote center ballot. For purposes of the public L&A test, these ballots constitute the test ballots. Once the attendees have completed marking all of their ballots, the attendees will hand tally the mail test ballots to create the expected results.
- All ballot tabulation for this election occurs at the Registrar of Voters in two ways:
  - Mail ballots are tabulated using a central count feature that allows ballots to be run in batches through optical scanners connected directly to the tabulation server. In part one of the test, the mail test ballots filled in by the attendees will be scanned and tabulated using one of these central count scanners. A results report will be produced, and the attendees will compare the results to the expected results to verify that the scanning process resulted in an accurate tabulation.
  - Ballots marked using the BMD, printed and cast at a vote center or the Registrar of Voters office, are then scanned on optical scanners at the Registrar’s office. For this part of the test, the BMD test ballots will be scanned and tabulated using one of the central count scanners. After the results have been produced, the attendees will compare the results to the expected results to verify that the scanning process resulted in an accurate tabulation.

1% MANUAL HAND TALLY

Following each election, a public, observable manual tally of one percent of the mail and precinct ballot batches tabulated by the voting system occurs. The manual tally is conducted to verify the accuracy of the automated count across every contest scanned in by the ballot scanners.
A five-day public notice is posted on sdvote.com indicating the time, date, and location of the manual tally and of the random draw of batches to be manually tallied.
To randomly select the batches to be tallied, Registrar of Voter’s staff use an approved method adopted by the Secretary of State to randomly choose the one percent of batches which are subject to the manual tally.
Prior to conducting the manual tally, up to twenty 3-member boards are trained on the requirements of how to conduct the manual tally.
The manual tally is conducted on the date, time, location as posted. The teams of three people count and verify the number of ballots in each batch with the tabulation reports. Upon verification of ballot count with the official report, a ‘reader’ calls out votes and two ‘recorders’ mark their official tally sheet using tally marks and slashes, as trained. Supervisors are in place to verify reports and assist boards and observers with questions about the process.
An official report of the one percent manual tally is included in the certification of the official canvass.

VOTING EQUIPMENT SECURITY

Security is built into every aspect of California’s voting technology.

All voting equipment, by law, are required to have closed connections, the Central Count tabulation machines at the Registrar’s office are not hooked up to anything that can be hacked in to. The voting system is not connected to the Internet nor any other networks.
Only the Secretary of State supplied trusted build (the certified version of the software and firmware) for any voting system shall be installed. Registrar of Voter’s staff validate prior to any election that the voting system is identical to the Secretary of State supplied trusted build.
The Secretary of State conducts source code review and evaluation, hardware and software security penetration testing, operational testing to validate system performance and functioning under normal and abnormal conditions, and more to identify any vulnerabilities in our code. If found, the voting system vendor must resolve any vulnerabilities prior to installing the latest system build.
The San Diego County Registrar of Voters follows strict physical security, and chain of custody requirements for all voting technology software, firmware and hardware which meet or exceed federal guidance including that of the Justice Department, the Cybersecurity and Infrastructure Security Agency and the Election Assistance Commission.
The San Diego County Registrar of Voters follows specific procedures regarding role-based permissions, administrative and management controls, access controls, security procedures, and operating procedures.
The enforcement of password rules such as minimum password complexity, length, strength, multi-factor authentication and lock out policies for failed attempts is required. Additionally, the Registrar’s office adheres to our local policies and procedures, regarding password standards such as password expiration. Under no circumstances may the Registrar’s office use default passwords to secure voting technology.
Pursuant to California Elections Code sections 18564 and 18565, any person who tampers with a voting device, the secrecy of the ballot, or the ballot tally software program source codes, is guilty of a felony, punishable by imprisonment.