Santa Cruz County Grand Jury
• 2020-2021
(nist). There are reports of voter registration data being offered for sale on hacker websites. Furthermore, in states
⚠️ Aviso de traducción: Este contenido ha sido traducido automáticamente. El texto original en inglés es la versión oficial. La traducción puede contener errores.
⚠️ Este contenido ha sido traducido automáticamente. El texto original en inglés es la versión oficial. La traducción puede contener errores.
Findings and Recommendations 2 findings
F1
Risk of misuse of voter registration data acquired by ELEC_2194 (1994) could be mitigated by stronger security measures at the County of Santa Cruz level.
Related Recommendations (2)
R1
In Distributed Data that is provided to County Recipients, the County Elections Department should replace voter full date of birth with year of birth only. This action should be implemented before the end of FY2021. (F1)
R6
The County Elections Department should encrypt Distributed Data to prevent data tampering and unauthorized use. This action should be implemented before the end of FY2021. (F1)
F2
County Applicants are not informed of recent amendments to ELEC_2188 (1994), and thus may not be taking all reasonable precautions to protect voter registration data, avoid data breaches, and report breaches if they occur.
Related Recommendations (3)
R2
On appropriate website pages, the County Elections Department should include links to the full text of all relevant statutes. In addition, the County Application should conform to the State Application by including the full text of relevant statutes. These actions should be implemented before the end of FY2021. (F2)
R4
The County Elections Department should incorporate amendments to ELEC 2188 (1994), as specified in AB 1678 and AB 1044, in the County Application and website information, namely that County Recipients must inform the SoS of a data breach, and that County Applicants may be subject to data security training. This action should be implemented before the end of FY2021. (F2)
R5
The County Elections Department should provide County Applicants with data security training, consistent with any guidance from the SoS, with the goal of implementing best practices aimed at protecting voter registration data. This action should be implemented before the end of FY2021. (F2)
Additional Recommendations 1
These recommendations are not explicitly linked to specific findings.
-
R3The County Elections Department should modify the County Application to conform to the State Application by requiring the County Applicant to provide a narrative stating the intended use of the Distributed Data, as well as how the Distributed Data will be secured. This action should be implemented before the end of FY2021.
Conclusions 1
-
CL1 Page 7The original California election statutes governing distribution of voter registration data were formulated in the mid-1990’s, long before data theft and breaches became commonplace.[66] [67] County election departments should examine their processes to make sure that best practices are being employed, and all precautions are being taken to ensure that voter registration data is secure.
Commendations 1
-
CM1 Page 9C1. The Grand Jury sets a high bar when issuing commendations. Performance of an agency must far exceed due diligence and expectations. We concur with the 2016-2017 Grand Jury and commend the Santa Cruz County Clerk and the Santa Cruz County Elections Department for their exemplary performance of one of the most complex and indispensable functions of local government—the democratic process of voting. The Santa Cruz County Elections Department demonstrates accountability, agility, responsiveness, transparency, attention to detail, desire for improvement, and forward-looking planning—all key indicators of outstanding leadership and process.
No Responses Found 2
Government entities assigned to respond to this report. No response documents have been linked in our database.
Santa Cruz County
County
Santa Cruz County Board of Supervisors
Elected County Office