Bill Amendment: IL SB0018 | 2019-2020 | 101st General Assembly

NOTE: For additional amemendments please see the Bill Drafting List

---

Bill Title: ELECTION CD-ELECTRONIC REGISTR

Status: 2021-01-13 - Session Sine Die [SB0018 Detail]

Download: Illinois-2019-SB0018-Senate_Amendment_001.html

---

Sen. Bill Cunningham

Filed: 3/14/2019

10100SB0018sam001 LRB101 06157 SMS 57597 a
AMENDMENT TO SENATE BILL 18
AMENDMENT NO. ______. Amend Senate Bill 18 by replacing
everything after the enacting clause with the following:
"Section 5. The Election Code is amended by changing
Section 1A-8 and by adding Section 1A-39 as follows:
(10 ILCS 5/1A-8) (from Ch. 46, par. 1A-8)
Sec. 1A-8. The State Board of Elections shall exercise the
following powers and perform the following duties in addition
to any powers or duties otherwise provided for by law:
(1) Assume all duties and responsibilities of the State
Electoral Board and the Secretary of State as heretofore
provided in this Code;
(2) Disseminate information to and consult with
election authorities concerning the conduct of elections
and registration in accordance with the laws of this State
and the laws of the United States;

10100SB0018sam001 - 2 - LRB101 06157 SMS 57597 a
(3) Furnish to each election authority prior to each
primary and general election and any other election it
deems necessary, a manual of uniform instructions
consistent with the provisions of this Code which shall be
used by election authorities in the preparation of the
official manual of instruction to be used by the judges of
election in any such election. In preparing such manual,
the State Board shall consult with representatives of the
election authorities throughout the State. The State Board
may provide separate portions of the uniform instructions
applicable to different election jurisdictions which
administer elections under different options provided by
law. The State Board may by regulation require particular
portions of the uniform instructions to be included in any
official manual of instructions published by election
authorities. Any manual of instructions published by any
election authority shall be identical with the manual of
uniform instructions issued by the Board, but may be
adapted by the election authority to accommodate special or
unusual local election problems, provided that all manuals
published by election authorities must be consistent with
the provisions of this Code in all respects and must
receive the approval of the State Board of Elections prior
to publication; provided further that if the State Board
does not approve or disapprove of a proposed manual within
60 days of its submission, the manual shall be deemed

10100SB0018sam001 - 3 - LRB101 06157 SMS 57597 a
approved.
(4) Prescribe and require the use of such uniform
forms, notices, and other supplies not inconsistent with
the provisions of this Code as it shall deem advisable
which shall be used by election authorities in the conduct
of elections and registrations;
(5) Prepare and certify the form of ballot for any
proposed amendment to the Constitution of the State of
Illinois, or any referendum to be submitted to the electors
throughout the State or, when required to do so by law, to
the voters of any area or unit of local government of the
State;
(6) Require such statistical reports regarding the
conduct of elections and registration from election
authorities as may be deemed necessary;
(7) Review and inspect procedures and records relating
to conduct of elections and registration as may be deemed
necessary, and to report violations of election laws to the
appropriate State's Attorney or the Attorney General;
(8) Recommend to the General Assembly legislation to
improve the administration of elections and registration;
(9) Adopt, amend or rescind rules and regulations in
the performance of its duties provided that all such rules
and regulations must be consistent with the provisions of
this Article 1A or issued pursuant to authority otherwise
provided by law;

10100SB0018sam001 - 4 - LRB101 06157 SMS 57597 a
(10) Determine the validity and sufficiency of
petitions filed under Article XIV, Section 3, of the
Constitution of the State of Illinois of 1970;
(11) Maintain in its principal office a research
library that includes, but is not limited to, abstracts of
votes by precinct for general primary elections and general
elections, current precinct maps and current precinct poll
lists from all election jurisdictions within the State. The
research library shall be open to the public during regular
business hours. Such abstracts, maps and lists shall be
preserved as permanent records and shall be available for
examination and copying at a reasonable cost;
(12) Supervise the administration of the registration
and election laws throughout the State;
(13) Obtain from the Department of Central Management
Services, under Section 405-250 of the Department of
Central Management Services Law (20 ILCS 405/405-250),
such use of electronic data processing equipment as may be
required to perform the duties of the State Board of
Elections and to provide election-related information to
candidates, public and party officials, interested civic
organizations and the general public in a timely and
efficient manner;
(14) To take such action as may be necessary or
required to give effect to directions of the national
committee or State central committee of an established

10100SB0018sam001 - 5 - LRB101 06157 SMS 57597 a
political party under Sections 7-8, 7-11, and 7-14.1 or
such other provisions as may be applicable pertaining to
the selection of delegates and alternate delegates to an
established political party's national nominating
conventions or, notwithstanding any candidate
certification schedule contained within this Code, the
certification of the Presidential and Vice Presidential
candidate selected by the established political party's
national nominating convention;
(15) To post all early voting sites separated by
election authority and hours of operation on its website at
least 5 business days before the period for early voting
begins;
(16) To post on its website the statewide totals, and
totals separated by each election authority, for each of
the counts received pursuant to Section 1-9.2; and
(17) To post on its website, in a downloadable format,
the information received from each election authority
under Section 1-17; and .
(18) On or by February 15 of each year, to provide a
single, consolidated report to the Governor and the General
Assembly that includes a detailed analysis and accounting
from all divisions of all activities from the preceding 12
months, the current state of each division, and a detailed
statement of goals and expectations for the coming year
from the following divisions of the State Board of

10100SB0018sam001 - 6 - LRB101 06157 SMS 57597 a
Elections: Office of Executive Director, Office of the
General Counsel, Election Operations, Information
Technology, Voting and Registrations Systems, and Campaign
Disclosure; the Voting and Registrations Systems division
must include in the report an analysis of all activities
from the preceding 12 months undertaken to maintain the
State's voter registration system and changes resulting
from those activities; this analysis shall encompass
activities undertaken to update voter registration
information and voter status based on:
(A) deaths and Social Security Administration
data;
(B) data exchanged with neighboring states as part
of a bilateral data sharing agreement;
(C) data exchanged as part of a multi-state data
sharing agreement;
(D) felony convictions;
(E) federal convictions;
(F) adjudicated incompetent persons;
(G) noncitizens;
(H) voter cancellations;
(I) change of address;
(J) the current state of automatic voter
registration; and
(K) an analysis of all bilateral and multi-state
voter registration data sharing programs to

10100SB0018sam001 - 7 - LRB101 06157 SMS 57597 a
demonstrate compliance with the governance, data
quality, and security standards set forth in the
Electronic Registration Information Center Membership
Agreement.
The State Board of Elections' report shall contain the
methodology used in gathering and analyzing the data; the
Executive Director of the State Board of Elections shall
certify that the data included in the State Board of
Elections' report is accurate and reliable. The State Board
of Elections shall post its report on its website on or
before February 15. On or before March 31 of each year, the
General Assembly shall request the Executive Director of
the State Board of Elections and all division heads serving
underneath the Executive Director to provide an in-person
briefing to a committee of each chamber of the General
Assembly, as determined by the leadership of each chamber,
concerning the information provided in the report required
under this paragraph (18).
The Board may by regulation delegate any of its duties or
functions under this Article, except that final determinations
and orders under this Article shall be issued only by the
Board.
The requirement for reporting to the General Assembly shall
be satisfied by filing copies of the report as required by
Section 3.1 of the General Assembly Organization Act, and
filing such additional copies with the State Government Report

10100SB0018sam001 - 8 - LRB101 06157 SMS 57597 a
Distribution Center for the General Assembly as is required
under paragraph (t) of Section 7 of the State Library Act.
(Source: P.A. 100-623, eff. 7-20-18; 100-863, eff. 8-14-18;
100-1148, eff. 12-10-18.)
(10 ILCS 5/1A-39 new)
Sec. 1A-39. Data sharing agreements.
As used in this Section:
"Information system" means a discrete set of electronic
information resources organized for the collection,
processing, maintenance, use, sharing, dissemination, or
disposition of electronic information.
"Multi-factor authentication" means authentication through
verification of at least 2 of the following types of
authentication factors:
(1) knowledge factor, such as a password;
(2) possession factor, such as a token or USB key; or
(3) inherence factor, such as a biometric
characteristic.
"Nonpublic voter information" means the following data
elements that are not publicly available information:
(1) date of birth;
(2) full or partial social security number; or
(3) driver's license number or non-driver
identification card number.
"Penetration testing" means a test methodology in which

10100SB0018sam001 - 9 - LRB101 06157 SMS 57597 a
assessors attempt to circumvent or defeat the security features
of an information system by attempting penetration of systems,
networks, databases, software applications, or controls from
outside or inside the information system undergoing
assessment.
(a) The State Board of Elections may enter into the
following types of data sharing agreements:
(1) multi-state voter data sharing agreements; and
(2) bilateral voter data sharing agreements with
bordering states that do not participate in a multi-state
voter data sharing agreement in which Illinois also
participates.
(b) A multi-state voter data sharing program that enters
into a multi-state voter data sharing agreement with the State
Board of Elections must comply with the following governance
requirements:
(1) The multi-state voter data sharing program must be
governed by a board consisting of at least 10 members
comprised of election officials from the member states
(governing board).
(2) Upon joining the multi-state voter data sharing
program, an Illinois election official must be appointed to
the governing board.
(3) The operation of the multi-state voter data sharing
program must be performed by an independent team or entity
as approved by the governing board, and no single member

10100SB0018sam001 - 10 - LRB101 06157 SMS 57597 a
state may absorb any operational responsibility for the
overall program.
(4) The operational costs of the multi-state voter data
sharing program must be collectively funded by all member
states.
(5) The multi-state voter data sharing program must
share security policies, procedures, and relevant
certifications with Illinois election officials sufficient
to demonstrate compliance with the International
Organization for Standardization and the International
Electrotechnical Commission 2700 Family of Standards.
(6) The multi-state voter data sharing program must
have documented policies and procedures to notify all
participating state election officials immediately in the
event of a data breach or an inadvertent exposure of data.
(c) A multi-state voter data sharing program that enters
into a multi-state voter data sharing agreement with the State
Board of Elections must comply with the following minimum
requirements for security and data accuracy:
(1) Nonpublic voter information may not be sent to a
multi-state voter data sharing program without the
application of a cryptographic hash.
(2) The multi-state voter data sharing program must
require participating states to include, at a minimum,
voter name, address, date of birth, and partial social
security number (when available on a voter record).

10100SB0018sam001 - 11 - LRB101 06157 SMS 57597 a
(3) No voter's unencrypted nonpublic voter information
may be transmitted through email or stored in an email
system in the course of participation in the multi-state
voter data sharing program.
(4) Multi-factor authentication must be used by
Illinois election officials and staff to access any of the
multi-state data sharing program's user interfaces.
(5) The multi-state voter data sharing program must
conduct a third-party security audit, including
penetration testing and a vulnerability assessment. The
results of the security audit shall be shared with the
Illinois member of the governing board.
(6) Before joining a multi-state voter data sharing
program, the governing body of the multi-state voter data
sharing program must provide the State Board of Elections
evidence of the multi-state voter data sharing program's
compliance with the security requirements of this
subsection.
(7) The State Board of Elections shall maintain records
sufficient to demonstrate the multi-state voter data
sharing program meets all requirements set forth in this
Section on an ongoing basis.
(8) The multi-state voter data sharing program must
provide a data quality report to the governing board that
evaluates the quality of the data the multi-state voter
data sharing program provides members. The first such

10100SB0018sam001 - 12 - LRB101 06157 SMS 57597 a
report must be submitted to the governing body on or before
March 1, 2021, and then annually thereafter.
(d) A bilateral voter data sharing agreement entered into
by the State Board of Elections must comply with the following
requirements:
(1) Nonpublic voter information may not be shared with
election authorities without the application of a
cryptographic hash.
(2) No voter's unencrypted voter information data may
be transmitted through email or stored in an email system
in the course of participation of the agreement.
(3) If any shared system of data exchange is used, such
as a file transfer protocol server or any third-party file
storage system, then multi-factor authentication must be
used by any Illinois personnel or personnel of the partner
state to access or transfer any portions of the voter data
exchanged.
(4) Illinois must conduct a third-party security audit
on an annual basis that includes penetration testing and a
vulnerability assessment.
(5) The State Board of Elections shall maintain records
sufficient to demonstrate that the bilateral voter data
agreement meets all requirements of this Section.
(e) The State Board of Elections is required to monitor
compliance with the governance, security, and reporting
requirements of this Section.

10100SB0018sam001 - 13 - LRB101 06157 SMS 57597 a
(f) Participation in a multi-state voter data sharing
program or a bilateral voter data sharing agreement must be
reaffirmed by a majority vote of the State Board of Elections,
a majority being defined as a minimum of 5 affirmative votes,
on an annual basis. Before a vote, the State Board of Elections
must provide documented evidence of the multi-state voter data
sharing program's or the bilateral voter data sharing
agreement's compliance with the governance, security, and
reporting requirements of this Section. A failure to reach a
majority affirmation shall result in the immediate termination
of the voter data sharing agreement.
(g) A multi-state voter data sharing program or a bilateral
voter data sharing agreement shall be subject to a
cybersecurity audit as provided under Section 3-2.4 of the
Illinois State Auditing Act.
(h) The State Board of Elections must request an analysis
of the partnering states' compliance with the federal National
Voter Registration Act of 1993 as it pertains to voter roll
maintenance activities from the Office of the Attorney General.
This report must be delivered to the State Board of Elections
at least 60 days before any vote to enter into a bilateral
voter data sharing agreement or to continue an existing
bilateral voter data sharing agreement. The report must be made
a part of the public record in a public State Board of
Elections meeting before a vote.
(i) If a multi-state voter data sharing program no longer

10100SB0018sam001 - 14 - LRB101 06157 SMS 57597 a
complies with the governance requirements of subsection (b):
(1) The State Board of Elections must immediately cease
data exchanges with the multi-state voter data sharing
program and initiate any agreed upon withdrawal process.
(2) If the issue of non-compliance is corrected, the
State Board of Elections may resume participation in the
multi-state voter data sharing program by a majority vote.
(j) If a multi-state voter data sharing program no longer
complies with the security requirements of this Section, has
incurred a data breach, or has inadvertently exposed data:
(1) The State Board of Elections must immediately cease
data exchanges with the multi-state voter data sharing
program and initiate any agreed upon withdrawal process.
(2) If the issue of noncompliance is corrected, the
State Board of Elections may resume participation in the
multi-state voter data sharing program or bilateral voter
data sharing agreement by a majority vote.
(k) If a partner state in a bilateral voter data sharing
agreement no longer complies with the security requirements of
this Section, has incurred a data breach, or has inadvertently
exposed data:
(1) The State Board of Elections shall immediately
cease exchanging data and request the permanent
destruction of any and all Illinois voter data in the
possession of the partner state.
(2) If the issue of noncompliance is corrected, the

10100SB0018sam001 - 15 - LRB101 06157 SMS 57597 a
State Board of Elections may resume participation in the
bilateral agreement by majority vote of the State Board of
Elections.
(l) If a multi-state voter data sharing program does not
produce a data quality report within the specified time frame
of this Section:
(1) The State Board of Elections must immediately cease
data exchanges with the multi-state voter data sharing
program.
(2) If the issue of noncompliance is not corrected
within 90 days, the State Board of Elections must initiate
any agreed upon withdrawal process.
(3) If the issue of noncompliance is corrected, the
State Board of Elections may resume participation in the
multi-state voter data sharing program by a majority vote.
(m) The State Board of Elections may adopt rules to execute
voter data sharing agreements.
Section 99. Effective date. This Act takes effect January
1, 2020.".