🚨AZ Election News: The AZ Elections Procedures Manual is very specific about what type of changes can be made after Logic & Accuracy Testing. 🚨A USB-borne software update to adjudication computers after L&A Testing would be permitted only if all of these hold: A) an election official observed it B) the software still matches the certified hash C) it used a one-time inventoried device D) if it was followed by a publicly noticed re-test 🚨AZ Elections Procedures Manual USB Requirements after L&A Testing: 1) Adjudication computers count as part of the voting system. Ch. 10 §ll.E.1 (p.234) says the adjudication application must be part of a federally and state certified EMS, installed on a "secure, isolated, closed network" with no internet or external network connection. All of the Ch. 4 equipment security rules therefore apply to the adjudication workstations. 2) Changing the program after L&A requires a public re-test. Ch. 4 Sl.E (p. 112) requires re-testing "if the election program is changed after initial testing." Counties must report any changes or repairs beyond normal maintenance to the SOS, and the re-test must be publicly noticed to the public and observers. Counties follow the same procedures for their own L&A (SI.F). Ch. 10 §II.E.2 (p. 235) says the adjudication functionality is specifically part of the L&A test. On p. 235 there is also a narrow carve-out: official write-in candidates can be entered after the deadline only "as long as doing so does not modify the election programming if L&A testing has been completed." 3) Software and firmware updates must be observed and hash-verified. Ch. 4 SII.B (p. 116) says voting system components: must match the hash code on file with NIST or the SOS (item 5) "must be observed by the officer in charge of elections or a designee if the election program (or any software or firmware) is updated or modifed" (item 6) One gap: item 5 frames the hash comparison as happening "prior to programing the election." It doesn't explicitly require a fresh hash check after a mid-cycle update. 4) USB transfers are allowed but tightly restricted. Ch. 4 Sll.C (pp. 116-117): Source: the device must come from a reliable source. Tracking: it must be One gap: item 5 frames the hash comparison as happening "prior to programing the election." It doesn't explicitly require a fresh hash check after a mid-cycle update. Tracking: it must be serialized and inventoried, and physically secured at all times Use: "one-way, one-use." It transfers data once and is then securely disposed of. Write-once media is preferred over USB. Internet-sourced data: this may move only when necessary, through a dedicated Gateway Computer (SIl.D), with antivirus scans. The listed examples of necessary transfers are ballot files in and results out. Software updates aren't listed. The Gateway Computer section mentions installing software updates only on the Gateway itself. 5) Detection afterward. Ch. 4 Sl.G (p. 112) requires the L&A database and test ballots to be secured and retained. A post-election L&A test is then run against them (Ch. 12 Sll, p. 272). 🚨Current AZ EPM:⬇️⬇️ apps.azsos.gov/election/file… @AzPinkLady @MerissaCaldwell @Garrett_Archer @CletaMitchell @AzRepGillette @WethePeopleAZA1 @BlehmLawAZ @realAlexKolodin