H-2456.4

HOUSE BILL 2115

ByRepresentatives Kraft, Chase, Sutherland, and McCaslin

AN ACT Relating to improving election integrity, security, and accountability for Washington voters; amending RCW 29A.60.185, 29A.60.170, 29A.40.100, 29A.72.230, 29A.60.110, 42.56.420, 29A.60.160, 29A.60.190, 29A.60.240, 29A.60.250, 29A.60.260, 29A.08.125, 29A.08.105, 29A.08.620, 29A.08.510, 29A.08.540, 29A.12.020, 29A.12.030, 29A.12.040, 29A.12.070, 29A.12.080, 29A.12.101, 29A.12.130, 29A.12.140, 29A.12.150, 29A.12.160, 29A.12.180, 29A.12.190, 29A.12.200, 29A.36.111, 29A.60.235, 29A.08.775, and 43.09.050; reenacting and amending RCW 29A.40.110; adding new sections to chapter 29A.60 RCW; adding new sections to chapter 29A.12 RCW; adding new sections to chapter 29A.04 RCW; adding a new section to chapter 29A.40 RCW; adding new sections to chapter 29A.84 RCW; repealing 2021 c 26 ss 2 and 3 (uncodified); prescribing penalties; and declaring an emergency.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION.  Sec. 1. A new section is added to chapter 29A.60 RCW to read as follows:

(1) Each year beginning in 2022, the state election audit board is created for the purpose of overseeing the forensic audit process required under section 2 of this act. The membership of the board consists of the following seven members:

(a) The state auditor, or the auditor's authorized designee;

(b) Four election observers representing four geographic locations throughout the state, randomly selected as follows:

(i) The state auditor or their authorized designee shall randomly draw the name of one county from each of the northwest, northeast, southwest, and southeast regions of the state. The drawing must be done publicly. Two weeks before the drawing, each county auditor shall publish a notice announcing the drawing, including the date, time, and location of the drawing; the clearly stated purpose of the notice; and an invitation to the public to attend and observe the drawing. The notice must be prominently displayed and readily visible on each county auditor's website, or county website if a county auditor does not have one, and published in newspapers with the largest and, if applicable, second largest readership in each of the four geographical regions and be of a size which occupies at least one-eighth of a page.

(ii) The county auditors of each of the four counties selected in (b)(i) of this subsection shall publicly and randomly select one election observer to be appointed to the state election audit board, and a second election observer to serve as an alternate, by a drawing of all the election observer names from the county's previous election year. Two weeks before the county auditor conducts the drawing, the county auditor shall publish a notice announcing the drawing, including the date, time, and location of the drawing; the clearly stated purpose of the notice; and an invitation to the public to attend and observe the drawing. The notice must be prominently displayed and readily visible on the county auditor's website, or county website if the county auditor does not have one, and published in newspapers with the largest and, if applicable, second largest readership in the county and be of a size which occupies at least one-eighth of a page; and

(c) Two precinct committee officers selected as follows:

(i) The state auditor or their authorized designee shall randomly draw the name of one county not already selected under (b) of this subsection. The drawing must be done publicly. Two weeks before the drawing, each county auditor shall publish a notice announcing the drawing, including the date, time, and location of the drawing; the clearly stated purpose of the notice; and an invitation to the public to attend and observe the drawing. The notice must be prominently displayed and readily visible on each county auditor's website, or county website if a county auditor does not have one, and published in newspapers with the largest and, if applicable, second largest readership in each of the four geographical regions and be of a size which occupies at least one-eighth of a page.

(ii) Each of the two major political party county central committees of the county selected under (c)(i) of this subsection shall elect a precinct committee officer to serve on the state election audit board.

(2) Members serve for one general election cycle. Members must be appointed to the state election audit board by June 1, 2022, and by June 1st each year thereafter.

(3) Members of the state election audit board are eligible to receive compensation in accordance with RCW 43.03.230, and must be reimbursed for travel expenses under RCW 43.03.050 and 43.03.060.

NEW SECTION.  Sec. 2. A new section is added to chapter 29A.60 RCW to read as follows:

(1) Not more than 45 days after the state election audit board members are appointed in accordance with section 1 of this act, the state election audit board shall enter into a contract with an impartial, nonpartisan, and bonded third-party audit vendor to conduct a forensic audit of the general election beginning in 2022 and for each general election thereafter, in accordance with the requirements of this section. The state election audit board may not contract with the same vendor to conduct the forensic audit more than one time every three years. The audit must be completed no later than 30 days after the date of the general election.

(2) A forensic audit of the general election must include a manual hand count audit of all the ballots in the following precincts:

(a) Every precinct in the 10 counties with the largest population in the state; and

(b) For all other counties not included in (a) of this subsection, the county auditor of each county must randomly select by a public drawing at least 10 percent of the total precincts in their county to audit. Two weeks before the county auditor conducts the drawing of election precincts, the county auditor shall publish a notice announcing the drawing, including the date, time, and location of the drawing; a clearly stated purpose of the notice; and an invitation to the public to attend and observe the drawing. The notice must be prominently displayed and readily visible on the county auditor's website, or county website if the county auditor does not have one, and published in newspapers with the largest and, if applicable, second largest readership in the county and be of a size which occupies at least one-eighth of a page.

(3) The following forensic audit procedures apply to all counties:

(a) Manual count of ballots. For counties described under subsection (2)(a) of this section, a manual hand count must be conducted of ballots cast in each precinct. For all other counties, manual hand counts must be conducted in precincts selected in accordance with subsection (2)(b) of this section. A manual hand count of each ballot by batch shall be conducted by the third-party audit vendor to ensure the ballots were properly counted and tallied. If the manual hand count total is different than the total from the vote tallying system, a second manual hand count of the ballots must occur. If the second manual hand count matches the first manual hand count, then that outcome must be used to certify the election. If the second manual hand count matches the total from the vote tallying system, then the total from the vote tallying system must be used to certify the election. If the second manual ballot hand count does not match the first manual ballot hand count or the total from the vote tallying system, then the state election audit board shall investigate the cause of the discrepancy and determine the accurate count of the votes before the date of the certification of the election.

(b) Voter registration database. (i) The third-party audit vendor shall audit the voter registration database and create a log of voter registrations added to the database, revisions made to existing voter information in the voter registration database, and cancellations of voter registrations, made between January 1st of the year being audited and the date the audit is commenced. For each entry, the log must include, but is not limited to, the following:

(A) The name of each election official or employee who modified the voter registration database in any way;

(B) The location from which the individual described in (b)(i)(A) of this subsection modified the voter registration database;

(C) Whether the modification made was an addition or revision to the voter registration database, or a cancellation of a voter's registration;

(D) A detailed description of the records in the voter registration database that were modified and how these records were modified; and

(E) The source of information relied upon to make the addition, revision, or cancellation. The third-party audit vendor shall verify the legitimacy of the source and check the database for any invalid entries, revisions, or cancellations.

(ii) The third-party audit vendor shall audit the voter registration database for any duplicate entries. Entries must be checked by a comparison of the name, date of birth, and valid state-issued identification number.

(c) Ballot reconciliation. (i) The third-party audit vendor shall manually hand count and review the count conducted under (a) of this subsection for validity and accuracy of the tally as part of the county ballot reconciliation process in this subsection (3)(c). In addition, the third-party audit vendor will reconcile the county's ballot totals including: Number of ballots produced, mailed, and received; absentee ballots requested, mailed, and received; provisional ballots issued and received; replacement ballots issued and received; damaged ballots received and duplicated; rejected ballots; and ballots counted daily.

(ii) To ensure a complete reconciliation of the election, the county auditor shall:

(A) Ensure ballots are printed using a paper stock that conforms to the manufacturer's recommendations and has been tested in each approved vote tabulation system used in the county. The county auditor shall keep a record of the paper stock amounts received and used. All paper stock must be fully accounted for and tracked to allow for easy identification of potential counterfeit ballots;

(B) Ensure all ballots contain an official watermark;

(C) Keep a written log of the number of ballots mailed per day, for what precincts, a running total of ballots mailed and returned, and the name of the election official or employee who mailed the ballots and recorded the daily running total of ballots mailed;

(D) Keep a written log of the names of all in-state voters, out-of-state voters, and overseas and service voters who requested an absentee ballot, the date of the request, the date the ballot was mailed, the address the ballot was mailed to, and the name of the election official or employee who issued the absentee ballot;

(E) Keep a written log of the date that each provisional ballot was issued; the reason for the provisional ballot request; the name of the election official or employee who issued the provisional ballot; the number of provisional ballots issued per day; and the total number of provisional ballots issued and returned;

(F) Keep a written log of the date each replacement ballot was issued; the reason the replacement ballot was requested; the name of the election official or employee who issued the replacement ballot; the number of replacement ballots issued per day; and the total number of replacement ballots issued and returned;

(G) Assign each damaged ballot a unique control number marked clearly on the front of the ballot. The county auditor shall keep a written log of the date the damaged ballot was received; the reason the ballot was declared damaged; the name of the election official or employee who processed the damaged ballot; the number of damaged ballots received per day; and the total number of damaged ballots received;

(H) Keep a written log of the date that each duplicated ballot was created; the reason that a ballot was duplicated; the name of the election official or employee who duplicated each ballot; the number of ballots duplicated per day; and the total number of ballots duplicated. The county auditor shall store all duplicated ballots separately in a container properly identifying the contents as duplicated ballots. Each duplicated ballot must be marked with the unique control number of the corresponding damaged ballot. Original damaged ballots sent to duplication should be stored separately and properly identified;

(I) Keep a written log of the number of ballots received daily in each precinct, the number of ballots received per day for all precincts, the number of ballots received in total, and the name of the election official or employee recording the information in this subsection;

(J) Keep a written log of the date a ballot was rejected for each rejected ballot; the reason for rejecting the ballot; the name of the election official or employee who rejected the ballot; the number of rejected ballots per day; and the total number of rejected ballots; and

(K) Keep a written log of the number of ballots counted daily and the name of the election official or employee recording the information in this subsection.

(d) Chain of custody. The third-party audit vendor shall review the handling process of the ballots including production, mailing, receiving, pick up and transfer, batching, labeling, and storage of ballots to ensure that the chain of custody procedures are sufficient and were performed in accordance with the chain of custody procedure manual.

(e) Vote tallies. The third-party audit vendor shall reconcile the number of registered voters for the general election being audited, the number of ballots mailed, the number of ballots received, the number of ballots accepted, the number of ballots rejected, the number of damaged ballots which have been duplicated, the number of provisional ballots, the number of counted ballots, and the number of final votes cast.

(f) Review of voting systems. The third-party audit vendor shall review the voting systems used in the election to ensure proper set up, calibration, maintenance, and function of these systems. The vote tabulation system must have been subject to a logic and accuracy test as referenced in RCW 29A.12.130 and must be disconnected from the internet and other mechanisms that could allow remote access to the vote tabulation system or its network. All data stored on the device must be stored for at least 22 months and is subject to all election audits and forensic image procedures required under section 5 of this act.

(g) Review of forensic images captured. The third-party audit vendor shall audit the forensic images captured pursuant to section 5 of this act by comparing the images captured before the general election to the image taken after the general election to determine whether any irregularities occurred that could impact the outcome of the election. Any forensic image taken in the prior 22 months by the county auditor may be used, upon request, for the audit.

(4) The third-party audit vendor shall determine who authorized, and what procedures were followed for, sending out unsolicited absentee voter ballot applications in each general election, beginning in 2022.

(5) During the audits conducted under this section, the third-party audit vendor shall:

(a) Use cameras to record the entire audit process to verify the chain of custody of all voter registration lists, ballots, and vote tallies audited;

(b) Require that only certain types of pens and other writing instruments approved by the third-party audit vendor are used during the audit;

(c) Require wardrobe differentiation for those individuals working on the audit based on the role of the individual during the audit;

(d) Inspect each ballot for proper ink markings, official watermarks, and depressions to confirm that the ballot was completed by an individual and not by a machine not approved by the secretary of state and the state auditor; and

(e) Inspect each special absentee ballot for folded crease marks.

(6) During the audit conducted under this section, the state election audit board and the third-party audit vendor must review and investigate any affidavits or complaints that were submitted or referred to the state election audit board, the third-party audit vendor, a county auditor, the state auditor, or the secretary of state concerning the general election that is being audited.

(7) The third-party audit vendor shall prepare an audit report to the state election audit board, the governor, the state auditor, the secretary of state, and the legislature, no more than 14 days after the audit is complete. The audit report must include, but is not limited to, the following:

(a) An executive summary of the audit;

(b) The determination required under subsection (3)(a) of this section concerning the review of the manual ballot count;

(c) The log required under subsection (3)(b) of this section pertaining to the voter registration database;

(d) The log required under subsection (3)(c) of this section pertaining to the ballot reconciliation;

(e) The log required under subsection (3)(d) of this section pertaining to the chain of custody procedures;

(f) The log required under subsection (3)(e) of this section concerning the vote tallies;

(g) The determination required under subsection (3)(f) of this section concerning the review of voting systems;

(h) The determination required under subsection (3)(g) of this section concerning the review of forensic images captured;

(i) The determination required under subsection (4) of this section regarding sending out unsolicited absent voter ballot applications;

(j) The determination of each investigation conducted under subsection (6) of this section;

(k) Any findings of irregularities; and

(l) Any recommendations for further investigation or corrective action needed.

(8)(a) Not more than seven days after the completion of the third-party audit vendor's report required under subsection (7) of this section, the state election audit board shall submit a final audit report to the governor, the secretary of state, the state auditor, and the legislature that includes, but is not limited to, the following:

(i) All of the information included in the audit report submitted pursuant to subsection (7) of this section; and

(ii) Any recommendations for further investigation or corrective action needed by law enforcement, the judiciary, the secretary of state, the state auditor, or the legislature.

(b) Reports to the governor and legislature must be submitted in writing.

(9) In addition to the report submitted pursuant to subsection (8) of this section, not more than 14 days after completion of the third-party audit vendor's report required under subsection (7) of this section, each member of the state election audit board may submit their own final audit report to the governor, the secretary of state, the state auditor, and the legislature. Reports to the governor and legislature must be submitted in writing.

(10) The state election audit board is dissolved 90 days after the state election audit board issues its final audit report under subsections (8) and (9) of this section.

(11)(a) Each county and its election officials, election employees, and election volunteers shall cooperate with the third-party audit vendor in conducting these audits, or be subject to subpoena, warrant, criminal prosecution, or civil penalty. Any county whose county auditor, election officials, election employees, or election volunteers refuse to cooperate with the full forensic audit required under this section is subject to a minimum fine of $5,000 per day of refusal. The third-party audit vendor shall report any refusal to cooperate with the audit to the state election audit board.

(b) The state auditor shall collect any fines due from any penalty issued pursuant to (a) of this subsection. The attorney general may enforce any penalty issued and the collection of any fines due. Fines collected must be deposited in the election audit account established under section 3 of this act.

(12) Each county auditor, election official, election worker, and election volunteer shall sign a sworn statement under penalty of perjury declaring that the person will help conduct the audit honestly, truthfully, and with a good faith effort.

(13) If the independent third-party audit vendor and the state election audit board finds that any person intentionally and knowingly committed fraud during the election or audit process, the state election audit board shall refer the case for investigation to the county prosecutor and the person may be subject to criminal punishment or civil penalties. A person who intentionally and knowingly commits fraud during any part of the election or audit process is guilty of a class C felony punishable under RCW 9A.20.021.

(14) As used in this section, "third-party audit vendor" means the impartial, nonpartisan, and bonded third-party corporation contracted with by the state election audit board to conduct the audit required under this section.

NEW SECTION.  Sec. 3. A new section is added to chapter 29A.60 RCW to read as follows:

The election audit account is created in the custody of the state treasurer. All receipts from fines collected pursuant to section 2(11) of this act must be deposited into the account. Fifty percent of each deposit is designated for the state auditor and 50 percent is designated, in equal amounts, for each county that submits an election expense reimbursement for the election. Expenditures from the account may be used to pay for the costs incurred by the state auditor or a county to perform election audit requirements under this title. Only the state auditor or their designee may authorize expenditures from the account. The account is subject to allotment procedures under chapter 43.88 RCW, but an appropriation is not required for expenditures.

Sec. 4. RCW 29A.60.185 and 2018 c 218 s 2 are each amended to read as follows:

(1) Prior to the certification of the general election, a full forensic audit of the general election must be conducted in accordance with section 2 of this act.

(2) Prior to certification of the primary and special election ((as required by RCW 29A.60.190)), the county auditor shall conduct an audit of duplicated ballots in accordance with subsection (((2)))(3) of this section, and an audit using at minimum ((one))two of the following methods:

(a) An audit of results of votes cast on the direct recording electronic voting devices, or other in-person ballot marking systems, used in the county if there are races or issues with more than ten votes cast on all direct recording electronic voting devices or other in-person ballot marking systems in the county. This audit must be conducted by randomly selecting by lot up to ((four))50 percent of the direct recording electronic voting devices or other in-person ballot marking systems, or one direct recording electronic voting device or other in-person ballot marking system, whichever is greater, and, for each device or system, comparing the results recorded electronically with the results recorded on paper. For purposes of this audit, the results recorded on paper must be tabulated as follows: On ((one-fourth))50 percent of the devices or systems selected for audit, the paper records must be tabulated manually; on the remaining devices or systems, the paper records may be tabulated by a mechanical device determined by the ((secretary of state))state auditor to be capable of accurately reading the votes cast and printed thereon and qualified for use in the state under applicable state and federal laws. ((Three races or issues, randomly selected by lot,))The mayoral contest with the most votes cast, one randomly selected local government council contest, and at least one additional randomly selected ballot contest must be audited on each device or system. If in any particular election there is no mayoral contest, the county auditor shall randomly select another local government council race to audit. This audit procedure must be subject to observation ((by political party representatives if representatives have been appointed and are present at the time of the audit))in accordance with subsection (6) of this section. As used in this subsection, "in-person ballot marking system" or "system" means an in-person ballot marking system that retains or produces an electronic voting record of each vote cast using the system;

(b) A random check of the ballot counting equipment ((consistent with RCW 29A.60.170(3)))for accuracy;

(c) A risk-limiting audit. A "risk-limiting audit" means an audit protocol that makes use of statistical principles and methods which produce the most accurate outcome and are consistent with the highest industry standards and is designed to limit the risk of certifying an incorrect election outcome. ((The secretary of state shall:))

(i) ((Set))The state auditor shall set the risk limit. A "risk limit" means the largest statistical probability that an incorrect reported tabulation outcome is not detected in a risk-limiting audit((;)).

(ii) ((Randomly))The county auditor shall randomly select for audit ((at least one statewide contest))the mayoral race with the most votes cast, one local government council race selected at random, and ((for each county)) at least one ballot contest ((other than the selected statewide contest)). The county auditor shall randomly select ((a ballot contest))another local government council race for audit if in any particular election there is no ((statewide))mayoral contest((; and)).

(iii) ((Establish))The state auditor shall establish procedures for implementation of risk-limiting audits, including random selection of the audit sample, determination of audit size, and procedures for a comparison risk-limiting audit and ballot polling risk-limiting audit as defined in (c)(iii)(A) and (B) of this subsection. The audit sample and size must be sufficiently large and consistent with industry best practices proven to yield accurate results.

(A) In a comparison risk-limiting audit, the county auditor compares the voter markings on randomly selected ballots to the ballot-level cast vote record produced by the ballot counting equipment.

(B) In a ballot polling risk-limiting audit, the county auditor of a county using ballot counting equipment that does not produce ballot-level cast vote records reports the voter markings on randomly selected ballots until the prespecified risk limit is met; or

(d) An independent electronic audit of the original ballot counting equipment used in the county. The county auditor may either conduct an audit of all ballots cast, or limit the audit to ((three))five percent of the precincts or ((six))12 batches pursuant to procedures ((adopted under RCW 29A.60.170(3)))established by the state auditor. This audit must be conducted using an independent electronic audit system that is, at minimum:

(i) Approved by the ((secretary of state))state auditor;

(ii) Completely independent from all voting systems, including ballot counting equipment, that is used in the county;

(iii) Not connected to the internet, and incapable of connecting to any wireless, bluetooth, universal serial bus, or similar exterior drives which may compromise data;

(iv) Distributed or manufactured by a vendor different from the vendor that distributed or manufactured the original ballot counting equipment; and

(((iv)))(v) Capable of demonstrating that it can verify and confirm the logic and accuracy of the original ballot counting equipment's reported results.

(((2)))(3) Prior to certification of the election, the county auditor must conduct an audit of ballots duplicated under RCW 29A.60.125. The audit of duplicated ballots must involve a comparison of the duplicated ballot to the original ballot. The ((county canvassing board))state auditor must establish procedures for the auditing of duplicated ballots.

(((3)))(4) For each audit method included in this section, the ((secretary of state))state auditor must adopt procedures no later than six months before the primary, general election, or special election for expanding the audit to include additional ballots when an audit results in a discrepancy. The procedure must specify under what circumstances a discrepancy will lead to an audit of additional ballots, and the method to determine how many additional ballots will be selected. The ((secretary of state))state auditor shall also adopt procedures ((to investigate))no later than six months before the primary, general election, or special election for investigating the cause of any discrepancy found during an audit, which must include an investigation by the state election audit board for any discrepancies found in a general election.

(((4)))(5) The ((secretary of state))state auditor must establish rules ((by January 1, 2019,)) to implement and administer the auditing methods in this section((, including facilitating))which must include public observation in accordance with subsection (6) of this section and detailed reporting requirements to ensure proper transparency and accountability to the voters.

NEW SECTION.  Sec. 5. A new section is added to chapter 29A.12 RCW to read as follows:

(1)(a) The county auditor shall capture a forensic image of all voting systems used in a primary, special election, or general election and retain the image for at least 22 months after certification of the primary, special election, or general election. Forensic images must be captured using current industry best practices, including best practices around the use of technology such as write-blocking technology to prevent future alteration of the drive contents captured in the forensic image.

(b) A forensic image must be captured:

(i) Immediately before the special election, primary, or general election ballot scanning process begins;

(ii) After all special election, primary, or general election ballots have been processed and tallied but before certification of the special election, primary, or general election; and

(iii) No later than 24 hours after certification of the special election, primary, or general election.

(2) The forensic image must be created using write-blocking technology, or more advanced technology if available, to prevent future alteration of the drive contents captured in the forensic image.

(3) Software upgrades to voting systems are prohibited beginning 30 days prior to the special election, primary, or general election, and ending 90 days after certification of the special election, primary, or general election.

(4) A full forensic audit of the forensic images must be conducted in accordance with section 2 of this act.

(5) As used in this section:

(a) "Forensic image" means a copy of unaltered electronic information capturing all the ones and zeros and all the data contained on any and all devices, including but not limited to: Networking, analyzing, monitoring, storage to include all types of internal and external or data devices, routing, switching, and firewall devices, that are involved in any way with the process of an election. A forensic image must capture the deleted space on the drive and account for any recent formatting, deleted files or data, hidden files or data, and file or data fragments.

(b) "Voting system" has the same meaning as in RCW 29A.12.005.

NEW SECTION.  Sec. 6. A new section is added to chapter 29A.04 RCW to read as follows:

County auditors must retain all digital and hardcopy election data for 22 months after the primary, special election, and general election, including but not limited to: All data from voting systems, paper ballots, county auditor logs created and maintained in accordance with section 2 of this act, and the forensic imaging data required to be captured under section 5 of this act. For increased transparency and accountability, ballot images that do not contain any personally identifiable information shall be made available for in-person inspection after the election date, along with other reasonable election data from the audit results in section 2 of this act and RCW 29A.60.185, so long as they do not contain any personally identifiable information.

Sec. 7. RCW 29A.60.170 and 2018 c 218 s 3 are each amended to read as follows:

(1) At least twenty-eight days prior to any special election, general election, or primary, the county auditor shall request from the chair of the county central committee of each major political party a list of individuals who are willing to serve as observers. The county auditor has discretion to also request observers from any campaign or organization. The county auditor may delete from the lists names of those persons who indicate to the county auditor that they cannot or do not wish to serve as observers, and names of those persons who, in the judgment of the county auditor, lack the ability to properly serve as observers after training has been made available to them by the auditor.

(2) The counting center is under the direction of the county auditor and must be open to observation by one representative from each major political party, if representatives have been appointed by the respective major political parties and these representatives are present while the counting center is operating. The proceedings must be open to the public, but no persons except those employed and authorized by the county auditor may touch any ballot or ballot container or operate a vote tallying system.

(3) A random check of the ballot counting equipment must be conducted upon mutual agreement of the political party observers or at the discretion of the county auditor. The random check procedures must be adopted by the ((county canvassing board, and consistent with rules adopted under RCW 29A.60.185(4), prior to the processing of ballots. The random check process shall involve a comparison of a manual count or electronic count if an audit under RCW 29A.60.185(1)(d) is conducted to the machine count from the original ballot counting equipment and may involve up to either three precincts or six batches depending on the ballot counting procedures in place in the county. The random check will be limited to one office or issue on the ballots in the precincts or batches that are selected for the check. The selection of the precincts or batches to be checked must be selected according to procedures established by the county canvassing board. The random check procedures must include a process, consistent with RCW 29A.60.185(3) and rules adopted under RCW 29A.60.185(4), for expanding the audit to include additional ballots when a random check conducted under this section results in a discrepancy. The procedure must specify under what circumstances a discrepancy will lead to an audit of additional ballots and the method to determine how many additional ballots will be selected. Procedures adopted under RCW 29A.60.185 pertaining to investigations of any discrepancy found during an audit must be followed))state auditor and be based on procedures that meet the current version of the best practices for securing election systems as established and published by the federal cybersecurity and infrastructure security agency. The check must be completed no later than forty-eight hours after election day.

(((4)(a) By November 1, 2018, the secretary of state shall:

(b) By December 15, 2018, the secretary of state shall submit a report, in compliance with RCW 43.01.036, to the appropriate committees of the legislature that provides recommendations, based on the evaluation performed under (a) of this subsection, for adopting best practices and uniform procedures.))

Sec. 8. RCW 29A.40.100 and 2011 c 10 s 40 are each amended to read as follows:

County auditors must request in writing that at least two observers be appointed by each of the major political parties to be present during the processing of ballots at the counting center. County auditors have discretion to also request that observers be appointed by any campaigns or organizations. If the county auditor elects to request that observers be appointed by a campaign for a particular race, the county auditor must invite all campaigns for that race to appoint an observer to be present. The absence of the observers will not prevent the processing of ballots if the county auditor has requested their presence at least one week in advance in writing and provided the date and time of the observation. Observers must not be prohibited or otherwise prevented from in-person observation of the processing of ballots during any stage of canvassing or election auditing.

Sec. 9. RCW 29A.72.230 and 2003 c 111 s 1823 are each amended to read as follows:

Upon the filing of an initiative or referendum petition, the secretary of state, with oversight and validation of the process by the state auditor, shall proceed to verify and canvass the names of the legal voters on the petition. The verification and canvass of signatures on the petition ((may))must be observed by persons representing the advocates and opponents of the proposed measure so long as they make no record of the names, addresses, or other information on the petitions or related records during the verification process except upon the order of the ((superior court of Thurston county))state auditor. ((The secretary of state may limit the number of observers to not less than two on each side, if in his or her opinion, a greater number would cause undue delay or disruption of the verification process. Any such limitation shall apply equally to both sides.)) The ((secretary of state may use))state auditor shall adopt by rule any statistical sampling techniques authorized for use for this verification and canvass ((which have been adopted by rule as provided by chapter 34.05 RCW)). No petition will be rejected on the basis of any statistical method employed, and no petition will be accepted on the basis of any statistical method employed if such method indicates that the petition contains fewer than the requisite number of signatures of legal voters. If the secretary of state with agreement of the state auditor finds the same name signed to more than one petition, he or she shall reject all but the first such valid signature. For an initiative to the legislature, the secretary of state shall transmit a certified copy of the proposed measure to the legislature at the opening of its session and, as soon as the signatures on the petition have been verified and canvassed, the secretary of state shall send to the legislature a certificate of the facts relating to the filing, verification, and canvass of the petition.

Sec. 10. RCW 29A.60.110 and 2018 c 218 s 4 are each amended to read as follows:

(1) Immediately after their tabulation, all ballots counted at a ballot counting center must be sealed in containers that identify the primary ((or)), general election, or special election and be retained for at least ((sixty days or according to federal law, whichever is longer))22 months.

(2) In the presence of major party observers ((who are available, ballots may be removed from the sealed containers at the elections department and consolidated into one sealed container for storage purposes. The)), with a minimum of two observers from each party being present, containers may only be opened by the canvassing board as part of the canvass, to conduct recounts, to conduct a random check ((under RCW 29A.60.170)), to conduct an audit under ((RCW 29A.60.185))section 2 of this act, or by order of ((the superior))a court judge in a contest or election dispute. If the canvassing board opens a ballot container, it shall be done in the presence of at least two observers from each of the major political parties, and the candidates on the ballot or their designated representatives if designated in writing, and the ballot issue representatives, must also be invited to attend. The canvass board shall make a full written record of the additional tabulation or examination made of the ballots along with the date, time, and names of canvass board members who conducted the tabulation or examination. A live video camera recording must capture the opening of ballot containers and removal or handling of any ballots for any purpose. This record must be added to any other record of the canvassing process and storage process in that county, and retained for 22 months.

Sec. 11. RCW 42.56.420 and 2021 c 26 s 1 are each amended to read as follows:

The following information relating to security is exempt from disclosure under this chapter:

(1) Those portions of records assembled, prepared, or maintained to prevent, mitigate, or respond to criminal terrorist acts, which are acts that significantly disrupt the conduct of government or of the general civilian population of the state or the United States and that manifest an extreme indifference to human life, the public disclosure of which would have a substantial likelihood of threatening public safety, consisting of:

(a) Specific and unique vulnerability assessments or specific and unique response or deployment plans, including compiled underlying data collected in preparation of or essential to the assessments, or to the response or deployment plans which are not related to the validity and legitimacy of the election process or outcome; and

(b) Records not subject to public disclosure under federal law that are shared by federal or international agencies, and information prepared from national security briefings provided to state or local government officials related to domestic preparedness for acts of terrorism;

(2) Those portions of records containing specific and unique vulnerability assessments or specific and unique emergency and escape response plans at a city, county, or state adult or juvenile correctional facility, or secure facility for persons civilly confined under chapter 71.09 RCW, the public disclosure of which would have a substantial likelihood of threatening the security of a city, county, or state adult or juvenile correctional facility, secure facility for persons civilly confined under chapter 71.09 RCW, or any individual's safety;

(3) Information compiled by school districts or schools in the development of their comprehensive safe school plans under RCW 28A.320.125, to the extent that they identify specific vulnerabilities of school districts and each individual school;

(4) Information regarding the public and private infrastructure and security of computer and telecommunications networks, consisting of security passwords, security access codes and programs, access codes for secure software applications, security and service recovery plans, security risk assessments, and security test results to the extent that they identify specific system vulnerabilities which are not related to the validity and legitimacy of the election process or outcome, and other such information the release of which may increase risk to the confidentiality, integrity, or availability of security, information technology infrastructure, or assets which are not related to the validity and legitimacy of the election process or outcome;

(5) The system security and emergency preparedness plan required under RCW 35.21.228, 35A.21.300, 36.01.210, 36.57.120, 36.57A.170, and 81.112.180; and

(6) Personally identifiable information of employees, and other security information, of a private cloud service provider that has entered into a criminal justice information services agreement as contemplated by the United States department of justice criminal justice information services security policy, as authorized by 28 C.F.R. Part 20((; and

(c) The exemptions specified in (a) of this subsection do not prohibit an audit authorized or required under Title 29A RCW from being conducted)).

Sec. 12. RCW 29A.40.110 and 2011 c 349 s 18, 2011 c 348 s 4, and 2011 c 10 s 41 are each reenacted and amended to read as follows:

(1) The secretary of state and state auditor shall establish chain of custody procedures for handling ballots at all times, which must be documented in writing no less than 90 days before the primary or election. State and county election officials and election personnel shall, for each step of ballot processing, attest that they are following the chain of custody procedures established under this subsection, or, if not, the reason for deviating from the established procedure. The attestation must include the election official's or election personnel's initials, date, and time of attestation.

(2) The opening and subsequent processing of return envelopes for any primary ((or)), general election, or special election ((may))must begin upon receipt. The tabulation of ((absentee)) ballots must not commence until after 8:00 p.m. on the day of the primary or election. All ballots must be processed and counted no later than 11:59 p.m. on the seventh day after the primary, special election, or general election, not including Saturdays, Sundays, and legal holidays.

(((2)))(3) All received return envelopes must be placed in secure locations with live video cameras focused on where the ballots are kept for storage at all times during the election process from the time of delivery to the county auditor until their subsequent opening. After opening the return envelopes, the county canvassing board shall place all of the ballots in secure, tamper-proof storage until processing. ((Ballots))Under the surveillance of a live video camera, ballots may be taken from the inner envelopes and all the normal procedural steps may be performed to prepare these ballots for tabulation. Ballots that are not actively being processed for counting or actively being counted must remain in secure, locked, and tamper-proof storage with live video cameras focused on where the ballots are kept for storage at all times. Ballots that have yet to be counted must be stored in batches and clearly labeled and separated from ballots that have been processed and counted in a manner such that they are incapable of being comingled. The stored batches of counted ballots must be accompanied with information that specifies which specific tabulation machine was used to count those ballots to provide for easy auditing of the ballots and voting systems as needed.

(((3)))(4) The canvassing board, or its designated official representatives, shall examine the postmark on the return envelope and signature on the declaration before processing the ballot. The ballot must either be received no later than 8:00 p.m. on the day of the primary or election, or must be postmarked no later than the day of the primary or election. All personnel assigned to verify signatures must receive training on statewide standards for signature verification. Personnel shall verify that the voter's signature on the ballot declaration is the same as the signature of that voter in the registration files of the county. ((Verification may be conducted by an automated verification system approved by the secretary of state.)) A variation between the signature of the voter on the ballot declaration and the signature of that voter in the registration files due to the substitution of initials or the use of common nicknames is permitted so long as the surname and handwriting are clearly the same.

(((4)))(5) If the postmark is missing or illegible, the date on the ballot declaration to which the voter has attested determines the validity, as to the time of voting, for that ballot. For overseas voters and service voters, the date on the declaration to which the voter has attested determines the validity, as to the time of voting, for that ballot. Any legally registered overseas voter or service voter may return the signed declaration and voted ballot by fax or email by 8:00 p.m. on the day of the primary or election, and the county auditor must use established procedures to maintain the secrecy of the ballot.

Sec. 13. RCW 29A.60.160 and 2016 c 134 s 2 are each amended to read as follows:

(1) The county auditor, as delegated by the county canvassing board, shall process ballots and canvass the votes cast ((at that primary or election on a daily basis in counties with a population of seventy-five thousand or more, or at least every third day for counties with a population of less than seventy-five thousand, if the county auditor is in possession of more than five hundred ballots that have yet to be canvassed.

(3) In order to protect the secrecy of a ballot, the county auditor may use discretion to decide when to process ballots and canvass the votes))on a daily basis, not including Saturdays, Sundays, or legal holidays.

(((4)))(2) Tabulation results must be made available to the public immediately upon completion of the canvass. Records of ballots counted must be made available to the public at the end of each day that the county auditor has processed ballots during and after an election.

Sec. 14. RCW 29A.60.190 and 2019 c 7 s 5 are each amended to read as follows:

(1)(a) Ten days after a special election held in February or April, ten days after a presidential primary held pursuant to chapter 29A.56 RCW, fourteen days after a primary, or twenty-one days after a general election except as specified in (b) of this subsection, the county canvassing board shall complete the canvass and the secretary of state and state auditor shall certify the results. Saturdays, Sundays, and legal holidays are not counted for purposes of this section. Each ballot that was returned before 8:00 p.m. on the day of the special election, general election, primary, or presidential primary, and each ballot bearing a postmark on or before the date of the special election, general election, primary, or presidential primary and received ((no later than the day before certification,))by 11:59 p.m. of the seventh day after the election not including Saturdays, Sundays, and legal holidays must be included in the canvass report.

Sec. 15. RCW 29A.60.240 and 2013 c 11 s 64 are each amended to read as follows:

(1) The secretary of state and the state auditor shall, as soon as possible but in any event not later than seventeen days following the primary, canvass and certify the returns of all primary elections as to candidates for statewide offices, United States senators and representatives in Congress, and all legislative and judicial candidates whose district extends beyond the limits of a single county.

Sec. 16. RCW 29A.60.250 and 2013 c 11 s 65 are each amended to read as follows:

(1) As soon as the returns have been received from all the counties of the state, but not later than the ((thirtieth))45th day after the general election, the secretary of state and the state auditor in the presence of the state election audit board shall canvass and certify the returns of the general election as to candidates for statewide offices, the United States senate, congress, and all legislative and judicial candidates whose districts extend beyond the limits of a single county. The secretary of state shall transmit a copy of the certification to the state election audit board, governor, president of the senate, and speaker of the house of representatives.

Sec. 17. RCW 29A.60.260 and 2003 c 111 s 1526 are each amended to read as follows:

(1) The votes on proposed amendments to the state Constitution, recommendations for the calling of constitutional conventions and other questions submitted to the people must be counted, canvassed, and returned by each county canvassing board in the manner provided by law for counting, canvassing, and returning votes for candidates for state offices. The secretary of state and the state auditor shall, in the presence of the ((governor))state election audit board, within thirty days after the election, canvass the votes upon each question and certify to the ((governor))state election audit board the result. The ((governor))state election audit board shall forthwith issue a proclamation giving the whole number of votes cast in the state for and against such measure and declaring the result. If the vote cast upon an initiative or referendum measure is equal to less than one-third of the total vote cast at the election, the ((governor))state election audit board shall proclaim the measure to have failed.

NEW SECTION.  Sec. 18. A new section is added to chapter 29A.40 RCW to read as follows:

A voter may only designate a person with whom the voter has an established relationship to return a voted ballot on his or her behalf, and no person may return a ballot on behalf of another voter who does not meet the criteria in this section. No entity or organization may return a ballot on behalf of another voter. As used in this section, a person with an established relationship to the voter means the registered voter's spouse, family member, legal guardian, or person the voter has an in-person continuous relationship with of 12 months or more.

NEW SECTION.  Sec. 19. A new section is added to chapter 29A.84 RCW to read as follows:

A person who willfully violates section 18 of this act regarding the return of ballots on behalf of another person is guilty of a class C felony punishable under RCW 9A.20.021.

Sec. 20. RCW 29A.08.125 and 2018 c 109 s 7 are each amended to read as follows:

(1) The office of the secretary of state shall maintain a statewide voter registration database. This database must be a centralized, uniform, interactive computerized statewide voter registration list that contains the name and registration information of every legally registered voter in the state.

(2) The statewide list ((is the official list of registered voters for the conduct of all elections))must match the information of legally registered voters in the county's voter registration system. The county auditor's voter registration list is the official list of legally registered voters for the county. If there is a discrepancy between the county's voter registration system and the statewide voter registration database, the county's voter registration system is the official list.

(3) The statewide list must include, but is not limited to, the full legal name, date of birth, residence address, signature, gender, and date of registration of every legally registered voter in the state.

(4) A unique identifier must be assigned to each registered voter in the state for auditing purposes.

(5) The database must be coordinated with other government databases within the state including, but not limited to, the department of corrections, the department of licensing, the department of health, the administrative office of the courts, and county auditors. ((The database may also be coordinated with the databases of election officials in other states.))These efforts must be for the sole purpose of validating the accuracy of the information in the statewide voter registration database. The secretary of state must provide any valid updates resulting from these efforts to the county auditor. The county auditor must retain a copy of these transferred files from the secretary of state for 22 months and must store them separately from the county registered voter file.

(6) Authorized employees of the secretary of state and each county auditor must have immediate electronic access to the information maintained in the database, accessible only by a unique password provided to each employee, the secretary of state, and county auditor.

(7) Voter registration information received by each county auditor must be electronically entered into the database. The office of the secretary of state must provide support, as needed, to enable each county auditor to enter and maintain voter registration information in the state database.

(8) The secretary of state has data ((authority))guidance oversight over all voter registration data. Each county auditor has data authority over his or her county's voter registration data.

(9) The voter registration database must be designed to accomplish at a minimum, the following:

(a) ((Comply with the help America vote act of 2002 (P.L. 107-252);

(b))) Identify, investigate, and remove duplicate voter registrations, identified by a comparison of the name, date of birth, and address;

(((c)))(b) Identify suspected duplicate voters;

(((d)))(c) Screen against any available databases maintained by other government agencies to identify voters who are ineligible to vote due to a felony conviction, lack of Washington state residency or United States citizenship, or mental incompetence;

(((e)))(d) Provide images of voters' signatures for the purpose of checking signatures on initiative and referendum petitions;

(((f)))(e) Provide for a comparison between the voter registration database and the department of licensing change of address database;

(((g)))(f) Provide access for county auditors that includes the capability to update registrations and search for duplicate or invalid registrations;

(((h)))(g) Provide for the cancellation of registrations of voters who have moved out of state; and

(((i)))(h) Provide for the separate storage of pending registration records for all future voters who have not yet reached eighteen years of age in a manner that these records will not appear on the official list of legally registered voters authorized to vote until the future registrant is no longer in pending status as defined under RCW 29A.08.615.

(10) The secretary of state may, upon agreement with other appropriate jurisdictions, screen against any available databases ((maintained by election officials in other states and databases)) maintained by federal agencies including, but not limited to, the federal bureau of investigation, the federal court system, the federal bureau of prisons, and the bureau of citizenship and immigration services for the purpose of verifying a voter registration meets the required criteria to legally vote in Washington.

(11) The database shall retain information regarding previous successful appeals of proposed cancellations of registrations in order to avoid repeated cancellations for the same reason. Any canceled voter registrations must be completely removed from the official statewide voter registration database and the county's voter registration database and retained in a separate database located on different equipment from the statewide voter registration database and the county's voter registration database. All canceled voter registrations must remain inactive in this manner unless and until such time the voter legally meets the requirements to vote again in Washington state.

(12) Each county auditor ((shall))must maintain a list of all legally registered voters within the county that are ((contained))also to be maintained on the ((official)) statewide voter registration list. In addition to the information maintained in the statewide database, the county database must also maintain the applicable taxing district and precinct codes for each voter in the county, and a list of elections in which the individual voted.

(13) Each county auditor shall allow only secure and fully auditable electronic access and information transfer between the county's voter registration system and the official statewide voter registration list.

Sec. 21. RCW 29A.08.105 and 2009 c 369 s 8 are each amended to read as follows:

(1) ((In compliance with the Help America Vote Act (P.L. 107-252), the))The centralized statewide voter registration list maintained by the secretary of state ((is))must match the voter registration data submitted by each county auditor to be the official list of eligible voters for all elections.

(2) In all counties, the county auditor shall be the chief registrar of voters for every precinct within the county.

Sec. 22. RCW 29A.08.620 and 2011 c 10 s 17 are each amended to read as follows:

(1) Each county auditor must request change of address information from the postal service for all mail ballots no later than 90 days prior to the primary, special election, or general election.

(2) ((The))Periodically and no later than 60 days prior to the primary, special election, or general election the county auditor shall, based on the information received under subsection (1) of this section, transfer the registration of a voter and send an acknowledgment notice to the new address informing the voter of the transfer if change of address information received by the county auditor from the postal service, the department of licensing, or another agency designated to provide voter registration services indicates that the voter has moved within the county.

(3) ((The))Periodically and no later than 60 days prior to the primary, special election, or general election the county auditor shall, based on the information received under subsection (1) of this section, place a voter on inactive status and send to ((all))the last known ((addresses))address a confirmation notice ((and a voter registration application))that there is a change of address if change of address information received by the county auditor from the postal service, the department of licensing, or another agency designated to provide voter registration services indicates that the voter has moved from one county to another.

(4) ((The))Periodically and no later than 60 days prior to the primary, special election, or general election the county auditor shall, based on the information received under subsection (1) of this section, place a voter on inactive status and send to ((all))the last known ((addresses))address a confirmation notice if any of the following occur:

(a) Any document mailed by the county auditor to a voter is returned by the postal service as undeliverable without address correction information; or

(b) Change of address information received from the postal service, the department of licensing, or another state agency designated to provide voter registration services indicates that the voter has moved out of the state.

Sec. 23. RCW 29A.08.510 and 2009 c 369 s 26 are each amended to read as follows:

The registrations of deceased voters ((may))must be canceled from voter registration lists as follows:

(1) ((Periodically))(a) At least quarterly, and no later than 60 days before a primary, special election, or general election, the registrar of vital statistics of the state shall prepare a list of persons who resided in each county, for whom a death certificate was transmitted to the registrar and was not included on a previous list, and shall supply the list to the secretary of state. The secretary of state shall also obtain the current social security administration's death master file at least on a quarterly basis but no later than 60 days before a primary, special election, or general election. The secretary of state shall send, in a separate file, the information received pursuant to this subsection to the county auditor in each county where the county voter registration database needs to be updated to reflect the information received.

(b) The secretary of state and county auditors shall compare ((this list))these lists with the registration records and cancel the registrations of deceased voters no later than 50 days before a primary, special election, or general election.

(2) In addition, each county auditor may also use appropriate government agencies and newspaper obituary articles as a source of information for identifying deceased voters and canceling a registration. The auditor must verify the identity of the voter by matching the voter's date of birth or an address. The auditor shall keep a written current log and record the date and source of the information in the cancellation records along with the date and time of the cancellation and the first and last name of the election employee making the cancellation.

(3) In addition, ((any))a legally registered voter who provides proof to the county auditor's office of an established relationship with a deceased registered voter may sign a statement, subject to the penalties of perjury, to the effect that to his or her personal knowledge or belief another registered voter is deceased. This statement may be filed with the county auditor or the secretary of state. Upon the receipt of such signed statement, the county auditor or the secretary of state shall cancel the registration from the official state voter registration list. As used in this subsection, a person with an established relationship to the deceased registered voter means the deceased registered voter's spouse, family member, legal guardian, or executor of his or her will.

Sec. 24. RCW 29A.08.540 and 2004 c 267 s 127 are each amended to read as follows:

(1) Registration records of persons whose voter registrations have been canceled as authorized under this title must be preserved ((in the manner prescribed by rule by the secretary of state))for at least 22 months for audit purposes, and in a manner determined by the county auditor to ensure that canceled registrations do not appear on the voter registration list until such time as the voter is properly registered. Information from such canceled registration records is available for public inspection ((and copying to the same extent established by RCW 29A.08.710 for other voter registration information)). For each cancellation, the county auditor shall keep a current log and record the source of the information used to cancel a voter's registration, the date the information was received, the date and time of the cancellation, and the first and last name of the election employee making the cancellation in the voter registration database.

Sec. 25. RCW 29A.12.020 and 2003 c 111 s 302 are each amended to read as follows:

The ((secretary of state))state auditor shall inspect, evaluate, and publicly test all voting systems or components of voting systems that are submitted for review ((under RCW 29A.12.030)). The ((secretary of state))state auditor shall determine whether the voting systems conform with all of the requirements of this title, the applicable rules adopted in accordance with this title, and with ((generally accepted safety requirements))the most current version of the best practices for securing election systems as established and published by the federal cybersecurity and infrastructure security agency. The state auditor must issue a report within 30 days providing details of this review, that includes the state auditor's findings and recommendations. The ((secretary of state))state auditor shall transmit a copy of the report of any examination under this section, within thirty days after completing the examination, to the secretary of state and the county auditor of each county.

NEW SECTION.  Sec. 26. A new section is added to chapter 29A.12 RCW to read as follows:

The secretary of state and state auditor shall ensure that election practices within the state adhere to the most current version of the best practices for securing election systems as established and published by the federal cybersecurity and infrastructure security agency and to the state auditor's recommendations. The state auditor must review and verify that these published best practices have been used and these standards have been properly met.

Sec. 27. RCW 29A.12.030 and 2003 c 111 s 303 are each amended to read as follows:

The manufacturer or distributor of a voting system or component of a voting system may submit that system or component to the ((secretary of state))state auditor for examination ((under RCW 29A.12.020)).

Sec. 28. RCW 29A.12.040 and 2003 c 111 s 304 are each amended to read as follows:

(((1) The secretary of state may rely on the results of independent design, engineering, and performance evaluations in the examination under RCW 29A.12.020 if the source and scope of these independent evaluations are specified by rule.

(2))) The ((secretary of state))state auditor may contract with experts in software, hardware, network, cybersecurity, mechanical, or electrical engineering or data processing to assist in examining a voting system or component. The manufacturer or distributor who has submitted a voting system for testing ((under RCW 29A.12.030)) shall pay the ((secretary of state))state auditor a deposit to reimburse the cost of any contract for consultation under this section and for any other unrecoverable costs associated with the examination of a voting system or component by the manufacturer or distributor who submitted the voting system or component for examination.

Sec. 29. RCW 29A.12.070 and 2020 c 101 s 3 are each amended to read as follows:

An agreement to purchase or lease a voting system or a component of a voting system is subject to that system or component passing:

(1) An acceptance test sufficient to demonstrate that the equipment is the same as that certified by the ((secretary of state))state auditor and that the equipment is operating correctly as delivered to the county; and

(2) A logic and accuracy test and vulnerability test conducted by ((a))an independent private sector vendor certified by the federal ((or state public entity which includes participation by))cybersecurity and infrastructure security agency, separate from the manufacturer or distributor of the system being tested, with participation by the state auditor and local elections officials.

Sec. 30. RCW 29A.12.080 and 2013 c 11 s 22 are each amended to read as follows:

No voting device shall be approved by the ((secretary of state))state auditor unless it passes a logic and accuracy test, vulnerability test, and:

(1) Secures to the voter secrecy in the act of voting;

(2) Remains disconnected from the internet and other mechanisms that could allow remote access to the voting systems or network;

(3) Permits the voter to vote for any person for any office and upon any measure that he or she has the right to vote for;

(((3)))(4) Correctly registers all votes cast for any and all persons and for or against any and all measures; and

(((4) Provides that a vote for more than one candidate cannot be cast by one single operation of the voting device or vote tally system except when voting for president and vice president of the United States; and

(5) Except for functions or capabilities unique to this state, has))(5) Has been tested and certified by an independent ((testing authority designated by the United States election assistance commission))private sector vendor certified by the federal cybersecurity and infrastructure security agency separate from the manufacturer or distributor of the system being tested, with participation by the state auditor and local elections officials. A county auditor has the authority to conduct an additional test and certification of the voting devices by an independent third party and have the cost reimbursed by the secretary of state.

Sec. 31. RCW 29A.12.101 and 2006 c 207 s 3 are each amended to read as follows:

(1) The ((secretary of state))state auditor shall not approve a vote tallying system unless it:

(((1)))(a) Correctly counts votes on ballots ((on which the proper number of votes have been marked for any office or issue));

(((2)))(b) Ignores votes marked for any office or issue where more than the allowable number of votes have been marked, but correctly counts the properly voted portions of the ballot;

(((3)))(c) Accumulates a count of the specific number of ballots tallied for each precinct, total votes by candidate for each office, and total votes for and against each issue of the ballot in that precinct;

(((4)))(d) Produces precinct and cumulative totals in printed form; and

(((5) Except for functions or capabilities unique to this state, has))(e) Has been tested and certified by an independent ((testing authority designated by the United States election assistance commission))private sector vendor certified by the federal cybersecurity and infrastructure security agency, separate from the manufacturer or distributor of the system being tested.

Sec. 32. RCW 29A.12.130 and 2003 c 111 s 313 are each amended to read as follows:

At least three days before each state primary or general election, the office of the ((secretary of state))state auditor shall provide for the conduct of tests of the programming for each vote tallying system to be used at that primary or general election. The test must verify that the system will correctly count the vote cast for all candidates and on all measures appearing on the ballot at that primary or general election. The test shall verify the capability of the vote tallying system to perform all of the functions that can reasonably be expected to occur during conduct of that particular primary or election. If any error is detected, the cause shall be determined and corrected, and an errorless total ((shall))must be produced before the primary or election.

Such tests ((shall))must be observed by at least ((one))two representatives from each major political party((, if representatives have been appointed by the respective major political parties and are present at the test,)) and ((shall))must be open to candidates, the press, and the public. The county auditor and any political party observers shall certify that the test has been conducted in accordance with this section. Copies of this certification shall be retained by the secretary of state, the state auditor, and the county auditor. All programming materials, test results, and test ballots ((shall))must be ((securely sealed until the day of the primary or general election))made available for audit under section 2 of this act.

Sec. 33. RCW 29A.12.140 and 2003 c 111 s 314 are each amended to read as follows:

The ((secretary of state))state auditor may publish recommended procedures for the operation of the various vote tallying systems that have been approved. These procedures allow the office of the ((secretary of state))state auditor to restrict or define the use of approved systems in elections.

Sec. 34. RCW 29A.12.150 and 2013 c 11 s 24 are each amended to read as follows:

The ((secretary of state))state auditor shall not certify under this title any voting device or machine for use in conducting a primary or general or special election in this state unless the device or machine correctly records on a separate ballot the votes cast by each elector for any person and for or against any measure and such separate ballots are available for audit purposes after such a primary or election.

Sec. 35. RCW 29A.12.160 and 2011 c 10 s 25 are each amended to read as follows:

(1) At each voting center, at least one voting unit certified by the ((secretary of state))state auditor shall provide access to individuals who are blind or visually impaired.

(2) For purposes of this section, the following definitions apply:

(a) "Accessible" includes receiving, using, selecting, and manipulating voter data and controls.

(b) "Nonvisual" includes synthesized speech, Braille, and other output methods.

(c) "Blind and visually impaired" excludes persons who are both deaf and blind.

Sec. 36. RCW 29A.12.180 and 2018 c 218 s 6 are each amended to read as follows:

(1) A manufacturer or distributor of a voting system or component of a voting system that is certified by the ((secretary of state under RCW 29A.12.020))state auditor shall disclose to the state election audit board in the case of a general election, secretary of state ((and)), state auditor, attorney general, and county auditors of counties affected, any breach of the security of its system immediately following discovery of the breach if:

(a) The breach has, or is reasonably likely to have, compromised the security, confidentiality, or integrity of an election in ((any))the state or nation; or

(b) Personal information of residents in any state was, or is reasonably believed to have been, acquired by an unauthorized person as a result of the breach and the personal information was not secured. For purposes of this subsection, "personal information" has the meaning given in RCW 19.255.010.

(2) Notification under subsection (1) of this section must be made in the most expedient time possible and without unreasonable delay.

Sec. 37. RCW 29A.12.190 and 2018 c 218 s 7 are each amended to read as follows:

(1) The ((secretary of state))state auditor may decertify a voting system or any component of a voting system and withdraw authority for its future use or sale in the state if, at any time after certification, the ((secretary of state))state auditor determines that:

(a) The system or component fails to meet the standards set forth in applicable federal ((guidelines))cybersecurity and infrastructure security agency standards;

(b) The system or component was materially misrepresented in the certification application;

(c) The applicant has installed unauthorized modifications to the certified software or hardware; or

(d) ((Any other reason authorized by rule adopted by the secretary of state))There is a legitimate concern that a system or component would compromise the security of elections in the state. The state auditor shall submit a written report of the concerns to the state election audit board during a general election, secretary of state, and county auditors of affected counties. The secretary of state and state auditor shall post a working link to the state auditor's report on their respective websites. The link must be predominantly displayed on the top one-third of the website.

(2) The ((secretary of state))state auditor may decertify a voting system or any component of a voting system and withdraw authority for its future use or sale in the state if the manufacturer or distributor of the voting system or component thereof fails to ((comply with the notification requirements of RCW 29A.12.180))notify the secretary of state and state auditor of any security breach in accordance with the notification requirements in RCW 29A.12.180.

Sec. 38. RCW 29A.12.200 and 2020 c 101 s 2 are each amended to read as follows:

(1) The secretary of state and state auditor must annually consult with the ((Washington state fusion center,)) state chief information officer((,)) and each county auditor to identify instances of security breaches of election systems or election data.

(2) To the extent possible, the secretary of state and state auditor must identify whether the source of a security breach, if any, is a foreign entity, domestic entity, or both.

(3) By December 31st of each year, the state auditor with the consultation of the secretary of state must submit a report to the state election audit board for the general election of the current year, governor, state chief information officer, ((Washington state fusion center,)) and the chairs and ranking members of the appropriate legislative committees from the senate and house of representatives that includes information on any instances of security breaches identified under subsection (1) of this section and options to increase the security of the election systems and election data, and to prevent future security breaches. The report, and any related material, data, or information provided pursuant to subsection (1) of this section or used to assemble the report, may only be distributed to, or otherwise shared with, the individuals specifically mentioned in this subsection (3), as well as county auditors for audit purposes, and an independent private sector vendor certified by the federal cybersecurity agency separate from the manufacturer or distributer of the voting system being used in the current election.

(4) For the purposes of this section:

(a) "Foreign entity" means an entity that is not organized or formed under the laws of the United States, or a person who is not domiciled in the United States or a citizen of the United States.

(b) "Security breach" means a breach of the election system or associated data where the system or associated data has been penetrated, accessed, or manipulated by an unauthorized person.

NEW SECTION.  Sec. 39. A new section is added to chapter 29A.04 RCW to read as follows:

Prior to working on any election, an election official, employee, or volunteer must sign and date an oath as follows:

"I will help conduct the election and any election audit honestly, truthfully, with good faith effort, and to the best of my ability. I acknowledge that any intentional and knowing fraud committed on my part is a gross misdemeanor and punishable under RCW 9A.20.021."

NEW SECTION.  Sec. 40. A new section is added to chapter 29A.84 RCW to read as follows:

Unless otherwise specified under this chapter, an election official, election employee, or election volunteer who knowingly and intentionally uses his or her position to commit fraud is guilty of a class C felony, punishable under RCW 9A.20.021.

Sec. 41. RCW 29A.36.111 and 2009 c 414 s 1 are each amended to read as follows:

(1) Every ballot for a single combination of issues, offices, and candidates shall be uniform within a precinct and shall identify the type of primary or election, the county, and the date of the primary or election, and the ballot or voting device shall contain instructions on the proper method of recording a vote, including write-in votes. Each position, together with the names of the candidates for that office, shall be clearly separated from other offices or positions in the same jurisdiction. The offices in each jurisdiction shall be clearly separated from each other. No paper ballot or ballot card may be marked by or at the direction of an election official in any way that would permit the identification of the person who voted that ballot.

(2) ((An elections [election] official may not enter into or extend any contract with a vendor if such contract may allow the vendor to acquire an ownership interest in any data pertaining to any voter, any voter's address, registration number, or history, or any ballot.))All ballots, including replacement ballots, provisional ballots, duplicated ballots, and paper records from voting devices to be electronically or manually tabulated, must contain an official watermark approved by the secretary of state and state auditor. A ballot that is not the original ballot mailed to the voter must include an official watermark that is visually distinct from the watermark contained in original ballots. Ballots for overseas and service voters must include an official watermark that is visually distinct from the watermark contained in original ballots and nonoriginal ballots, and must be visible on the ballot received by the county. The watermark must be sufficient to prove that the ballot is an official ballot and not a reproduction. The secretary of state and the state auditor shall take measures to secure the software or firmware used to store the electronic file of the watermark. Only ballots containing the official watermark are valid and may be counted.

Sec. 42. RCW 29A.60.235 and 2018 c 218 s 9 are each amended to read as follows:

(1) The county auditor shall prepare at the time of certification an election reconciliation report that discloses the following information:

(a) The number of registered voters;

(b) The number of ballots issued;

(c) The number of ballots received;

(d) The number of ballots counted;

(e) The number of ballots rejected;

(f) The number of provisional ballots issued;

(g) The number of provisional ballots received;

(h) The number of provisional ballots counted;

(i) The number of provisional ballots rejected;

(j) The number of federal write-in ballots received;

(k) The number of federal write-in ballots counted;

(l) The number of federal write-in ballots rejected;

(m) The number of overseas and service ballots issued by mail, email, website link, or facsimile;

(n) The number of overseas and service ballots received by mail, email, or facsimile;

(o) The number of overseas and service ballots counted by mail, email, or facsimile;

(p) The number of overseas and service ballots rejected by mail, email, or facsimile;

(q) The number of nonoverseas and nonservice ballots sent by email, website link, or facsimile;

(r) The number of nonoverseas and nonservice ballots received by email or facsimile;

(s) The number of nonoverseas and nonservice ballots that were rejected for:

(i) Failing to send an original or hard copy of the ballot by the certification deadline; or

(ii) Any other reason, including the reason for rejection;

(t) The number of voters credited with voting;

(u) The number of replacement ballots requested;

(v) The number of replacement ballots issued;

(w) The number of replacement ballots received;

(x) The number of replacement ballots counted;

(y) The number of replacement ballots rejected; and

(z) Any other information the state auditor or ((secretary of state))county auditor deems necessary to reconcile the number of ballots counted with the number of voters credited with voting, and to maintain an audit trail.

(2) The county auditor must make the report available to the public at the auditor's office and must publish the report on the auditor's website ((at the time of certification))upon completion of the report. The county auditor must submit the report in writing to the secretary of state, state auditor, and state election audit board for a general election, at the time of ((certification in any form determined by the secretary of state))completion of the report.

(3)(a) The secretary of state, state auditor, and state election audit board for a general election, must ((collect))receive the reconciliation reports from each county auditor ((and)). The secretary of state must prepare a statewide reconciliation report for each state primary and general election, which must be thoroughly reviewed and reconciled using the county auditor reports for final approval by the state auditor and, for a general election, the state election audit board. The report may be produced in a form determined by the ((secretary))state auditor that includes the information as described in this subsection (3). The report must be prepared and published on the secretary of state's and the state auditor's website ((within two months after the last county's election results have been certified))immediately upon completion.

(b) The state report must include a comparison among counties on rates of votes received, counted, and rejected, including provisional, write-in, overseas ballots, and ballots transmitted electronically. The comparison information may be in the form of rankings, percentages, or other relevant quantifiable data that can be used to measure performance and trends.

(c) The state report must also include an analysis of the data that can be used to develop a better understanding of election administration and policy. The analysis must combine data, as available, over multiple years to provide broader comparisons and trends regarding voter registration and turnout and ballot counting. The analysis must incorporate national election statistics to the extent such information is available.

Sec. 43. RCW 29A.08.775 and 2011 c 10 s 19 are each amended to read as follows:

Only voters who appear on the official ((statewide))county voter registration list are eligible to participate in elections. ((Each county))The secretary of state shall maintain a copy of ((that))each county's ((portion of the state list))official voter registration list. The ((county))secretary of state and state auditor must ensure that voter registration data used for the production, issuance, and processing of ballots in the administration of each election are the same as the official ((statewide))county voter registration list.

Sec. 44. RCW 43.09.050 and 1992 c 118 s 6 are each amended to read as follows:

The auditor shall:

(1) Except as otherwise specifically provided by law, audit the accounts of all collectors of the revenue and other holders of public money required by law to pay the same into the treasury;

(2) In his or her discretion, inspect the books of any person charged with the receipt, safekeeping, and disbursement of public moneys;

(3) Investigate improper governmental activity under chapter 42.40 RCW;

(4) Inform the attorney general in writing of the necessity for the attorney general to direct prosecutions in the name of the state for all official delinquencies in relation to the assessment, collection, and payment of the revenue, against all persons who, by any means, become possessed of public money or property, and fail to pay over or deliver the same, and against all debtors of the state;

(5) Give information in writing to the legislature, whenever required, upon any subject relating to the financial affairs of the state, or touching any duties of his or her office;

(6) Report to the director of financial management in writing the names of all persons who have received any moneys belonging to the state, and have not accounted therefor;

(7) Authenticate with his or her official seal papers issued from his or her office;

(8) Make his or her official report annually on or before the 31st of December; and

(9) Perform duties required under chapter . . ., Laws of 2022 (this act).

(1) 2021 c 26 s 2 (uncodified) (making exemptions apply to records requests already made but for which disclosure has not yet occurred); and

(2) 2021 c 26 s 3 (uncodified) (emergency clause).

--- END ---