Sole Source Hearing Recommendation - 24-587BOE-ADMIN-B-41183_ (002).pdf

TO: Ellen H. Daley, Chief Procurement Officer for General Services

FROM: Ellen C. Morris, Sole Source Hearing Officer

DATE: March 19, 2024

SUBJECT: February 7, 2024, Sole Source Hearing Officer Determination

On February 7, 2024, I presided as hearing officer over a hearing to consider comments regarding the following agency determination to contract on a sole source basis:

Agency: State Board of Elections (“BOE”)

Vendor: Democracy Live

Brief Description: A turn-key Military and Overseas Voter Empowerment (MOVE) Act compliant Electronic Ballot Delivery System for military and overseas voters and voters with disabilities. Democracy Live will work with the State to provide the Full Service Pre-

Loaded Omni-Ballot portal to each of the 108 election authorities and provide an On-

Demand Ballot Request Portal in secure manner to ensure consistent and reliable service to Illinois voters and Illinois election authorities

Procurement Bulletin Reference: 24-587BOE-ADMIN-B-41183 (I note that Sole Source

Justification Form incorrectly references procurement # 24-587BOE-ADMIN-R-194389)

Factual Background:

BOE has had contracts for the OmniBallot Balloting Portal Accessible Balloting Portal (just covering accessible voters) since 2022 with Democracy Live. The initial contract resulted from an emergency procurement from April 15, 2022 through July 13, 2022. The second contract resulted from another emergency procurement from August 30, 2022 through November 27, 2022. The third contract resulted from a small purchase procurement from February 27, 2022 through May 27, 2023. The contract subject to the instant sole source hearing is estimated to begin January 15, 2024, and end December 31, 2026.

The BOE published sole source justification forms (“SSJFs”) on January 19, 2024. BOE’s SSJFs outline that

10 ILCS 5/19-2.6 requires the BOE to provide a certified accessible vote by mail system through which a vote by mail ballot can be delivered by electronic transmission to voters with print disabilities and through which voters with print disabilities are able to mark and verify their ballots using assistive technology.

Additionally, the BOE’s SSJFs outline that 52 USC 20302 and 10 ILCS 5/20-2.1 and 20-2.3 require certain military and overseas voters be afforded the option to receive their ballots electronically. In the SSJFs, the

BOE wrote that Democracy Live is the sole source for this mail ballot system in summary because:

• Democracy Live’s OmniBallot portal is the only FedRamp compliant and NIST cybersecurity certified vendor in the marketplace;

• Democracy Live has the experience of deploying and supporting secure, accessible remote balloting solutions, and is regarded as the most secure vendor;

• Only Democracy Live meets the security requirements necessary with ensuring voter information is secure and vote integrity is maintained; and

• Democracy Live offers the most secure platform.

Summary of Hearing:

Aaron Wilson, President of Enhanced Voting, requested the hearing.

The hearing was held via Webex on February 7, 2024. The notice of intent to contract on a sole source basis as well as the justification form for this procurement were incorporated into the record.

BOE’s Jeremy Kirk primarily testified on behalf of the BOE. Mr. Kirk testified in summary that:

• The BOE’s objective is to fulfill statutory requirements related to electronic ballot transmission in the most secure manner possible;

• Democracy Live is widely considered the most secure vendor based on a direct comparison with two vendors during a previous solicitation from April 2022. Democracy Live is deployed statewide in mores states than Enhanced Voting;

• Determination to proceed with a sole source procurement with Democracy Live is based primarily on the vendor security comparison analysis done by the agency and that Democracy Live security infrastructure will best maintain the security of electronic ballot transmission for Illinois voters;

• During the March 2022 BOE solicited bid, the Chief Information Security Officer reviewed security documentation from Democracy Live and Enhanced Voting upon receipt of their bids. Democracy

Live provided detailed security information, including SOC II Type 2 certification requirements.

The Chief Information Security Officer reviewed the SOC II Type 2 report provided by Democracy

Live and found them to be outstanding. The Chief Information Security Officer did not receive a

SOC II Type 2 report from Enhanced Voting, which is a requirement as part of BOE’s internal policies. The BOE moved forward with emergency procurement for the 2022 election;

• The BOE filed for a Federal Grant in 2023, which is the funding source for this procurement. The

BOE was not prohibited from including a vendor in grant application. The BOE received the grant award;

• Enhanced Voting has SOC 1 certification, but the BOE requires a SOC II Type 2 report for all solicitations. Not having it would be a disqualifier today;

• Chief Procurement Officer (“CPO”) Ellen Daley asked the BOE about the SSJFs stating that

“Democracy Live’s OmniBallot portal is the only FedRamp compliant and NIST cybersecurity certified vendor in the marketplace,” and whether that statement was accurate. The BOE responded that it should have stated NIST compliant and not NIST certified and that the SSJFs statement was erroneous. Additionally, the BOE responded that FedRamp compliant should have been that the infrastructure is FedRamp compliant;

• CPO Daley asked the BOE if the first sentence in Box 3 of SSJFs was true and the BOE responded that their statement was not well articulated and not factual, and should have said infrastructure is FedRamp approved;

• CPO Daley asked if the BOE stands by the statement made in SSJFs Box 5 and 5a, that no other vendors were considered and that no other vendor meets security requirements necessary with ensuring voter information is secure and vote integrity is maintained, and the BOE stated that they do stand by those statements.

Felicia Erlich, the Chief Operating Officer of Democracy Live, testified in summary that Democracy Live is the largest provider of electronic balloting in the United States, that they have been around since 2008, and are across thirty-four states. Ms. Erlich stated that this is their third presidential election, that they are in 2,500 jurisdictions over the United States, and that they are SOC II Type 1 and 2 approved. Ms. Erlich stated Democracy Live can turn on and implement the system in less than 24 hours’ notice.

Aaron Wilson, President of Enhanced Voting ,testified on behalf of Enhanced Voting. Mr. Wilson testified in summary that:

• The BOE did an analysis in 2022 and made conclusions then about Democracy Live and Enhanced

Voting, but the BOE did not discuss it with them;

• The BOE cancelled that procurement and proceeded with an emergency procurement;

• It does not appear Enhanced Voting was given the same opportunity to present their information as Democracy Live. In last two years Enhanced Voting has made big changes. They are in nineteen states, fourteen of which are statewide deals. The BOE’s information is out of date and the BOE did not get updates to do an accurate comparison of the two vendors. Democracy Live has done business in thirty-four states, but are not actively in thirty-four states;

• Enhanced Voting does bottom-up ballot data now, which is something that is not unique to

Democracy Live. Enhanced Voting currently do this in several states;

• NIST-certified/approved is not an actual distinguishment. NIST has guidelines and best practices.

Third parties might evaluate a company against those best practices, which is a standard penetration test. All Enhanced Voting’s penetration testing incorporates NIST cybersecurity because that is the industry standard. There is nothing unique about that claim. Enhanced Voting is SOC II Type 1 certified and is in middle of Type 2 certification;

• Enhanced Voting has not been given an opportunity here because of the sole source;

• The BOE made decision to apply for a federal grant specifically naming Democracy Live in it, which the BOE was not required to do. Many states did not name a vendor in their grant submissions;

• Democracy Live is not FedRamp certified, rather their supplies are but Democracy Live is not;

• What services the BOE is seeking is what Enhanced Voting does with their customers every day.

Enhanced Voting meets the requirements, and this procurement should not be a sole source;

• SOC 2 Type II requirements were not mentioned in this sole source or back in 2022. This is the first Enhanced Voting is hearing of it; and

• Enhanced Voting’s infrastructure is FedRamp certified and they are NIST compliant. Enhanced

Voting asks that they be allowed to compete in 2024.

After the hearing, on February 12, 2024, Enhanced Voting reached out to the Hearing Officer to advise they submitted a Freedom of Information Act (“FOIA”) request to the BOE. Additionally, Enhanced Voting stated that during the hearing was the first time they heard a claim relating to the BOE’s review of a SOC

2 Type II audit report covering Democracy Live during the BOE’s comparison of product security in 2022, and despite working with many states, Enhanced Voting has never before heard that Democracy Live is

SOC 2 Type II certified. Enhanced Voting indicated that the FOIA responsive documents found that

Democracy Live instead stated that they did not have a SOC 2 Type II report.

On February 14, 2024, the Hearing Officer shared Enhanced Voting’s communication with the BOE and inquired of the BOE whether the sole source procurement required that the vendor have SOC 2 Type II certification, and if so, where that requirement could be found. The Hearing Officer also inquired of the

BOE whether Democracy Live has SOC 2 Type II certification and if so, when the certification was secured.

On February 16, 2024, the BOE responded to the Hearing Officer’s inquiry and stated that a SOC 2 Type II report is required for this procurement because the BOE aligns with the Center for Internet Security (CIS)

Controls Framework and because the BOE has internal policies, procedures, and controls related to the requirements. The BOE stated that Democracy Live has a SOC 2 Type II report covering the period of April

1, 2023 through June 30, 2023. On February 20, 2024, the Hearing Officer shared this information with

Enhanced Voting.

On February 29, 2024, the BOE informed the Hearing Officer of a misstatement made by the BOE during the hearing and sought to retract that statement. At the hearing, the BOE stated that Democracy Live submitted and the BOE reviewed a SOC 2 Type II report during the prior 2022 solicitation, but clarified in that the BOE did not receive or review a SOC 2 Type II report for the Democracy Live OmniBallot system during the 2022 solicitation. On March 1, 2024, the Hearing Officer shared this information with Enhanced

Voting.

Applicable Statutes and Rules

Sole-source procurements must be scrutinized because they tend to contravene the core purpose of the

Illinois Procurement Code (“Code”), namely, “that the principles of competitive bidding and economical procurement practices shall be applicable to all purchases and contracts by or for any State agency.” 30

ILCS 500/1-5. The Code requires heightened transparency for sole source awards because they lack competition and can be abused relatively easily. See, generally, 30 ILCS 500/20-25.

The Code states that “contracts may be awarded without use of the specified method of source selection when there is only one economically feasible source for the item.” 30 ILCS 500/20-25(a). Additionally, the

Code states that a “contract may be awarded as a sole source contract unless an interested party submits a written request for a public hearing at which the chief procurement officer and purchasing agency present written justification for the procurement method.” Id. Additionally, the Code states that “[a] sole source contract where a hearing was requested by an interested party may be awarded after the hearing is conducted with the approval of the chief procurement officer. Id.

Whether a sole source procurement be made is determined by the State Purchasing Officer, based on the request made by a State agency via a written form. 44 ILL. ADMIN. CODE 1.2025(c). Additionally, the SSJFs must be included in the Procurement Bulletin (BidBuy). 30 ILCS 500/20-25(c).

The Illinois Administrative Code further outlines the following:

A sole source procurement is permissible when a requirement is available from only a single supplier. A sole economically feasible source is permissible when only one supplier is deemed economically feasible. A requirement for a particular proprietary item does not justify a sole source procurement if there is more than one vendor is authorized to provide that item.

44 ILL. ADMIN. CODE 1.2025(b).

Section 1.2025(c) provides that “[p]rior to authorizing the State agency to enter into a contract based on the sole source or sole economically feasible source request, the CPO-GS shall offer a public hearing to be held and make a final determination as required by Section 20-25(a) of the Code.” 44 ILL. ADMIN. CODE

1.2025(c).

Analysis and Recommendation

The issue here is whether any vendor other than Democracy Live can provide the necessary services to meet the BOE’s needs with regards to providing an electronic ballot delivery system for military and overseas voters and voters with disabilities. In this case, another vendor can provide these services.

The BOE needs a vendor to provide a platform through which voters with print disabilities and military and overseas voters can receive their ballots electronically.

In the SSJFs, the BOE states that it was awarded the U.S. Department of Defense’s Election Absentee

Systems for Election (EASE) grant (“the Grant”). The BOE further states that it was awarded the Grant “for the sole purpose of procuring a MOVE Act compliance electronic ballot delivery system from Democracy

Live.” However, it appears that BOE made a decision to list Democracy Live as a vendor in their Federal

Grant, thereby limiting the vendor pool upon receiving the award. During the hearing, Enhanced Voting noted that the Grant does not require the agency to list a specific vendor and that other states have not listed a specific vendor.

As stated above, whether a sole source procurement be made is determined by the State Purchasing

Officer, based on the request made by a State agency via a written form. 44 ILL. ADMIN. CODE 1.2025(c).

Additionally, the SSJFs must be included in the Procurement Bulletin (BidBuy). 30 ILCS 500/20-25(c). The

SSJFs completed by the agencies are crucial; the Chief Procurement Office for General Services relies on the SSJFs when reviewing a matter for a sole source procurement. In this case, some of the BOE’s statements made on the SSJFs were erroneous.

The SSJFs indicate that Democracy Live is the only vendor that is FedRamp compliant and certified, but as established by the BOE’s testimony, the statement is inaccurate. At the hearing, the BOE clarified that it should have stated NIST compliant and not NIST certified and that the SSJFs statement was erroneous.

Additionally, the BOE stated that FedRamp compliant should have been that the infrastructure is FedRamp compliant/approved.

It also appears that the BOE procured Democracy Live three times in 2022 without a SOC 2 Type II audit and it has only come to light as a requirement now. Notably, a SOC 2 Type II report requirement is not referenced anywhere in the SSJFs, but at the hearing and in the subsequent communications, the BOE states a SOC 2 Type II audit report is a requirement for the vendor.

Not only are the SSJFs relied on by the Chief Procurement Office for General Services to determine if a sole source procurement is appropriate, but they are also signed, made available to the public, and are relied on by the public to determine if a business could perform the work sought in the sole source procurement. Additionally, Enhanced Voting indicates they can meet the procurement requirements, indicating Democracy Live is not the sole vendor to provide the BOE these services.

The BOE does not appear to have adequately investigated alternative vendors. It appears that the BOE did not attempt to write an Invitation for Bids, Request for Proposal, or a Request for Information to learn more about the potential vendor pool. The BOE argues that Democracy Live is the most secure vendor for the sought-after services, however, the BOE has not evaluated Enhanced Voting for this sole source procurement. It appears that the BOE used data from a 2022 procurement to compare Democracy Live and Enhanced Voting in order justify this sole source procurement to Democracy Live. That means that

Enhanced Voting and other potential vendors did not have an opportunity to provide their current information, including security data, to be evaluated.

In this case, Enhanced Voting testified it can perform the services outlined by the BOE in the SSJFs. As a result, the BOE’s requirements do not appear to be available from only a single vendor, and there is insufficient evidence to establish that only Democracy Live can fulfill the BOE’s requirements. Therefore, based on the foregoing, I find the justification for this sole source to be insufficient, and I recommend the procurement not be approved.