FISCAL NOTE

Date Requested: February 13, 2020
Time Requested: 12:28 PM
Agency: Technology, WV Office of
CBD Number: Version: Bill Number: Resolution Number:
3170 Introduced HB4846
CBD Subject: Elections


FUND(S):

2220

Sources of Revenue:

Special Fund

Legislation creates:





Fiscal Note Summary


Effect this measure will have on costs and revenues of state government.


The definitions of “online election system” and “penetration test” are too vague to provide a precise cost estimate. The Cybersecurity Office has no visibility or authority into the Secretary of State’s current network to appropriately scope out a penetration test. There are multiple pieces in an election system including but not limited to, internal Secretary of State databases, vendor-owned applications, citizen end-user interfaces, and 3rd party auditing systems. Each of those areas could have a different type of penetration test performed either internally or externally. There is not enough information for the Office of Technology to determine the total fiscal impact.



Fiscal Note Detail


Effect of Proposal Fiscal Year
2020
Increase/Decrease
(use"-")
2021
Increase/Decrease
(use"-")
Fiscal Year
(Upon Full
Implementation)
1. Estmated Total Cost 0 300,000 300,000
Personal Services 0 0 0
Current Expenses 0 300,000 300,000
Repairs and Alterations 0 0 0
Assets 0 0 0
Other 0 0 0
2. Estimated Total Revenues 0 0 0


Explanation of above estimates (including long-range effect):


The above is the estimated cost to perform penetration testing with a quick turnaround.



Memorandum


The one-month time constraint will substantially raise the cost of a penetration test. It would not be feasible to perform penetration testing one month before an election and fix any noted deficiencies by the election. It can take 1-2 weeks to perform some penetration tests. Depending on who owns which parts of the system, there could be legal issues to overcome. There needs to be a contract review to see if the State can run these tests on an already established contract. All parties would need to agree on the scope of a penetration test to avoid violating federal laws.



    Person submitting Fiscal Note: Justin T McAllister
    Email Address: Justin.t.mcallister@wv.gov