Press Releases

Deficiencies with security parameters and account maintenance in the information systems

The Office of the Comptroller of Puerto Rico issued a qualified opinion on the fiscal operations of the Office of Information Systems and Electronic Processing of the State Elections Commission. A qualified opinion is issued when the instances of noncompliance, individually or in the aggregate, are significant but not pervasive.

The Report reveals that as of March 8, 2023, password policies had not been defined nor had control policies been established to limit the maximum number of failed access attempts before deactivation. In addition, 20% of the active user accounts examined were configured so that their passwords would not expire.

A similar situation had been commented on in Audit Report TI-13-14 of 2013. These deficiencies with the security parameters of passwords increase the risk that they can be cracked and used by unauthorized persons.

The three-finding audit notes that as of March 27, 2023, the accounts of 27 former employees who had ceased their functions between 2020 and 2023 had not been deactivated on the main server. In addition, from the analysis of 664 active accounts, 32 were identified that were never used and 129 that had not been used, with between two months and more than three years having elapsed since the last access. On the other hand, in the Advanced Civil ID system, the accounts of 17 former employees had not been deactivated, with up to more than two years having elapsed since they ceased functions.

These situations prevent the Commission from maintaining effective and efficient control over access accounts and assigned privileges, among other things.

The auditors found multiple deficiencies with the communication-network access request forms. For example, in seven of 20 network access accounts, the request form was not found, and six accounts did not include all required information. In addition, in 16 of the 25 access accounts to the Advanced Civil ID system, the request form was not found, and seven forms did not include all required information.

The audit recommends that the alternate president of the State Elections Commission effectively supervise, and ensure that the director and deputy director of the Office of Systems comply with the recommendations of the Report.

The budget allocated to the State Elections Commission comes from joint resolutions of the General Fund and from federal funds. The approved budget from 2021 to 2023 was $37,860,000, $24,506,000, and $31,567,000 respectively. The Office of Systems had no budget allocated during these fiscal years.

This report of the Office of Information Systems and Electronic Processing of the State Elections Commission covers the period from October 6, 2022 to May 31, 2023, and is available at  www.ocpr.gov.pr.