March 2023

OFFICE OF THE ILLINOIS

SECRETARY OF STATE

ALEXI GIANNOULIAS • SECRETARY OF STATE

Technology Modernization: Full Report

Draft, Confidential, and Pre-decisional

1
Technology Modernization: Full Report
– Table of Contents

Table of Contents
1 Letter from the Secretary ................................................... Error! Bookmark not defined.

2 Executive Summary .......................................................................................................... 5

3 Facts around IL SOS and its criticality to residents .................................................... 10

3.1 Summary of SOS services and transaction volumes ............................................................. 11
3.2 How IL SOS services drive trust in government ..................................................................... 13

4 Why the time to modernize is now .............................................................................. 14

4.1 Growing risk of cybersecurity attacks ......................................................................................... 14
4.2 Growing risk of non-compliance with mandates ................................................................... 15
4.3 Loss of institutional knowledge .................................................................................................... 16
4.4 Increasing cost of maintaining status quo ............................................................................... 18
4.5 Inability to keep pace with other States and digital service standards ......................... 18

5 Assessment of technology-enabled resident and employee experience................. 23

5.1 Pain point 1: Inaccessible Information ....................................................................................... 25
5.2 Pain point 2: Inconvenient Experiences ..................................................................................... 27
5.3 Pain point 3: Unintuitive Systems leading to errors ............................................................. 29
5.4 Pain point 5: Training challenges due to complex and legacy technology ................. 31
5.5 Pain point 6: Low morale ................................................................................................................. 32

6 Assessment of current technology ............................................................................... 35

6.1 The state of IL SOS’s technology today ..................................................................................... 35
6.2 Comparing IL SOS technology capabilities to other organizations ................................ 37
6.3 Challenges with IL SOS technology............................................................................................. 38
6.3.1 Challenge 1: Data protection and cyber security .................................................... 38
6.3.2 Challenge 2: Complex architecture built around outdated systems ................ 40
6.3.3 Challenge 3: Talent .............................................................................................................. 41
6.4 Opportunity areas .............................................................................................................................. 42

7 What might a modernization program look like........................................................ 44

7.1 Key modernization workstreams .................................................................................................. 44
7.1.1 Workstream 1: Cybersecurity........................................................................................... 45
7.1.2 Workstream 2: Technology Systems and Infrastructure ....................................... 45

2
Technology Modernization: Full Report
– Table of Contents

7.1.3 Workstream 3: Data ............................................................................................................ 45

7.1.4 Workstream 4: Resident and Employee Experience ............................................... 46
7.1.5 Workstream 5: Transformation Program Management ........................................ 46
7.2 Potential phasing of the program ............................................................................................... 47
7.3 Modernization outcomes ................................................................................................................ 49

8 Closing statement .......................................................................................................... 51

9 Methodology for report ................................................................................................ 52

3
Technology Modernization: Full Report
– Executive Summary

Illinois Secretary of State Technology Modernization

March, 2023 Page 4
Technology Modernization: Full Report
– Executive Summary

1 Executive Summary
The Office of the Secretary of State (SOS) in Illinois is visited by more Illinois residents
than any other in state government, delivering vital services to residents that affect their
day-to-day lives. The Illinois SOS delivers over 100 different services to the State, such as
vehicle services, driver services and business services, among several others. It brings in more
than $3 Billion in revenue each year. These funds help maintain Illinois’s roadways, among
many other contributions. The SOS office processes over 30 Million transactions per year for
residents and maintains over 2 Billion records as the State’s identity-keeper.1

Within days after winning election in November 2022, Secretary of State-Elect Alexi
Giannoulias’ administration team launched the transition committee, working with 125
stakeholders across Illinois and the public to create a roadmap on how to streamline
operations, deliver services more effectively and improve the customer experience for
Illinoisans. The transition sought feedback, suggestions and ideas on what the public wanted.
The core of this effort was modernization and determining how to eliminate the Time Tax, or
the amount of time Illinois residents spend waiting in lines or filling out forms just to receive
basic and required services from the SOS.

After taking office on January 9th, the Secretary of State conducted an outside assessment of
its technological capabilities that touch all 25 departments within the SOS office. The findings
discussed in this report paint a troubling picture of precarious technology systems that
run the high-risk of breakdowns, data breaches and cyberattacks and require immediate
need. This must be addressed prior to implementing any modernization tools such as
digital driver’s license, an SOS mobile app, digital license plates, to name a few.

The SOS’ antiquated mainframe system runs on outdated 1980s COBOL code, which is a
complex and unsecure patchwork of more than 140 applications that have been built to suit
the short-term needs of the agency’s 25 separate departments that have no ability to
communicate with each other.

With the SOS sensitive and personally identifiable information and records for the nearly 13
million Illinois residents (including SSNs, home addresses, driver’s license data, etc.) the
obsolete technology poses a dangerous and imminent risk of cyber and data privacy attacks.

In addition, the SOS has experienced delays in implementing mandated services and it faces
new demands like Real ID. Meanwhile, the SOS also faces severe challenges in finding
individuals who understand the antiquated system and code base as other states have set new
standards for modernizing their offices, especially DMVs.

1
Interviews with IL SOS Department employees, February – March 2023

Illinois Secretary of State Technology Modernization

March, 2023 Page 5
Technology Modernization: Full Report
– Executive Summary

After years of neglect, ignoring the inevitable and failing to act, the costs and risks of
keeping the status quo exponentially increase over time.

The latest rapid assessment of IL SOS’ technology landscape indicates a clear and urgent
need for IL SOS to modernize its technology and associated processes.

There are 5 key reasons underpinning this statement:

1. Risk of catastrophic operational disruption across SOS’ 138 facilities, data theft,
and potential harm to residents - in the event of a cyber-attack, data breach (whether
intentional or unintentional), or outages due to legacy technology

As a primary record keeper for the State, IL SOS holds over 2 billion records including
data like residents’ SSNs, names, addresses, driver’s license numbers, vehicle
registration etc. Moreover, IL SOS shares data with 1400+ public and private sector
entities.

Legacy and complex technology architecture, weak info-sec policies, and growing risk
of cyber-attacks such as ransomware can cause major system outages and large-
scale operational disruption. Such outages could impact business continuity for IL
SOS, affecting critical services (e.g., providing organ donor information to recipients,
allowing Illinois’s law enforcement to identify unsafe drivers and take them off the road)
and potentially putting residents at risk.

With cyberattacks and data theft becoming increasingly prevalent and sophisticated,
state organizations must strengthen their defenses to stay one step ahead of bad
actors. Recent cyber breaches2 and ransomware attacks highlight the criticality to
modernize this area. IL SOS needs to strengthen controls and policies in order to better
safeguard systems, to share data responsibly and safely without compromising critical
information; and pre-emptively shore up defenses against such attacks.

2. ILSOS is at risk for not meeting critical mandates (e.g., Real ID) or agency
aspirations (e.g., digital IDs, skip the line program)

IL SOS’s technology landscape is so complex and difficult to update that, in some cases,
it has taken as long as years to deliver mandated services like e-Titling or Real ID. For

2
“California DMV hit by data breach, exposing millions of drivers' personal information to hackers”,
https://www.sfgate.com/bayarea/article/California-DMV-hit-data-breach-ransomware-attack-
15959944.php; “Software vendor says data breach exposed nearly 28 million Texas driver’s license
records”, https://thehill.com/policy/cybersecurity/525923-data-breach-of-software-vendor-exposes-
almost-28-million-texas-drivers/; “DPS sent at least 3,000 driver’s licenses to organized crime group
targeting Asian Texans”, https://www.texastribune.org/2023/02/27/texas-drivers-license-theft-dps/

Illinois Secretary of State Technology Modernization

March, 2023 Page 6
Technology Modernization: Full Report
– Executive Summary

example, even an update like waiving fees for certain residents can take months due to
the complexity of the code, and number of disparate applications in legacy COBOL
language.

The implication is that residents go without the services their government should be
providing to them. With a Real ID deadline just 2 years away (May 2025), the ability to
quickly update systems is vital. Technology modernization programs typically take
several years, and IL SOS needs to start on its journey now in order to deliver against
agency targets.

3. Operational risk due to tech talent shortage to support the legacy technology

IL SOS’s systems are written in COBOL, a 60+ year-old coding language that was already
starting to be phased out in the 1980’s.

At this point, many of the staff members proficient in COBOL and IL SOS’ systems are
coming up on retirement and the required talent replacement could be a challenge.
This was recently observed in the State of New Jersey where the Governor had to make
an emergency call for volunteer COBOL programmers to help the state cope with
COVID-related system changes.3 Talent departures and gaps can similarly seriously
hamper the IL SOS’ ability to deliver services. Moreover, as tenured resources leave,
their knowledge of the SOS-specific code base leaves with them, meaning few are left
who can maintain the system or implement updates.

4. Delay in modernizing tends to increase the costs and risks over time

As budget analysis indicates, there has been a 10% year-over-year increase in costs
over the last 5 years just to maintain the current systems (to the minimum extent).4
Typically, the effort to make updates and keep up with mandates will become greater
and greater, as the systems continue to get more complex over time while residents’
expectation continue to rise. This “technical debt” builds up in the system and will
come due- often suddenly and unexpectedly. Moreover, users suffer due to the
inability to get new capabilities and features quickly, and the lack of resiliency increases
the risk of operational disruptions over time.

5. Resident and employee experience today is cumbersome and imposes a

significant “time tax”; while other States are leapfrogging ahead

3
“New Jersey seeks COBOL programmers to fox unemployment system”, April 6, 2023,
https://www.cnbc.com/2020/04/06/new-jersey-seeks-cobol-programmers-to-fix-unemployment-
system.html
4
IL SOS Budget and spend analysis, FY09 – FY23

Illinois Secretary of State Technology Modernization

March, 2023 Page 7
Technology Modernization: Full Report
– Executive Summary

State agencies everywhere face higher-than-ever expectations from residents who

want user-friendly and frictionless ways to interact with the government and
receive required services. The volume and significance IL SOS services likely means
that IL SOS is seen by many as a key driver of resident experience and perception of
state government. However, research shows that over 2/3rd of IL residents are
dissatisfied with current state of IL SOS services, and expect faster, easier to
navigate and more consistent experiences.5 Customers and employees are frustrated
with the lack of digital capability.

"[Going to the DMV] is like going to McDonald's and having to wait in many
different lines to get my sandwich, my sides, and my drink." - Resident

Website services are confusing to the average resident. Other channels also suffer due
to lack of digital enablement: 25% of the calls to the IL SOS contact centers were
abandoned by people after waiting for too long.6 Residents frequently cited the long
wait times and different standards of service across driver services facilities, leading to
a significant “time tax”, especially on seniors, non-English Language Speakers, and
accessibility-challenged population.7

Internally within SOS, employees struggle to learn complicated systems that require
cumbersome numeric codes to operate, and without timely training, they are left to
learn ‘on-the-job’ for 6, even 12, months. Non-intuitive technology drives up error
rates, meaning more residents have to come back to facilities to correct errors.
Paper-based systems make it hard for employees to keep track of their time, leading to
cancelled vacations, and low morale. All in all, outdated systems could leave employees
feeling “undervalued” and potential overworked.

While IL SOS faces these challenges and risks, some state DMVs are moving ahead,
raising the standards for digital experiences. They are providing residents features
like virtual facilities which residents can access on their own schedule, resident accounts

5
State-of-the-States survey, 2022, McKinsey & Company,
https://www.mckinsey.com/industries/public-and-social-sector/our-insights/governments-can-
deliver-exceptional-customer-experiences-heres-how
6
IL SOS contact center call records, February 2023
7
Office of the Illinois Secretary of State, “Transition Report”, Jan 2023

Illinois Secretary of State Technology Modernization

March, 2023 Page 8
Technology Modernization: Full Report
– Executive Summary

to pre-verify documents and track applications, self-service 24-hr kiosks, and some are
starting to even offer mobile IDs. 8

To summarize, SOS currently faces a very pressing challenge: its outdated technology is
creating historic and unprecedented risks for residents, their private data, and their access
to critical IL SOS services.

SOS could consider setting up a comprehensive transformation or modernization program that

is launched quickly and executed at a strong pace, focusing on some of the highest risk and
impact areas, and coordinating these actions (along with other operational initiatives). A
program of this scale and magnitude will cost approximately $200 million.

Executed effectively, such a program could ensure these changes are not only delivered on
time, but embraced and adopted by the full organization, through communication, training,
and change management. The program could:

1. Strengthen IL SOS’s cybersecurity defenses, in line with CISA recommendations and

standards required by the current times given the sophistication of threats

2. Migrate systems away from outdated code and 1980’s technology, allowing IL SOS
to deliver services in a timely way, scale its services to prepare for Real ID, among other
initiatives, and bring in the talent necessary for the future

3. Consolidate IL SOS’s data onto a modern, scalable platform, enabling IL SOS to

maintain the most up-to-date view of residents (e.g., when they change their name),
better protecting its data, and identify better ways to serve residents (e.g., bringing
mobile facility units to communities with low ID rates)

4. Improve resident and employee experience by addressing their most critical pain
points. This could include expanding appointments to reduce wait time in facilities,
offering more services online, quickly answering questions with tools like chatbots, and
for employees, replacing paper-based systems with digital tools like eTime, etc.

Such a program would be a much needed and exciting step forward in SOS’ journey to its bold
aspiration and mission.

8
California Department of Motor Vehicles Digital Experience Platform project proposal and related
documents, https://projecttracking.technology.ca.gov/Details?id=c5586466-ce45-4fa6-8fc2-
ae46f899960e, https://esd.dof.ca.gov/Documents/bcp/2122/FY2122_ORG2740_BCP4772.pdf;
Arizona Department of Transportation https://azdot.gov/motor-vehicles/driver-services/mobile-id

Illinois Secretary of State Technology Modernization

March, 2023 Page 9
Technology Modernization: Full Report
– Facts around IL SOS and its criticality to residents

2 Facts around IL SOS and its criticality to residents

Key points:
● IL SOS’s services keep residents safe, protected, able to business, give them access to
important medical resources, and help keep them informed about government
activities, both past and present

● IL SOS is the ‘face of the state’ for millions of residents, so their experience with its
services shape their perception of the state government overall

● IL SOS contributes over $3Bn in fees to the State each year, much of which helps
maintain the State's roadways and construction

● IL SOS provides over 100 different services to residents, from Drivers & Vehicle services
to State Library services, across 25 departments

● The Office processes over 30M transactions per year for residents, across a mixture of
in-person, phone, mail-in, and online services

● IL SOS acts as the official record keeper for the state, with over 2Bn records under its
management

● IL SOS also serves as the primary identity provider for Illinois residents

IL SOS is more than an administrative body. The services it delivers – ranging from issuing
Drivers Licenses, to registering businesses, to protecting the State Capitol – have a direct
impact on the lives and livelihoods of Illinoisans.

For example, IL SOS:

● Keeps residents safe on the roads by

managing the issuance of drivers’
licenses, and removing licenses from
unsafe drivers, both personal and
commercial. In addition, IL SOS
collaborates with countless state and
local law enforcement agencies to ensure
only safe drivers are allowed on the
roads.
Figure 1: IL SOS fact sheet
● Keeps residents protected by providing
Secretary of State police services to
protect the State’s capitol.

Illinois Secretary of State Technology Modernization

March, 2023 Page 10
Technology Modernization: Full Report
– Facts around IL SOS and its criticality to residents

● Provides transparency for State government activities, by registering lobbyists and

ensuring all lobbyist spending is publicly available. In addition, IL SOS serves as the archivist
for the State, ensuring a historic record of State activities is available to all.
● Supports Illinois economy and Illinoisans’ livelihoods, by providing business
incorporation services, critical data, and annual reporting

● Enables life-changing resources by managing the State’s Organ Donor Registry

In addition, IL SOS acts as the source of truth for residents’ identity. Countless law
enforcement agencies, courts, and commercial entities (like insurance companies) rely on IL
SOS to verify that residents are who they say they are.

IL SOS collects around $3Bn in fees for the State each year. More than 97% of that revenue
comes from Vehicle, Drivers, and Business services departments. Vehicle services alone drives
82% of SOS’ revenue, and just one service within vehicle services (i.e., Motor Vehicle licenses)
contributes nearly half of the revenue.9

Much of this revenue is used to support Illinois’ roadways, ensuring safe and secure
passage around the state for drivers, businesses, goods and services.

2.1 Summary of SOS services and transaction

volumes
SOS delivers over 100 different services to residents – from issuing Drivers’ licenses to Library
services, to Registering lobbyists, and manages 138 Driver and Vehicle services facilities across
the state.10 The Office conducts over 30M transactions each year on behalf of residents.11 In
addition, the SOS maintains over 2 billion records – from resident ID numbers to vehicle
registrations, to historic bills for archives.12

9
IL SOS Revenue data, FY2022 Actuals
10
As of March 2023
11
Interviews with IL SOS employees, Feb-Mar 2023
12
IL SOS IT Department interviews, February – March 2023

Illinois Secretary of State Technology Modernization

March, 2023 Page 11
Technology Modernization: Full Report
– Facts around IL SOS and its criticality to residents

Figure 2: IL SOS departments

IL SOS provides over 100 different services for residents. The table below provides examples:

Approximate
Department transactions/year Select examples
Vehicle 17 million Registration & registration renewals, Titling, Title transfer,
Services Address change, Disability parking placards
Driver 12 million Drivers license, License renewal, Real ID, Commercial Drivers
Services License (CDL), CDL transfer, Duplicate license, Driving record
abstract
Business 2 million Articles of incorporation, Articles of organization, Annual
services report filing, Certificate of good standard, UCC filing,
Trademark filing
Index <0.5 million Notary public commissioning, Lobbyist registration, Foreign
Department document certification, Statement of economic interest
filing
21 other ~0.5 million Organ Donor registration, Court claim filing, Library services,
departments Archive services

Illinois Secretary of State Technology Modernization

March, 2023 Page 12
Technology Modernization: Full Report
– Facts around IL SOS and its criticality to residents

2.2 How IL SOS services drive trust in government

IL SOS is the ‘face of State Government’ for many
residents, and their experience using IL SOS services sets the
Research shows that
tone for how they perceive government services overall.
resident experience directly
impacts public trust. DMVs
A national survey13 of satisfaction levels among residents
are often the “Face of State
Government” for residents. with US State services in 2022 shows that Vehicles Services
is one of the five most important services to the
A 1% decrease in resident
satisfaction decreases public residents and one of the most-used services.
trust by 1.3%.
The same survey highlighted the relationship between
resident satisfaction and trust in the government: a 1%
decrease in resident satisfaction decreases public trust by 1.3%.14

As a primary provider of state services, IL SOS’s Driver and Vehicle services play a critical role
in defining resident experience, thereby shaping overall perception of the State and trust in
public services.

One of Secretary Giannoulias’ seven transition commitments to residents was to “earn public
trust through good government”.15 Ensuring residents are satisfied with the services they
receive is critical to building this public trust. In addition, as the primary record keeper for the
State, SOS’ ability to maintain these records securely, reliably, and accessibly to those who need
them is vital to its mission. For all these reasons, the integrity of IL SOS systems and the
security of its data is paramount.

13
State-of-the-States survey, 2022, McKinsey & Company,
https://www.mckinsey.com/industries/public-and-social-sector/our-insights/governments-can-
deliver-exceptional-customer-experiences-heres-how
14
State-of-the-States survey, 2022, McKinsey & Company,
https://www.mckinsey.com/industries/public-and-social-sector/our-insights/governments-can-
deliver-exceptional-customer-experiences-heres-how
15
Office of the Illinois Secretary of State, Alexi Giannoulias, “Transition Report”, January 2023

Illinois Secretary of State Technology Modernization

March, 2023 Page 13
Technology Modernization: Full Report
– Why the time to modernize is now

3 Why the time to modernize is now

There are multiple, compelling reasons and factors why the state must launch its modernization
effort right away. These include:

Figure 3: 5 reasons why IL SOS should embark on modernization now

These reasons are detailed further below.

3.1 Growing risk of cybersecurity attacks

Cyber-security attacks are getting more sophisticated, and IL SOS will need to continue
to upgrade its security infrastructure and operations to continue to fend off cyber-
security attacks.

IL SOS is the keeper of significant government records for IL, and the guardian of residents’
identity information. The SOS technology and systems hold sensitive information and must be
protected against the ever-evolving nature of cyber threats.

Moreover, technology organizations today are moving towards cloud-based solutions that
come with built-in security measures that are continually updated to protect against the rising
sophistication of threats. IL SOS technology relies almost entirely on heavily customized,
self-owned and managed legacy infrastructure – making it challenging to keep pace with
modern threat vectors.

Legacy and complex technology architecture, weak info-sec policies, and growing risk of cyber-
attacks such as ransomware can cause major system outages and large-scale operational
disruption. Such outages could impact business continuity for IL SOS, affecting critical
services (e.g., providing organ donor information to recipients, allowing Illinois’s law

Illinois Secretary of State Technology Modernization

March, 2023 Page 14
Technology Modernization: Full Report
– Why the time to modernize is now

enforcement to identify unsafe drivers and take them off the road) and potentially putting
residents at risk.

In recent years, other State Motor Services agencies have experienced cyberattacks and data
breaches16. Incidents such as these further highlight the urgent need for modernization.

Figure 4: Examples of recent cyber incidents in nationwide DMV organizations

3.2 Growing risk of non-compliance with mandates

Delivering on commitments to residents and official mandates is critical to building
confidence in state government. However, IL SOS is at risk of non-compliance with
several current and future mandates largely due to current technology challenges.

At present, technology projects to support many of the official mandates – and sometimes
even basic but necessary updates – can take a long time (sometimes years) leading to
compliance and other issues (e.g., resident distrust, safety).

There have been recent examples of initiatives that had to be postponed due to technology
challenges. IL SOS also has future mandates that need to be delivered, and challenges that
need to be addressed.

16
“California DMV hit by data breach, exposing millions of drivers' personal information to hackers”,
https://www.sfgate.com/bayarea/article/California-DMV-hit-data-breach-ransomware-attack-
15959944.php; “Software vendor says data breach exposed nearly 28 million Texas driver’s license
records”, https://thehill.com/policy/cybersecurity/525923-data-breach-of-software-vendor-exposes-
almost-28-million-texas-drivers/; “DPS sent at least 3,000 driver’s licenses to organized crime group
targeting Asian Texans”, https://www.texastribune.org/2023/02/27/texas-drivers-license-theft-dps/

Illinois Secretary of State Technology Modernization

March, 2023 Page 15
Technology Modernization: Full Report
– Why the time to modernize is now

Examples of delays due to technology complexity include:

● State-to-state title transfer: The deadline for state-to-state title transfers was first
proposed in 2015. Since then, the deadline has been postponed 4 times, including a couple
of times due to insufficient capacity within IT (people or systems) to take on the complexity
of the task within the stipulated time.

● Interface with AAMVA: IL SOS’ transmission mechanism with AAMVA (American

Association of Motor Vehicle Administrators), called UNI, will no longer be supported as of
2024. Without an alternative method, IL SOS risks losing its ability to share data with
AAMVA, which sets national standards for IDs and shares important data on commercial
driver safety.

● ELiens: ELiens was mandated in 2022. However, the service has yet to be delivered
● eNotarization: eNotarizations was originally mandated in 2020 and has yet to be delivered.

● Real ID: There are at least 7M residents in Illinois who still need to upgrade to their current
ID to Real ID.17 Obtaining Real ID is a complex transaction that requires multiple steps and
documentation and is very challenging to implement with today’s systems.

Modernization will be a key factor in enabling timely support of mandates. Moreover, not
modernizing at this point could increase the costs and risks of not complying with some of the
mandates.

3.3 Loss of institutional knowledge

The window of opportunity for modernization is closing as IL SOS loses institutional
knowledge in its technology talent pool.

IL SOS technology and systems are dated. Critical resident services are still being delivered by
leveraging a combination of mainframe systems with COBOL (a computer programming
language that was developed in late 1950’s). These systems are complex to comprehend and
do not follow modern software development principles (e.g., a simple business rule change
may require reviewing or updating thousands of lines of code through antiquated interfaces
and programming tools with limited abilities for automation and error prevention.)

Additionally, current IL SOS employees indicate they only “understand 80% of the current
code”. Even this knowledge is at the risk of further erosion as IL SOS resources proficient
with Mainframe system and COBOL are coming up for retirement.

17
Interviews with IL SOS employees, Feb – Mar 2023

Illinois Secretary of State Technology Modernization

March, 2023 Page 16
Technology Modernization: Full Report
– Why the time to modernize is now

Programmers began moving away from COBOL as early as the 1980’s18 and the average age
of COBOL programmers in the market is 45-55, with many set to retire soon.19 This pattern
is reflected in IL SOS. This makes it very difficult for any entity – particularly public sector entities
– to find and recruit technical talent who can code in COBOL. This is due to the shortage of
such talent in the market, the rising costs due to the shortage, and the time to fill a position. It
can take upwards of a year to fill a position in IL SOS IT.

Figure 5: IL SOS tech talent challenges

In a few years, IL SOS may not have the necessary talent in-house to maintain and update the
mainframe and COBOL code base, and may not be able to find and recruit the required talent
in time to keep the lights on. Lastly, even if the COBOL talent is successfully recruited, there
will be the question of coming up to speed and understanding the current codebase, systems,
and their architecture.

18
“Desperate Need for COBOL Programmers During Covid-19 Underlines the Importance of
Workforce Planning,” Kathy Gurchiek, Society for Human Resources Management, April 9, 2022
https://www.shrm.org/hr-today/news/hr-news/pages/desperate-need-for-cobol-programmers-
underlines-importance-of-workforce-planning.aspx
19
“COBOL blues” Reuters Graphics, Travis Hartman, http://fingfx.thomsonreuters.com/gfx/rngs/USA-
BANKS-COBOL/010040KH18J/index.html

Illinois Secretary of State Technology Modernization

March, 2023 Page 17
Technology Modernization: Full Report
– Why the time to modernize is now

3.4 Increasing cost of maintaining status quo

The costs and risks of the status quo will increase over time. If IL SOS does not modernize,
the cost of this “Do Nothing” scenario will likely
increase disproportionately, as conceptually
illustrated by the adjacent graphic, due to the
following factors:

● There cost to maintain legacy systems will likely

increase. Budget analysis indicates there has been a
10% year on year increase in cost over the last 5
years, just to do the bare minimum “keep the lights
on”. With the talent pool shrinking, the cost of both
recruiting and paying for the talent will contribute to
the rising costs Figure 6: Conceptual illustration of cost over
time
● The effort and time to make updates and to keep
up with mandates will likely become greater, as
the system continues to get more complex

● There is a shrinking group of employees who know the code base. If IL SOS loses the critical
institutional knowledge, it may take longer to analyze, test and modernize the technology
resulting in greater costs. Moreover, and the risk of errors and defects could increase,
thereby costing the state more

● Lack of digitization may increase the spend on in-person, website and phone channels as
transaction volumes grow alongside new mandates IL SOS needs to deliver on (e.g., Real
ID)

Beyond the costs, the risks of cyber-attacks and data breaches become even more challenging
to mitigate. Lastly, deferring modernization can also create rework in the future i.e., any major
investments that are made in the current legacy technology will either provide low return or
will need to be re-done in the future.

3.5 Inability to keep pace with other States and digital

service standards
A national survey19 of satisfaction levels among residents with US State services in 2022 shows
that a 1% decrease in resident satisfaction decreases public trust by 1.3%.

Driver and vehicle services are one of the first state services to be experienced by several
resident segments (e.g., teens, new state residents etc.). With no modernization, Illinois will lag

Illinois Secretary of State Technology Modernization

March, 2023 Page 18
Technology Modernization: Full Report
– Why the time to modernize is now

in delivering favorable constituent experience and reducing “time tax” (and therefore, cost) to
residents and businesses. Ultimately, this could impact State’s competitiveness and perception.

Several other states have already announced or are in process of moving away from legacy
technology and offering innovative services to residents, raising the standard for public sector
digital Driver & Vehicle services.

Examples of Modernization programs in other states, with sample initiatives and impact
Texas20
Texas’ Department of Public Safety began modernizing its infrastructure
in 2013, migrating its systems from a legacy codebase to modern
platforms in a one-by-one refactoring effort. Their legacy systems (e.g.,
COBOL) were becoming too costly to maintain and the lack of agility impeded critical
business process improvements, while increasing cyber risk. The State continues to
prioritize modernization and technology improvements for 2023-202721

● Initiatives: Texas’s modernization program focuses largely on fortifying its

technology, including

— Improving cybersecurity and fraud mitigation

— Migrating from mainframe to a modern, scalable Linux-based environment

— Replacing a 1990’s Registration and Title System
— Implementing a paperless registration renewal
— Creating a single point-of-contact gateway for residents through its contact center
● Budget: Expected program budget is approx. $245M

● Impact: With refactored systems, users could more easily search for records, including
vehicle registrations, not just by VIN, but by owner’s name or address. In addition, Texas
DMV was able to simplify reporting, condensing 1,000+ legacy reports into 27 parameter-
based reports, which directly provides flexibility to the end-user.22 23

20
Texas Department of Motor Vehicles, FY2023-2027 Strategic Plan,
https://www.txdmv.gov/sites/default/files/report-files/TxDMV_Strategic_%20Plan_2023-2027.pdf
21
Ibid
22
NASCIO State IT Recognition Awards Emerging and Innovative Technologies
https://www.nascio.org/wp-content/uploads/2020/09/2017-NASCIO-State-IT-Recognition-
Awards_Emerging-and-Innovative-Technologies_TxD.pdf
23
Ibid

Illinois Secretary of State Technology Modernization

March, 2023 Page 19
Technology Modernization: Full Report
– Why the time to modernize is now

Figure 7: Texas DMV’s migration approach from legacy to modern systems

California24
California’s new governor, G. Newson, made REAL ID, modernization,
and improved service a priority when he was elected to office in 2019.25

● Initiatives: As part of modernization, California’s DMV is implementing

— Virtual field offices to address customer needs online
— Proactive Real ID messaging

— Expanded credit cards and mobile wallet acceptance across all facilities,
— Enhanced cybersecurity

— Migrate high-volume transactions off mainframe.

● Budget: Expected program budget is approx. $415M26

● Impact: To date, the state has seen transaction time drop by more than half over the
course of its modernization efforts.

24
California Department of Motor Vehicles Digital Experience Platform project proposal and related
documents, https://projecttracking.technology.ca.gov/Details?id=c5586466-ce45-4fa6-8fc2-
ae46f899960e, https://esd.dof.ca.gov/Documents/bcp/2122/FY2122_ORG2740_BCP4772.pdf
25
Governor Newsom Orders a Comprehensive Modernization and Reinvention of California DMV and
Appoints Management Expert to Lead DMV Strike Team, January 2019
https://www.gov.ca.gov/2019/01/09/dmv-strike-team/
26
https://projecttracking.technology.ca.gov/Details?id=c5586466-ce45-4fa6-8fc2-ae46f899960

Illinois Secretary of State Technology Modernization

March, 2023 Page 20
Technology Modernization: Full Report
– Why the time to modernize is now

Figure 8: California’s Real ID website, with clear instructions, an online application with document verification, and a
chatbot to answer questions

Vermont27
Gov. Phil Scott prioritized and made IT modernization a permanent
function across the state starting in 2020.

● Initiatives: Vermont’s program sought to improve resident experience while also

modernizing back-end technology, through
— Overhauling of DMV mainframe and other legacy systems (with complete migration to
cloud-based Workday)

— Improving cybersecurity
— Upgrading user-interfaces and offering most services online

● Budget: Expected program budget is approx. $80M28

27
Vermont Department of Motor Vehicles Core System Modernization Report,
https://legislature.vermont.gov/Documents/2022/WorkGroups/House%20Energy%20and%20Techn
ology/Technology/Agency%20of%20Digital%20Services/DMV%20Modernization/W~John%20Quin
n~DMV%20Core%20System%20Modernization%20Phase%20II~2-8-2022.pdf
28
https://legislature.vermont.gov/Documents/2022/WorkGroups/House%20Energy%20and%20Technol
ogy/Technology/Agency%20of%20Digital%20Services/IT%20Modernization%20Fund/W~John%20Q
uinn~DMV%20IT%20System~2-10-2021.pdf

Illinois Secretary of State Technology Modernization

March, 2023 Page 21
Technology Modernization: Full Report
– Why the time to modernize is now

● Impact: Within 1 month of starting this program, 28% of license renewals took place
online, significantly reducing onsite resident traffic.29

In addition to the above, Idaho, Nevada, Ohio, Oregon, New York and Nebraska have
also undertaken modernization efforts in their DMVs, among other states.30

These compelling examples further support the hypothesis that the Illinois needs to start
its modernization and digitization journey.

29
“Vermont Begins Issuing Driver’s License Renewals Online”, Government Technology, May 2020
https://www.govtech.com/gov-experience/vermont-begins-issuing-drivers-license-renewals-
online.html
30
“Is There Hope for Modernizing State DMVs?” Government Technology, March 2023 https://www-
govtech-com.cdn.ampproject.org/c/s/www.govtech.com/computing/is-there-hope-for-
modernizing-state-dmvs?_amp=true
DMV Transformation Effort Fact Sheet, March 2022 https://dmv.nv.gov/news/22002/facts.pdf
DMV Modernization Initiatives Deliver Big Benefits for Citizens, StateTech, April 2020
https://statetechmagazine.com/article/2020/04/dmv-modernization-initiatives-deliver-big-benefits-
citizens
BMV Services Now Available on Saturday, February 2023 https://publicsafety.ohio.gov/home/news-
and-events/all-news/bmv-services-available-022523
Idaho DMV to update vehicle registration and titling system in October, October 2020
https://itd.idaho.gov/news/idaho-dmv-to-update-vehicle-registration-and-titling-system-in-
october/
New website launch kicks off DMV transformation effort, March 2022 https://dmv.nv.gov/news/22002-
dmv-transformation.htm

Illinois Secretary of State Technology Modernization

March, 2023 Page 22
Technology Modernization: Full Report
4 – Assessment of technology-enabled resident and employee
experience

4 Assessment of technology-enabled resident and

employee experience
Key points:
● Technology challenges directly impact residents’ and employees’ experience with IL
SOS – today 68% of residents are dissatisfied with their experience in Drivers & Vehicle
Services

● As one of the most important services to residents, Drivers & Vehicle Services act as the
‘face of the state’, shaping their overall view of state government.

● Residents struggle with unclear access to information and inconvenient processes,

which increase their “time tax” and “frustration”

● Employees use outdated technology that is difficult to learn and error-prone

● Paper-based and “green screen” systems make employees feel "under-valued", and low
morale

This section outlines the current state of the resident and employee experience - either with
or caused by the current outdated technology landscape.

Technology challenges aren’t just about code and back-end systems. They directly impact
residents’ and employees’ day-to-day experience with IL SOS.

A survey of IL residents conducted in 202231 found that 68% of residents are dissatisfied with
their experience in Motor Services. This dissatisfaction is even higher in low-income
communities, where the hurdles of accessing services, e.g., taking a day off work to visit a
facility, are even steeper. The survey shows that reliability & consistency, ease of navigation,
and speed of completion are the top 3 drivers of residents’ experience in vehicle services. All
those dimensions could be positively impacted by technology, thereby significantly improving
satisfaction levels. For instance, technology could be leveraged to offer effective self-service,
provide clear information on the website, reduce duplicate work, reduce need for in-person
trips, shorten call-center calls, and more.

31
State of the States survey, 2022, McKinsey & Company,
https://www.mckinsey.com/industries/public-and-social-sector/our-insights/governments-can-
deliver-exceptional-customer-experiences-heres-how

Illinois Secretary of State Technology Modernization

March, 2023 Page 23
Technology Modernization: Full Report
4 – Assessment of technology-enabled resident and employee
experience

The implications for residents are quite meaningful. For instance, when parents can’t take time
off work to take their teenagers to a facility to get an ID, those young people miss out on the
opportunity to get summer jobs or internships (or parents lose a day of work and/or income).

Figure 9: Summary of IL resident experience with SOS services

Residents also want different options to access services. The same residents’ survey showed
that nearly 60% of Illinois residents prefer to use digital channels if available. Today, nearly half
of residents who use in-person and phone channels are not using their preferred channel.32

Driver & Vehicle Services often shape the way constituents view the State as a whole. Low
satisfaction leads to low levels of public trust, reducing residents’ confidence in their
government. Each percentage point decrease in satisfaction rate results in a 1.3% decrease in
public trust33.As one of the most important and commonly used services, Driver & Vehicle
Services act as the ‘face of the state’:

32
Ibid.
33
Ibid

Illinois Secretary of State Technology Modernization

March, 2023 Page 24
Technology Modernization: Full Report
4 – Assessment of technology-enabled resident and employee
experience

Figure 10: How SOS services impact perception of the State

A visit to facilities in both metro and downstate highlighted pain points for both residents
and employees throughout the current process. The major pain-points are detailed below.

4.1 Pain point 1: Inaccessible Information

Observations

Residents struggle to find critical information about services, required documents, available
appointment times, which facilities perform which tasks, etc. This results in unnecessary foot
traffic in facilities. Moreover, residents have to return to fix errors. Unnecessary visits increase
work for employees and wait times for everyone, increasing "time tax” at facilities.

Technology and digitization can play a hugely supportive role here. The current IL SOS
website is difficult to navigate. Critical information is hard to find, and it is unclear how to
access digital services when they are available, due to numerous links and layers in the
current interface.

Illinois Secretary of State Technology Modernization

March, 2023 Page 25
Technology Modernization: Full Report
4 – Assessment of technology-enabled resident and employee
experience

Figure 11: IL SOS website has numerous links, and two entry points for driver’s license renewal (Source: ILSOS.gov,
accessed March 1, 2023)

Figure 12: Not all facilities have clear signage. (Schaumburg, February 28, 2023)

Illinois Secretary of State Technology Modernization

March, 2023 Page 26
Technology Modernization: Full Report
4 – Assessment of technology-enabled resident and employee
experience

Quotes from residents at facilities

"I couldn't find information about when appointments are released… I tried making an
appointment at 12AM and realized they released slots at 6AM because a neighbor told me."

"I was confused about where to go because I saw a huge line outside, but there were no
signs telling you what to do if you have an appointment. I was thinking, I have an
appointment, so do I still have to wait outside?"

"This is my first time coming here since I just got my license. I wasn't sure how to make an
appointment but luckily, my friend has already done it before, so he showed me."

"If you have special circumstances, such as any name changes due to marriage or divorce,
you need to bring additional documentation to prove your identity, but this disclaimer and
information is listed as a tiny asterisk on the bottom of the page. I could barely see it."

4.2 Pain point 2: Inconvenient Experiences

Observations

Residents pass through multiple steps at different windows to complete even simple tasks
(e.g., payment), all with their own wait time, sometimes with repeat procedures. Residents are
often confused about where to go next, due to the numerous steps required for one
transaction. Employees then need to step in and help out, guiding them on where to go next,
which in turn reduces their time available to serve residents.

Illinois Secretary of State Technology Modernization

March, 2023 Page 27
Technology Modernization: Full Report
4 – Assessment of technology-enabled resident and employee
experience

For senior citizens and those with disabilities, the need to move around to so many stations,
and the confusing experience can be particularly difficult.

Appointments have reduced wait time for some, but the process is still cumbersome and
challenging. Technology and process redesign could help streamline the experience both in-
person and virtually, making it easier for residents to navigate various services.

Figure 13: Steps involved in renewing a DL, when a test is needed. Observed in facility visits Feb 27-28, 2023

Quote from a resident at a facility

"It's like going to McDonald's and having to wait in different lines to get my sandwich, my
sides, and my drink."

Quote from an employee at a facility

Illinois Secretary of State Technology Modernization

March, 2023 Page 28
Technology Modernization: Full Report
4 – Assessment of technology-enabled resident and employee
experience

"We check resident documents at the check-in desk but also here [Drivers Services] because
our systems don't communicate with each other, so I don't know if they actually have the
correct documents even if they passed the first checkpoint."

4.3 Pain point 3: Unintuitive Systems leading to errors

Observations

The main computer systems used in facilities are ‘green-screens’ (See image below) that
require numeric entry codes (a far cry from the intuitive, user-friendly website and systems
most residents are used to today). Using these systems can be slow and laborious for
employees. Some examples of this include:

• Employees need to remember complex codes for various transactions, leading to

slower turnover rates and longer facility wait times.

• Multiple different systems are required to be used simultaneously, increasing the

mental load on employees who are already experiencing anxiety due long lines of
waiting residents.

• The complexity of the systems leads to frequent errors, resulting in repeat traffic at
facilities and frustrated residents.

Figure 14: Some examples of difficult to use systems and processes for employees in the facilities. (Springfield,
Wabash, Feb 27, 2023. Image blurred for confidentiality)

Illinois Secretary of State Technology Modernization

March, 2023 Page 29
Technology Modernization: Full Report
4 – Assessment of technology-enabled resident and employee
experience

Figure 15: Some examples of systems relying on numeric codes. (Springfield, Wabash, Feb 27, 2023. Image blurred
for confidentiality)

Figure 16: Examples of employees relying on “cheat sheets” to remember codes. (Springfield, Wabash, Feb 27, 2023.
Image blurred for confidentiality)

Illinois Secretary of State Technology Modernization

March, 2023 Page 30
Technology Modernization: Full Report
4 – Assessment of technology-enabled resident and employee
experience

Quotes from employees at facilities

"The system is so complex that you will never get comfortable using it; I still use my cheat
sheet daily after being here for 11 years!"

"The scanner doesn't work for licenses; it gives a random string of numbers when we scan
the barcode. That's why we need to manually enter the license number and the
corresponding information."

"If a signature is missing, or a document is not scanned, or any other information is wrong,
we need to call the resident back to the facility to re-do the entire process. As you can
imagine, they are very unhappy with this as it isn't their fault, and they have to take time out
of their day to re-do the application that should have been correct in the first place."

4.4 Pain point 5: Training challenges due to complex and legacy

technology
Observations

The complexity of the legacy systems presents significant challenges when it comes to training
employees on how to use them. Formal training for certain facilities (especially in Downstate)
is only offered 6 to 12 months after a new hire’s start date due to low availability of employees
with enough experience to give trainings. This means new employees are trained in complex
systems on-the-job and may have difficulty in serving residents as they gain an understanding
around the right processes or implications of the tasks. This, combined with the complexity of
the systems, drives up error rates, resulting in repeat visits for residents, and anxiety for
employees.

Illinois Secretary of State Technology Modernization

March, 2023 Page 31
Technology Modernization: Full Report
4 – Assessment of technology-enabled resident and employee
experience

Furthermore, there is an opportunity for technology to play a supportive role in helping

employees keep up with the legislature or policy changes as it relates to immigration,
international regulations, etc., given the pace of change and complexity of policies/ processes.

Quotes from employees

"Usually, people get trained on the job - we try to start with simple tasks."

"We can't afford to officially train new hires as we don't have enough coverage to take
senior employees away from their station to oversee and train new hires."

"We get dozens of new legislations and regulations daily but never have enough time to
get employees up to speed”

4.5 Pain point 6: Low morale

Observations

Employees feel the tension of having upset and dissatisfied residents. Larger facilities process
hundreds of residents daily, and the employees could feel “anxious” about working down the
line fast enough.

Furthermore, basic processes such as paper-based clipboards to check-in/out instead of

automation could lower morale of the employees, who would much rather focus on high-value
activities Employee systems have their own issues. Time tracking is currently a manual process,
resulting in large amounts of paper daily due to schedule printouts, sign-in and sign-out
sheets, etc. resulting in unnecessary time spent on tracking and organization that could be
easily automated. This creates long delays in updating an employee’s vacation day balance, so

Illinois Secretary of State Technology Modernization

March, 2023 Page 32
Technology Modernization: Full Report
4 – Assessment of technology-enabled resident and employee
experience

employees are unsure of how many days they have available. In some cases, employees have
had to cancel vacations once systems were finally updated.

Above, combined with the challenges of outdated technology, complex systems, and lack of
training lowers employee morale.

Figure 17: Examples of paper-based systems for time tracking (Schaumburg, February 28, 2023)

Figure 18: Examples of paper-based schedules and time-off requests. (Schaumburg, February 28, 2023)

Illinois Secretary of State Technology Modernization

March, 2023 Page 33
Technology Modernization: Full Report
4 – Assessment of technology-enabled resident and employee
experience

Quotes from employees at facilities

"Morale is one of our biggest obstacles; employees can hear the residents grumbling about
how bad the service and process is."

Illinois Secretary of State Technology Modernization

March, 2023 Page 34
Technology Modernization: Full Report
5 – Assessment of current technology

5 Assessment of current technology

Key points:
● IL SOS’s technology is still based on 1980’s-era systems, and a coding language that is
over 60 years old

● Years of incremental additions and patches have resulted in a complicated, unwieldy

system, which no one person understands in its entirety and is very challenging to
manage

● A technology scoring of SOS tech capabilities found that IL SOS is in the bottom 10%
of public sector organizations
● With outdated technology, IL SOS faces three present challenges

1. Data protection & cybersecurity challenges- putting resident data at risk

2. Complex systems that are difficult to update – making it slow, costly and difficult to
add any new capabilities or services and meet mandates

3. A shrinking pool of talent who understands the COBOL code – increasing the risk
and cost of maintaining the status quo

This section outlines the current state of IL SOS technology, an overall assessment of the
technology capabilities, and the major challenges this presents to the State.

5.1 The state of IL SOS’s technology today

IL SOS’s current state infrastructure and systems still largely rely on decades old technologies,
without any strategic overhaul in the recent past. The current technology architecture is based
on:

● A mainframe core platform that hasn’t been modernized – increasing the costs and
risks of continued support: IL SOS infrastructure core is centered around a mainframe
transaction processing system. Many organizations are in process of phasing it out, while
SOS had to increase capacity to its existing mainframe system in the recent past. The costs
and risks of supporting such a legacy system will increase over time.

● A complex landscape of homegrown applications, with lack of an architecture

“blueprint”- making it slow and error-prone to deploy capabilities: IL SOS uses 140+
applications that have been built over the years to deliver its services. As individuals retire
or leave SOS, the full knowledge of these applications’ codebases leaves with them. No one
person has the full picture of all applications and the connections between them- which is
what is referred to as an “architecture blueprint”. IL SOS lacks this type of “map”. The data

Illinois Secretary of State Technology Modernization

March, 2023 Page 35
Technology Modernization: Full Report
5 – Assessment of current technology

exchange and integration between these applications should be further studied, as these
integration points may expose several security vulnerabilities. Furthermore, when updates
are needed (for example, a fee change) to policies or business processes, this lack of a
blueprint makes it difficult to identify all possible impact points and related test scenarios
to be considered before this code is released in production.

● A coding language that is difficult to find proficient talent in, increasing the risks of
supporting the current setup: Critical applications are written in COBOL code, a legacy
language first developed in the 1980’s, making finding proficient talent quite difficult. One
anecdote to illustrate the extent of the challenge: during the Coronavirus outbreak, some
States like New Jersey had to put out a public call for volunteers who knew COBOL, to help
the State keep the mainframes that powered its unemployment benefits up and running.
34
. In addition, many SOS technology department positions are vacant, due in part to the
limited availability of technologists that still study and are proficient in these technologies.
The next generation of programmers coming out of universities usually prefer to learn the
latest in technology and not something which is on path of retirement and being phased
out. This means the small group of engineers available spend all their time ‘keeping the
lights on’ to maintain existing technology, with limited-to-no time available to focus on
improvements.

“When I arrived here, it was like stepping back into the 1990’s”
~ IL SOS IT department employee

● Data that is hard to find, and not consistently updated: Each of IL SOS’s 25 departments
stores and maintains data in its own way. Data relating to the same resident may be stored
in scores of different systems. If a resident gets married and changes their name in one
system, this update may not necessarily be carried to a different department’s database. A
lack of consistent data formats (e.g., for date of birth), makes sharing data between
departments cumbersome.

34
https://www.cnbc.com/2020/04/06/new-jersey-seeks-cobol-programmers-to-fix-unemployment-
system.html

Illinois Secretary of State Technology Modernization

March, 2023 Page 36
Technology Modernization: Full Report
5 – Assessment of current technology

5.2 Comparing IL SOS technology capabilities to

other organizations
An assessment that measures organizations’ Technology score – a composite score of
services, capabilities, and infrastructure across multiple dimensions- placed IL SOS 12th out
of 13 public sector companies in the peer group.35

Figure 19: IL SOS tech capabilities compared to other public sector organizations

Technology score methodology

The technology score asks employees to assess their organization’s technical capabilities across
a number of dimensions. Example dimensions include Technology Strategy, Data Capabilities,
Platform architecture, and technology org and operating model. The results are then compiled
into a composite score, which is compared to other organizations in the benchmark database.

Technology is constantly updating, which means we live in a very different world today
compared to when SOS built its current technology stack. Today, organizations are cloud-first,
mobile enabled, available 24X7, and enhance their features daily. As these organizations
continue to modernize, and the longer SOS takes to embark on the next technology
modernization journey, the larger this gap will become. This in turn further increases the gap
between residents’ expectations and the quality of services IL SOS provides.

35
Technology score assessment, conducted February – March 2023

Illinois Secretary of State Technology Modernization

March, 2023 Page 37
Technology Modernization: Full Report
5 – Assessment of current technology

5.3 Challenges with IL SOS technology

5.3.1 Challenge 1: Data protection and cyber security

In its role as the central identity provider and record keeper for Illinois, SOS maintains over 2
billion records that include sensitive, personally identifiable information (PII) for the State’s
12.8M residents. This includes, among others:

● Names, including maiden names

● Contact information: phone numbers, addresses, past and present

● Social Security Numbers

● Drivers’ license numbers
● Criminal records and history of violations

If this data were to be leaked, a bad actor would likely have everything they needed to steal
residents’ identity.

This is a growing challenge for ILSOS, as the

rate of cyberattacks and data breaches rises36 Data breaches are a growing risk33
and other public sector entities are ● The rate of phishing attacks has risen
strengthening their defenses against 4-fold since 2020, and "spear-phishing"
attacks.37 Data breaches are becoming more – impersonating a sender – makes
costly38 (see callout box), and bad actors these attacks more effective
target the ‘weakest links’. Keeping pace with
● 19% of data breaches occur due to a
– if not exceeding – other entities’ level of
compromise at a business partner
cybersecurity reduces the risk of becoming a
target. ● Another 19% of breaches are caused by
lost or stolen credentials
Cyberattacks are not only about data
breaches. Ransomware attacks can take whole systems out for weeks or months. At IL SOS, an
outage like this could jeopardize IL SOS’s ability to support other state agencies and services-

36
Verizon, “Data Breach Investigations Report”, 2022
37
“Cyber grant money is beginning to flow, CISA official say,” StateScoop, Benjamin Freed, February
10, 2023, accessed March 10 2023
38
IBM Security “Cost of a Data Breach”, 2022 Report, Proofpoint State of the Phish Report 2022,
Cofense’s Q1 2022 Phishing Review, “The Cybersecurity 202: Cybercrime skyrocketed as workplaces
went virtual in 2020, new report finds” Tonya Riley, The Washington Post Online, February 22, 2021
https://www.washingtonpost.com/politics/2021/02/22/cybersecurity-202-cybercrime-skyrocketed-
workplaces-went-virtual-2020/

Illinois Secretary of State Technology Modernization

March, 2023 Page 38
Technology Modernization: Full Report
5 – Assessment of current technology

e.g., limiting law enforcement from tracking down bad actors by checking vehicle registrations.
Like all organizations, IL SOS needs to continue to stay vigilant to the threat of cyberattacks,
especially along the following dimensions:

Data sharing

In order to fulfill its services, IL SOS currently shares data with over a thousand different entities,
including39

Type of organization Examples

State agencies Department of Transportation, Illinois Tollway Authority
Law-enforcement bodies City of Chicago Police Department

Small businesses Towing companies, currency exchange businesses that offer

select vehicles services

Corporate entities Insurance companies, Risk reduction services (e.g.,

SambaSafety, LexisNexis)
National organizations AAMVA (American Association of Motor Vehicle
Administrators)

IL SOS has an opportunity to continue improving the way it shares this data, including limiting
the amount of data shared to only the minimum necessary to complete services, to reduce the
amount of data shared in the first place, and expand the use of APIs (application programming
interfaces), to give it greater control of how the data is used.

It could also consider implementing data tracing and audit trail systems to ensure each piece
of data extracted from the mainframe is tracked and traced.

It could review its data sharing agreements to more thoroughly assess and monitor external
entities’ security practices, ensuring that any entity that uses IL SOS data stores and uses it
securely.

Authentication & Access management

Logins and unsecure passwords are one of the primary entry points for cyberattacks – 19% of
breaches are caused by lost or stolen credentials40. In order to prepare and defend against
cyber-attacks, IL SOS might adopt protocols like requiring regular password updates, training
it employees on how to use strong passwords or spot phishing, and expand the use of tools

39
Interviews with IL SOS IT department, February – March 2023
40
Verizon, “Data Breach Investigations Report”, 2022

Illinois Secretary of State Technology Modernization

March, 2023 Page 39
Technology Modernization: Full Report
5 – Assessment of current technology

like multi-factor authentication to ensure only approved users can access systems and
databases.

Cybersecurity team & protocols

IL SOS can continue to build its cybersecurity team dedicated to monitoring threats, regularly
testing the strength of its defenses, and implementing additional tools that allow it to stay
‘one-step-ahead’ of threats, for example, CISA guidelines on how best to defend against
cybersecurity attacks (e.g., automatic updates of security patches).41 A cybersecurity team could
also expand employee training on areas like how to recognize phishing emails.

5.3.2 Challenge 2: Complex architecture built around outdated

systems
With hundreds of systems, and thousands of connections between them, making any updates
to IL SOS’s technology is time-intensive and risky.

IL SOS programmers do not understand the full code base, so working out how to effectively
make updates requires investigation and could take a long time. As one IT department member
said, “We only understand about 80% of the current code base.”42

The implication: Because so much accumulated business logic has been developed and
multiple point-to-point connections created over the years, even a small tweak to the code
might cause unexpected ripple effects to other areas of the code, resulting in a high risk of
errors and operational disruption or impact.

Time-intensive and error-prone updates

When updates are mandated - for example, a reduced fee for senior residents - that logic has
to be built into the system in multiple different places, then tested thoroughly to ensure the
update is carried across every application, and every system where the original fee had been
coded. Business logic – written in legacy COBOL code – is buried in lengthy blocks of code,
which have been updated and added to by many different hands over the years, and lack of
documentation makes it challenging for new programmers to understand and make changes.
This not only makes the development of a new feature complex and costly, it also introduces
the risk that the defects may not be caught soon enough and may lead to failure of critical
functionality, which may take long to triage and fix. Hence, it may lead to long and costly
outages to critical systems, and a growing cost and timeline to maintain and eventually replace

41
CISA Campaign Checklist, “Securing your cyber infrastructure”
https://www.cisa.gov/sites/default/files/publications/081720_DHS%20Campaign%20Checklist_v2.pdf
42
Interviews with IL SOS IT department, February – March 2023

Illinois Secretary of State Technology Modernization

March, 2023 Page 40
Technology Modernization: Full Report
5 – Assessment of current technology

these applications. The implication: As more mandates or new capabilities are needed, the
cost and timeline of getting a new technology feature/capability deployed on existing
technology stack will continue to grow compared to doing the same unit of work on
modernized technology stack.

Manual testing approaches leading to more errors and costs

This high complexity of updating a code base like this increases the risk of bugs when
updates are made. To avoid this, IL SOS undertakes a time-intensive testing process. Teams
of testers from facilities all over the state have to carve out time – often taking them
away from critical customer-facing roles- to perform extensive user testing to make sure
new features don’t break existing functionality of tools. The administrative effort and cost of
this approach could severely limit the speed at which IL SOS can offer any new features or
improvements to residents.

Significant time spent accessing data

While each of the 25 departments serves the same 12.8M residents, all have separate and
different methods of storing data, making it challenging to match records across them. For
example, if a resident gets married and changes their name on their driver’s license, that update
will not necessarily be reflected on their vehicle registration. Two databases will maintain non-
matching records for that resident, making data sharing difficult.

This disparate data architecture also increases the burden on IL SOS IT employees, who
spend 25-30% of their time responding to data requests from other agencies.43 Each request
– if it requires pulling data from different departments – might require custom code and senior
programming engineers to complete the request.

5.3.3 Challenge 3: Talent

The legacy architecture also limits IL SOS’s ability to hire and retain talent. The IT department
has faced challenges finding tech talent that is able to code in COBOL, willing to work with
legacy technology.

This has left the department with positions vacant.

It can take upwards of a year to fill a vacant position given low application volumes and a
lengthy hiring process

43
Interviews with IL SOS IT department, February – March 2023

Illinois Secretary of State Technology Modernization

March, 2023 Page 41
Technology Modernization: Full Report
5 – Assessment of current technology

“I had retired, then came back [to the IT department] because no one else understood the
systems as well as I did.”

~ IT Department member

5.4 Opportunity areas

In summary, there are 5 key opportunity areas with current technology & processes

1. Enhance Cybersecurity

IL SOS is the central record keeper and identity provider for the State. With that in mind,
there is room for IL SOS to improve in its data protection and bolster defenses against ever
increasing cyberattacks44, by investing in cybersecurity talent and capabilities.

2. Modernize core systems and simplify architecture

IL SOS’s current state architecture is based on 1980’s era technology, with additional
systems and applications added in as ‘patchwork’ of systems, most of which are
homegrown. Simplifying and modernizing this architecture would allow IL SOS to deliver
the full range of services to meet residents’ needs and make updates in a timely fashion.

This approach also allows for IL SOS to pay down its accumulated “Technical debt”45 over
the past several years. This debt, if left unaddressed – will “come due”, often in sudden and
unpredictable ways (e.g., outages, high cost to roll out new features, errors).

3. Improve front-end resident & employee facing technology

IL SOS has ample opportunity to digitize key resident and employee facing services. These
services or “journeys” could be prioritized based on degree of impact to residents, and
designed and delivered iteratively as the core gets modernized

4. Organize and protect data in a scalable way

Today, IL SOS’s data is difficult to access, not consistently updated across departments, and
not being utilized to its fullest ability. Migrating data to a centralized, searchable, and
scalable database would allow employees to better serve residents (e.g., while in a facility

44
Cost of a Data Breach Report 2022, IBM Security
45
Ernst, N., 2015: A Field Study of Technical Debt. Carnegie Mellon University, Software Engineering
Institute's Insights (blog), Accessed March 15, 2023, http://insights.sei.cmu.edu/blog/a-field-study-
of-technical-debt/.

Illinois Secretary of State Technology Modernization

March, 2023 Page 42
Technology Modernization: Full Report
5 – Assessment of current technology

for a DL renewal, check if the resident’s vehicle also needs a sticker renewal), more quickly
respond to data requests without having to deploy custom code, and improve transparency
for residents.

Overall, these five opportunities are highly interdependent and need to be coordinated the
right way and in a programmatic fashion. These five opportunities could form the backbone of
a modernization program for IL SOS, outlined in the next chapter.

Illinois Secretary of State Technology Modernization

March, 2023 Page 43
Technology Modernization: Full Report
6 – What might a modernization program look like

6 What might a modernization program look like

Key points:
● A modernization program for IL SOS could include 5 workstreams
1. Strengthen cybersecurity capabilities and controls

2. Migrate systems away from systems built on 50+ year-old technology (e.g.,
Mainframe, COBOL) to modern platforms that are more flexible, use contemporary
code, and are easier to quickly update

3. Move data into a centralized data repository, where the most updated information
can be shared across departments (e.g., Drivers & Vehicle services)
4. Improve resident and employee experience by moving commonly-used services
and internal functions online
5. Set up transformation program management to oversee and coordinate the
program, including change management and training for new ways of working

● Residents and employees could start seeing a difference in their day-to-day experience
with IL SOS, including through such features as proactive reminders, a secure resident
portal for document uploads & application tracking, and self-guided trainings for
employees

6.1 Key modernization workstreams

To address the risks of outdated technology and the pain points its causes for residents, IL SOS
could consider a modernization program with 5 key workstreams. These are detailed further in
the sections following.

1. Cybersecurity

2. Technology systems & infrastructure

3. Data
4. Resident & employee experience

5. Transformation program management

Illinois Secretary of State Technology Modernization

March, 2023 Page 44
Technology Modernization: Full Report
6 – What might a modernization program look like

6.1.1 Workstream 1: Cybersecurity

This workstream aims to strengthen SOS’ cyber defenses even more, preventing data leaks
and identity theft, and ensure systems are as reliable as possible, safe from ransomware
attacks that could jeopardize services.

Examples of initiatives could include:

● Expand cybersecurity team and capabilities, e.g., security strategy and infosec policies
● Expand monitoring to identify potential threats before they occur, and more frequently
check for weak points

● Implement safer practices for sharing data with authorized parties

● Train employees and residents on safe data handling practices

6.1.2 Workstream 2: Technology Systems and Infrastructure

The workstream aims to make IL SOS’s technology easier, quicker, and less risky to update,
so it can deliver much-needed services to residents on time. Having systems written in today’s
common coding languages will help attract and retain more talent to the IT department and
improve resident and employee experiences and operational effectiveness more easily.

Examples of initiatives could include:

● Migrate core systems and applications off 1980’s-era mainframe to a more modern
platform

● Modernize core systems by re-writing them with a more contemporary code or buying
custom-off-the-shelf products to replace current systems

● Adopting digital solutions for internal processes, allowing quicker updating of technology
and easier collaboration between departments (e.g., Enterprise Resource Planning (ERP)
software)

6.1.3 Workstream 3: Data

This workstream aims to make it easier for residents and employees to find information
within IL SOS. When residents want to search for business or lobbyist records, for example,
they could type a name into a single search bar to see all records, rather than having to search
by the exact ID number of a business.

Employees could see all records for a resident in one place. For example, this could allow an
employee at a Driver facility to notice that a resident’s vehicle registration is expiring soon, and
renew it for them in the same visit (a task that is very difficult to do today).

Illinois Secretary of State Technology Modernization

March, 2023 Page 45
Technology Modernization: Full Report
6 – What might a modernization program look like

One way to do this is to conceptualize and implement a ‘Resident 360’ database: a single view
to house resident data across departments, making it easier for residents to manage all of their
IL SOS services in one place online. For example, when someone changes their name in one
service, it could be updated across all. In order to better protect data from breaches – an ‘access
layer’ can be applied as an additional layer of protection on the database.

Examples of initiatives could include:

● Build a data platform and create a single source of truth for SOS data

● Migrate data to this scalable new platform

● Build a resident-360 degree view of data
● Build logic to securely access and share data from this platform within and outside of SOS

6.1.4 Workstream 4: Resident and Employee Experience

While addressing critical risks in its technology foundation is a priority, IL SOS could
simultaneously improve resident and employee experience with ‘quick-wins’ like using e-Time
for employees and ‘Skip-the-Line’ appointment scheduling for residents.

IL SOS can also offer online options for high impact services (e.g., vehicle registrations,
renewals, e-Titling) so residents can access services in the way they prefer.

Examples of initiatives could include:

● Update ILSOS.gov website to make information easier to find

● Skip-the-line easy appointment scheduling

● Improve business processes to reduce time tax and error
● Create a resident account online, where residents can find information, update their
information and track their applications
● Implement eTime for employees to move away from paper-based time tracking

6.1.5 Workstream 5: Transformation Program Management

Given the critical risks IL SOS aims to solve, timely delivery of a modernization program matters.
A transformation program management office could oversee the progress of the program and
ensure it finishes within time and budget. Additionally, this office could drive change
management efforts required for this program to be successful. Examples of initiatives could
include:

Illinois Secretary of State Technology Modernization

March, 2023 Page 46
Technology Modernization: Full Report
6 – What might a modernization program look like

● Work with internal departments and vendors to plan and deliver on the modernization
roadmap within time and budget
● Coordinate and orchestrate various workstreams

● Drive organizational change management activities to adopt new process and technology,
including communication and training

● Support filling key talent positions and roles currently vacant or needed to support the new
modernized technology

6.2 Potential phasing of the program

The modernization workstreams could be delivered over a three to four year period at a
total cost of $200,000,000 where the focus could be on the biggest and most pressing
challenges.

IL SOS could potentially plan to run this program in 3 phases, outlined below.

Phase 1: Launch – Accelerate quick wins

In the first phase, IL SOS could focus on implementing the must-do critical fixes to ensure
reliability and security of the IL SOS systems (e.g., any threat remediation, development of tech
strategy and architecture), as well as launch quick wins to address the most pressing resident
and employee pain points (e.g., complete website updates and launch eTime). During this
phase, IL SOS could get started on some initiatives that could take longer to complete, like
launch of the data platform.
Workstream Initiatives could include:
Cybersecurity ● Start setting up overall strategy, roadmap and governance framework
● Enhance protection against critical cyber-security threats
Technology ● Assess applications to determine candidates for migration based on a
systems & variety of factors
infrastructure ● Develop initial estimates and sequencing
Data ● Define data analytics use-cases that drive highest value
● Assess and revise data sharing agreements
● Launch data platform build
Resident &● Accelerate on-going projects (e.g., website upgrade)
employee ● Implement quick-wins (e.g., skip-the-line, eTime, chatbot to answer
experience queries)

Illinois Secretary of State Technology Modernization

March, 2023 Page 47
Technology Modernization: Full Report
6 – What might a modernization program look like

Phase 2: Build – Modernize the core

Having addressed the most critical risks in Phase 1, IL SOS could turn to modernizing its core
systems in Phase 2.

In this phase, IL SS could continue strengthening its cybersecurity by expanding capabilities

such as access management, data loss protection, and privacy compliance.

In addition, IL SOS could start modernizing its core systems, including migrating the most
frequently-used systems off outdated code and onto modern platforms.

More high-volume, high-importance journeys that are critical to residents could be moved
online to continue expanding access to digital services.

Workstream Initiatives could include:

Cybersecurity ● Build and strengthen comprehensive security functions (e.g., access
control, data loss protection, privacy compliance, encryption)
Technology ● Begin to update systems to move away from legacy technology (e.g.,
systems & move to a newer standard platform)
infrastructure
Data ● Complete data platform build (i.e., data migration and access layer)
Resident &● Simplify workflows in facilities
employee ● Launch mobile app and move high impact low to medium
experience complexity journeys online (e.g., sticker application, handicapped
parking permit application and renewal, vehicle registration)

Phase 3: Sustain – Continue digitization

Having begun to establish a modern foundation for its highest volume, highest impact systems
and services, IL SOS could continue its modernization, bringing more systems onto modern
platforms, and offering more resident services online.

With a new, centralized database, IL SOS could explore implementing Resident-360 on the new
data platform, and adding a secure data access layer

Illinois Secretary of State Technology Modernization

March, 2023 Page 48
Technology Modernization: Full Report
6 – What might a modernization program look like

Workstream Initiatives could include:

Cybersecurity ● Complete building comprehensive security capabilities and
enhancing existing capabilities (incl. modern data-sharing
mechanisms, e.g., APIs, to control data being shared)
● Define new IT processes for the future (e.g., regular system upgrades)
Technology ● Complete modernizing the technology back bone for the most
systems & important systems
infrastructure
Data ● Build Resident 360 database with secure access protocols
● Institute data governance and data quality framework
Resident &● Complete workflow simplification
employee ● Move additional journeys online (e.g., e-Title, search for business
experience records, file Articles of Organization, access Good Standing Certificates)

Throughout the program: Transformation program management

IL SOS could set up a transformation office which could oversee the entire modernization effort.
Its workplan could include, but not limited to:

Workstream Initiatives could include:

Transformation ● Project manage the transformation effort with internal departments and
Program external vendors to ensure on-time in-budget delivery
Management ● Communicate updates widely and frequently
● Educate residents and employees on changes in systems and processes
to ensure adoption of new technology
● Help shift mindsets and cultures to embrace the new ways of working
● Take frequent pulse checks of organization
● Support talent acquisition needed to manage and maintain the
modernized technology

6.3 Modernization outcomes

Technology modernization isn’t just about updating back-end systems and code – it has a
direct impact on residents’ and employees’ day-to-day lives.

The goal of the modernization program is ultimately to improve IL SOS’s ability to continue
to provide critical services to the residents, safeguard their data & identity information
and provide a positive experience to residents and employees.

Illinois Secretary of State Technology Modernization

March, 2023 Page 49
Technology Modernization: Full Report
6 – What might a modernization program look like

Modernized technology could enable IL SOS to offer new tools to improve residents’ and
employees’ experience. Some examples of services that IL SOS could offer through modernized
tech and digitization are listed below as thought starters:

1. Send proactive resident reminders when it’s time to renew a license, or apply for Real ID,
with easy to access links for services (e.g., to renew driver’s license, update address
information, etc.)

2. Easy to find and make appointments at the right facility for the resident’s needs (e.g., for
drivers that need to take a driving test for their renewal, they could find facilities that offer
that service vs having to dig to know which facilities offer driving tests and which don’t)

3. Provide personalized checklists for documents required for their various needs (e.g.,
driver’s license renewal document needs differ for citizens versus non-citizens)

4. Secure resident portal to manage needs in a single place, optimizing for their
circumstances and allowing document upload for digital record keeping (e.g., having the
ability to store essential resident information updated in a secure portal, such as name,
address, phone number, etc.)

5. Enable residents to complete more steps of more services online, prioritizing critical
time at facility, in-person (e.g., enabling the written exam to be taken securely prior to the
facility visit – at home or otherwise)

6. Gather feedback and input from all users (residents and employees) on a regular
cadence to optimize process regularly (e.g., visit follow-up surveys, employee feedback
surveys, etc.)

7. Provide self-service type kiosks at facility to manage simple tasks (e.g., renewing a vehicle
sticker)

8. Offer a secure, digital employee portal for regular tasks (e.g., enabling the employee
to log time entry, vacation requests, review schedules, etc.)

9. Offer self-guided trainings for employees to find growth opportunities within IL SOS (e.g.,
trainings to enable employees to move into leadership roles or advance to other areas of
resident services)

Illinois Secretary of State Technology Modernization

March, 2023 Page 50
Technology Modernization: Full Report
7 – Closing statement

7 Closing statement
IL SOS currently delivers its 100+ services to residents using 1980s-era technology that has not
been updated for 15+ years. This causes unprecedented challenges today, as IT teams have
little capacity to do anything other than “keep the lights on”, and employees and residents face
pain points in delivering and receiving services. The risks that state is exposed to by not
modernizing SOS systems can be unprecedented and affect all its residents.

Looking ahead, pressures on this system could only increase, as the frequency and
sophistication of cyberattacks continues to grow, and the scale of digital services increases,
e.g., with Real ID.

Modernizing its technology could help IL SOS:

● Build strong defenses against cyberattacks so IL SOS could fulfill its mission as the State’s
identity provider and keeper of record

● Deliver the services Illinoisans need now and in future, to meet the growing demands
and expectations of residents who want to transact online
● Improve residents and employees’ experience with IL SOS to deepen public trust in the
State

The time to modernize is now, because

● The risk of cyberattacks continues to grow

● IL SOS is at risk of non-compliance with mandated services given the effort required to
update current systems

● IL SOS is rapidly losing institutional knowledge who can understand legacy systems written
in outdated technologies
● The costs and risks of the status quo could exponentially increase as legacy systems require
more and more upkeep

● Other states are setting new standards for digital services

To address these challenges, IL SOS could launch a modernization program that could
transform the ways in which SOS delivers services today, drive a step-change in operational
effectiveness and build trust for citizens in their government. This is an exciting step in SOS’
journey to its bold aspiration and mission.

Illinois Secretary of State Technology Modernization

March, 2023 Page 51
Technology Modernization: Full Report
8 – Methodology for report

8 Methodology for report

IL SOS launched a rapid assessment over a few weeks in February 2023 to understand the
current state of its technology and its impact on residents. Methods included

Source Description
Interviews with IL SOS IT Representatives from the following were interviewed
Department ● Director’s office
● Admin/Fiscal Staff
● Data Center Services
● Systems & Programming, Drivers and Vehicles
● Technical Services
● Web Services
Interviews with IL SOS Representatives from the following were interviewed
Department leads and ● Administrative Operations
Chief Deputies ● Business Services
● Downstate Operations
● Drivers Services
● External Affairs
● Index Services
● Public Services
● Vehicle Services
Site visits to multiple Observed processes, interviewed employees and residents in
facilities, interviews with facilities across the State (both North and South)
residents and employees
Technology current state Diagnostic survey shared with 50+ IL SOS employees, assessing
assessment technical services, capabilities, and infrastructure. Allows IL SOS
to compare its technology against a benchmark of 180+ other
organizations
Budget & fees analysis Analysis of IL SOS fees, budget and actual spend data from FY09-
FY23F

Illinois Secretary of State Technology Modernization

March, 2023 Page 52