Secretary of State Staff Test Report

Dominion Voting Systems Inc. Democracy Suite 5.19 Staff Report Prepared by: Secretary of State’s Office of Voting Systems Technology Assessment February 7, 2025 Table of Contents I. Introduction ......................................................................................... 1 1. Scope ................................................................................... 1 2. Summary of the Application ................................................. 1 3. Contracting and Outsourcing ............................................... 2 II. Summary of the System .................................................................... 2 1. Election Management System (EMS) 5.19 .......................... 2 2. Election Event Designer (EED) 5.19 .................................... 2 3. Results Tally Reporting (RTR) 5.19 ..................................... 2 4. Audio Studio 5.19……………………………………………….2 5. File System Service 5.19 ..................................................... 2 6. Data Center Manager 5.19 ................................................... 2 7. Application Server 5.19 ........................................................ 2 8. Election Data Translator 5.19 ............................................... 2 9. EMS Service 5.19 ................................................................ 3 10. ImageCast Evolution (ICE) 5.19 ........................................... 3 11. ImageCast Central (ICC) 5.19 .............................................. 3 12. ImageCast X (ICX) 5.19 ...................................................... 3 13. Adjudication Client 5.19 ...................................................... 3 14. Adjudication Services 5.19 ................................................... 3 15. ImageCast Precinct 2 (ICP2) 5.19 ........................................ 3 16. ImageCast Voter Activation (ICVA) 5.19 .............................. 3 III. Testing Information and Results ........................................................ 3 1. Background .......................................................................... 3 Functional Testing Summary ............................................... 4 2. Software Review Testing Summary ..................................... 6 3. Security and Telecommunications Testing Summary .......... 7 4. Volume Testing Summary .................................................... 9 5. 6. Usability, Accessibility & Privacy Testing Summary ............ 9 IV. Compliance with State and Federal Laws and Regulations ............... 11 1. Elections Code Requirements .............................................. 11 2. Elections Code Review ......................................................... 13 3. Review of Federal Statutes & Regulations ........................... 16 4. Help America Vote Act (HAVA) Requirements ..................... 18 V. Conclusion .......................................................................................... 18 I. INTRODUCTION 1. Scope This report presents the test results for all phases of the certification test of the Dominion Voting Systems Democracy Suite 5.19 voting system. The purpose of the testing is to test the compliance of the voting system with Federal law and California law and standards, including California Voting System Standards (CVSS). Testing also uncovers other findings, which do not constitute non- compliance, and those findings are reported to the voting system vendor to address the issues procedurally. The procedures for mitigating any additional findings are made to the documentation, specifically the Dominion Democracy Suite 5.19 Use Procedures. 2. Summary of the Application Dominion Voting Systems Inc. applied for the testing for certification of the Dominion Democracy Suite 5.19 voting system on August 29, 2023. The system is comprised of the following major components: • Election Management System (EMS) 5.19 • Election Event Designer (EDD) 5.19 • Results Tally Reporting (RTR) 5.19 • Audio Studio 5.19 • File System Service 5.19 • Data Center Manager 5.19 • Application Server 5.19 • Election Data Translator 5.19 • EMS Service 5.19 • ImageCast Evolution 5.19 • ImageCast Central 5.19 • ImageCast X 5.19 • Adjudication Client 5.19 • Adjudication Services 5.19 • ImageCast Precinct 2 5.19 • ImageCast Voter Activation 5.19 In addition to these major components, which includes the executable code and the source code, Dominion Voting Systems Inc. was required to submit the following: 1) the technical documentation package (TDP); 2) all the hardware components to field two complete working versions of the system, including all peripheral devices, one for the Functional Test Phase and one for the Security and Telecommunications Penetration Test Phase; 3) all the peripherals that 1 | Pa g e would be in the polling place; and 4) the Dominion Democracy Suite 5.19 Use Procedures. 3. Contracting and Consulting Upon receipt of a complete application, the Secretary of State released a Request for Quote for assistance with the Functional, Volume, Software (Source Code) Review, Security and Telecommunications (Red Team Penetration), Usability, Accessibility and Privacy Testing. Through the formal California contracting process, the Secretary of State awarded a contract to SLI Compliance (SLI), a division of Gaming Laboratories International, LLC, to serve in the capacity as the state-approved testing agency or expert technician to examine the voting system. II. SUMMARY OF THE SYSTEM The Dominion Democracy Suite 5.19 system consists of the following components: • The Dominion Democracy Suite 5.19 EMS represents a set of N-Tier software applications for pre-voting and post-voting election project activities that are applicable to jurisdictions of various sizes and geo- political complexities. • The Dominion Democracy Suite 5.19 Election Event Designer is a software component of the EMS that integrates election definition functionality and represents a main pre-voting phase end-user application. • The Dominion Democracy Suite 5.19 Results Tally Reporting is a software component of the EMS that integrates election results acquisition, validation, tabulation, reporting and publishing capabilities. • The Dominion Democracy Suite 5.19 Audio Studio is a software component of the EMS that represents an end-user helper application sued to record audio files for a given election project. • The Dominion Democracy Suite 5.19 File System Service is a software component of the EMS that is a stand-alone service that runs on client machines enabling access to low level operating system functions. • The Dominion Democracy Suite 5.19 Data Center Manager is a software component of the EMS that represents a system level configuration application. • The Dominion Democracy Suite 5.19 Application Server is a software component of the EMS that represents a server-side application responsible for executing long running processes such as rendering ballots. • The Dominion Democracy Suite 5.19 Election Data Translator is a software component of the EMS that represents an end-user application to export and import data to and from an election project. 2 | Pa g e • The Dominion Democracy Suite 5.19 EMS Service is a software component of the EMS that represents a service that provides EMS data to external applications such as Adjudication. • The Dominion Democracy Suite 5.19 ICE system employs a precinct-level optical scan ballot counter (tabulator) in conjunction with an external ballot box. This tabulator is designed to mark and/or scan paper ballots, interpret voting marks, communicate these interpretations back to the voter (either visually through the integrated LCD display or audibly via integrated headphones) and, upon the voter’s acceptance, deposit the ballots into the secure ballot box. • The Dominion Democracy Suite 5.19 ICC system consists of a central, high-speed, optical scan ballot counter (tabulator) called the ICC Ballot Counter and is used for processing absentee ballots (such as vote-by- mail). This ballot counter unit is based on commercial off-the-shelf (COTS) hardware coupled with custom-made ballot processing application software. It is used for high-speed, accurate, and reliable centralized scanning and counting of paper ballots. • The Dominion Democracy Suite 5.19 ICX ballot marking platform is used to create paper ballots. These ballots are later scanned and tabulated by the ICC optical ballot counter and/or scanned, verified, and cast by the ICE. • The Dominion Democracy Suite 5.19 Adjudication Client is a software component that allows on-screen adjudication of voted ballots. • The Dominion Democracy Suite 5.19 Adjudication Services is a collection of software services that interface with the Adjudication Client and EMS application service. • The Dominion Democracy Suite 5.19 ICP2 ballot counter device is a precinct optical scan ballot counter designed to provide three major functionalities: ballot scanning and tabulation, accessible voting, ballot review, and second chance voting. • The Dominion Democracy Suite 5.19 ImageCast Voter Activation Software version 5.19 Installed on a workstation or laptop at the polling place, that allows the poll workers to program smart cards for voters. The smart cards are used to activate voting sessions on ImageCast® X. III. TESTING INFORMATION AND RESULTS 1. Background The Secretary of State staff in conjunction with SLI, oversaw all phases of testing of the system, including Functional, Software Testing (Source Code Review), Security and Telecommunications (Red Team Penetration Testing), Volume, Usability, Accessibility and Privacy Testing. 3 | Pa g e 2. Functional Testing Summary System Configuration: The system is self-contained on an air gapped network, per the CVSS requirements. SLI performed the task of creating the Trusted Build of the Dominion Democracy Suite 5.19 voting system. The artifacts produced will be kept and distributed by the Secretary of State. Functional Testing Phase The Functional Testing consisted of following the Use Procedures to import the following seven (7) test elections in Table 1: Test Elections into the testing environment. The vote-by-mail ballots (VBM) and BMD ballots used for testing were marked using predetermined ballot marking patterns. Each election was tabulated using the IBML high speed scanner. Table 1: Test Elections Number Election Election Anomaly of Ballots Specific Resolution Type Identified Details English, 19 precincts, five parties, five Top-Two 1000 (330 contests, ten Gubernatorial VBM/10 choices, single- None N/A Primary BMD) sided 8.5” x 17” ballots, imprinted on HiPro scanner. English, 3,000 precincts, five 2000 (500 Gubernatorial contests, ten VBM/10 None N/A General choices, double BMD) sided 8.5” x 14” ballots. English and Spanish, ten precincts, eight party splits per 1700 (420 Presidential precinct, 20 VBM/10 None N/A Primary contests, 65 BMD) choices, double-sided 8.5” x 14” ballots. 4 | Pa g e English, Korean, Chinese, and 1000 (250 Vietnamese, Presidential VBM/50 ten precincts, None N/A General BMD) 12 contests, double-sided multi-card 8.5” x 11” ballots. English, Ilocano, Tagalog, and Thai, one ballot style, two contests, six to Ranked 250 (80 twelve Choice VBM// 11 candidates, None N/A Voting BMD) four write-ins for the multi seat, one write- in for the single seat, double sided 8.5” x 11” ballots. English, Khmer, Japanese, and 3300 Hindi, one Special (1000 precinct, one Recall None N/A VBM/ 10 contest, 135 Election BMD) choices, one write-in, double sided 8.5” x 21” ballots. The HiPro motherboard The HiPro was replaced, Built from scanner and a code scratch, motherboard update was 200 (35 English, single failed, and an made to correct VBM/ 30 and multiple issue was Special Local the Cannon BMD/7 seat RCV encountered Election scanner Hand Election, one with the imprinter issue. Marked) ballot style, five imprinter Regression contests, two to functionality for testing was ten candidates. the Cannon performed to scanner. validate the resolutions. 5 | Pa g e The Dominion Democracy Suite 5.19 voting system can support any language, provided that the necessary fonts and audio files are uploaded onto the Election Management System (EMS). The following languages, with their corresponding fonts and audio files, are pre-installed in the system • Burmese • Hindi • Spanish • Cambodian/ • Japanese • Thai Khmer • Khmer • Vietnamese • Chinese • Korean • Hispanic • Filipino • Laotian (Spanish) • Gujarati • Panjabi Marginal marks were purposely made to some ballots to test out stacking functionality. The following tools were used: • Yellow highlighter • Blue ink • Pencil • Dry erase marker • Black ink • Black sharpie marker The system is designed to detect marks that encompass a lower and upper threshold, defined for the tabulator prior to each election, of the target marking area (circle) on ballots. This threshold setting is adjustable. Each writing tool performed as expected. 3. Software Testing (Source Code Review) Summary The review was conducted by SLI. SLI evaluated the security and integrity of the voting system by identifying any security vulnerabilities that could be exploited to: • Alter vote recording, • Alter vote results, • Alter critical data (such as audit logs), or • Conduct a “denial of service” attack on the voting system. SLI’s review of the Dominion Democracy Suite 5.19 source code against the applicable standards of the CVSS in sections 5 and 7 determined the following discrepancies were found in the source code Table 3: Dominion Democracy Suite 5.19 Source Code Findings: 6 | Pa g e Table 3: Source Code Findings Issue Consultant Assessment Mitigation Manual verification found this to only be exploitable by someone One improper error with extensive knowledge of the handling source The issue was system, such as a vendor insider, code vulnerability determined to be of low and that the issue can be prevented was found to be an severity and have by ensuring proper use procedures issue within the ICX minimal impact on the are implemented and followed. source code base operation of the system. Dominion has committed to reviewed. resolving this in the next version of their system. 4. Security and Telecommunications (Red Team Penetration) Testing Security and Telecommunications (Red Team Penetration) testing of the Dominion Democracy Suite 5.19 system was conducted in June and July of 2024 by SLI. The Security and Telecommunications testing resulted in the following findings requiring a resolution, response and/or mitigation. Each is described in Table 4: Security Findings: Table 4: Security Findings Note: All findings are considered by SLI to have either no impact on system security or are limited to a low severity risk classification. However, Dominion is committed to resolving these findings in the next version of the system. Issue Status Consultant Assessment Vendor Mitigation 2.1.1(b) All systems shall provide system Testing resulted in the Users can check the Event functions that requirement being Viewer to confirm event are executable identified as partially met logging status and user only in the as certain components Mitigated actions. Testing verified that intended could be configured to this method also reveals manner and prevent the Event Log any associated error order, and only from recording data as messages. under the expected. intended conditions. 7 | Pa g e Table 4: Security Findings, Continued Issue Status Consultant Assessment Vendor Mitigation 2.1.1(c) All systems shall use the Testing resulted in the system's Users can check the Event requirement being control logic to Viewer to confirm event identified as partially met prevent a logging status and user as certain components system function Mitigated actions. Testing verified that could be configured to from executing this method also reveals prevent the Event Log if any any associated error from recording data as preconditions messages. expected. to the function have not been met. Testing concluded that the system’s 2.1.5.1(e) Users can check the Event configuration was Voting system Viewer to confirm event insufficient to fully meet equipment logging status and user the requirement as shall log all Mitigated actions. Testing verified that certain components could normal and this method also reveals be configured to prevent abnormal any associated error the Event Log from events. messages. recording data as expected. Testing concluded that the system’s 2.1.5.1(e)(i) Users can check the Event configuration was Voting system Viewer to confirm event insufficient to fully meet equipment logging status and user the requirement as shall ensure Mitigated actions. Testing verified that certain components could that event this method also reveals be configured to prevent logging cannot any associated error the Event Log from be disabled. messages. recording data as expected. Testing concluded that the system’s Users can check the Event configuration was Viewer to confirm event insufficient to fully meet 5.4.3 In- logging status and user the requirement as process Audit Mitigated actions. Testing verified that certain components could Records this method also reveals be configured to prevent any associated error the Event Log from messages. recording data as expected. 8 | Pa g e Table 4: Security Findings, Continued Issue Status Consultant Assessment Vendor Mitigation Non-voter-facing Documented and verified components were procedural mitigations have observed to contain 7.5.3 Context been provided instructing operating system account of OEVT Mitigated users to limit account usage configurations with a Testing to non-administrative user single user account that accounts during day-to-day contained administrative usage. privileges. 5. Volume Testing Summary The Volume Test simulates conditions in which ballot marking devices would be used on Election Day. Twenty (20) ICE combination BMD/precinct tabulation units, twenty (20) ICX BMD units, and twenty (20) ICP2 precinct tabulation units were tested during the volume test. Over two (2) days, twenty-five (25) temporary workers marked (50) ballots per BMD device and casted over 1000 ballots per precinct scanning device. The devices were each loaded with a California Presidential Primary Election, including all supported languages, with complete audio files for the testers to choose from. The testing resulted in the following findings as described in Table 5: Volume Testing Issue Log: Table 5: Volume Testing Issue Log Issue Description Vendor Response Fifteen ICP2 devices experienced ballot Documented and verified procedural jams when write-in ballots were diverted to mitigations have been provided instructing the diverter ballot bag and the ballot would users to manually expand the diverter get caught on the diverter ballot bag as the ballot bag or remove the bag entirely to bag was not expanded prior to testing. resolve the issue. Six ICE devices experienced errors related Per Dominion, the scanner properly to marking the ballot, displaying the rejected the ballot as the system operated message, 'Marking of the ballot was correctly. If the ballot marking device interrupted due to the error condition (error detects a misalignment, it will not mark the marking ballot).' When users selected the ballot and will return it with this error 'Yes' option, the ballot was rejected. A new message. ballot was then inserted to be marked and cast. 9 | Pa g e Table 5: Volume Testing Issue Log, Continued Issue Description Vendor Response Per Dominion, the scanner properly rejected the ballot as the system operated correctly. An obstruction in the device's One ICE device experienced an error inkjet printer caused one mark to be related to the marking of the ballot, where misplaced. The device automatically one mark was placed outside the intended recalibrated itself, which is why the oval. The ballot was subsequently remainder of the ballot was correctly rejected, and a new one was inserted to aligned except for the single erroneous be marked and cast. mark. The system compares the printed ballot to the voter's on-screen selections, detects any discrepancies, and rejects the ballot if an error is found. 6. Accessibility, Usability and Privacy Testing Summary The Accessibility, Usability and Privacy testing took place over two days, June 20 to 21, 2024 with five (5) volunteer testers from the accessibility community. The BMD devices used for this test were programmed with a California Presidential General Election. Each volunteer tester was asked to complete a ballot on their own, with assistance provided as requested. Upon completion of the session, volunteer testers were asked to participate in a post-test survey regarding their experience. The survey results are included in Table 6: Accessibility Survey. Table 6: Accessibility Survey Tester Survey Results Vendor Response The system is designed to be The text instructions should be flexible and allows jurisdictions to updated to include the yellow customize messaging and button update and should be instructions to enhance user Testers 1 emphasized in the on-screen experience. Jurisdictions can instructions and with poll include any on-screen workers. instructions to enhance the user’s experience. This feature will undergo thorough evaluation and testing Improvement to the text to with accessibility resources. If a Tester 3 speech technology would be viable solution is identified, it will helpful. be implemented in a future version. The system is designed to be flexible and allows jurisdictions to Reduction in repetitive audio Tester 4 customize messaging and instructions would be helpful. instructions to enhance user experience. Jurisdictions can 10 | P a ge reduce or remove audio instructions as desired. The system is designed to be flexible and allows jurisdictions to Guidance on how to review your customize messaging and Tester 5 ballot at the end would be instructions to enhance user helpful. experience. Jurisdictions can add audio or on-screen instructions as desired. The system is designed to be flexible and allows jurisdictions to Better audio and visual prompts customize messaging and regarding the need to double Tester 5 instructions to enhance user select letters when during the experience. Jurisdictions can add write-in process would be helpful. audio or on-screen instructions as desired. IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS 1. California Elections Code Requirements Six (6) sections of the California Elections Code, Sections 19101, 19203, 19204, 19204.5, 19205, and 19270, describe in detail the requirements any voting system must meet in order to be approved for use in California elections. These sections are described in detail and analyzed for compliance below. a) §19101(b)(1): The machine or device and its software shall be suitable for the purpose for which it is intended. - The system meets this requirement. b) §19101(b)(2): The system shall preserve the secrecy of the ballot. - The system meets this requirement. Vote-by-mail and BMD ballots can both be secretly cast. c) §19101(b)(3): The system shall be safe from fraud or manipulation. - The system meets this requirement. The tabulation system is wholly contained within an air-gapped environment, in addition to the Use Procedures prescribing strict chain of custody requirement, including the use of tamper evident seals, port security locks, and physical security mitigations/best practices. 11 | P a ge d) §19101 (b)(4): The system shall be accessible to voters with disabilities pursuant to section 19242 and applicable federal laws. - The system meets this requirement. Accessibility testing conducted with members of the accessibility community verified that the system is accessible and voters with accessibility needs can cast a ballot privately and independently. e) §19101 (b)(5): The system shall be accessible to voters who require assistance in a language other than English if the language is one in which a ballot or ballot materials are required to be made available to voters pursuant to Section 14201 and applicable federal laws. - Dominion Democracy Suite 5.19 supports 14201 languages. The system can add additional languages, to produce ballots or ballot materials, and accessible audio files pursuant to Section 14201, utilizing system functionality and outside translation. f) §19203: The system shall use ballot paper that is of sufficient quality that it maintains its integrity and readability throughout the retention period specified in sections 17300 through 17306. - The system meets this requirement. g) §19204: The system shall not include features that allow a voter to produce, and leave the polling place with, a copy or facsimile of the ballot cast by that voter at that polling place. - The system meets this requirement as the ballot marking devices retain the ballots, in the integrated ballot box, upon casting. h) §19204.5: The Secretary of State shall not certify or conditionally approve a voting system that cannot facilitate the conduct of a ballot level comparison risk-limiting audit. - The system meets this requirement. The systems components in addition to processes and procedures prepare ballots during the tabulation process for a risk-limiting audit. i) §19205 (a): No part of the voting system shall be connected to the internet at any time. - The system meets this requirement. No components of the voting system are connected to the internet. The system operates in a wholly contained air-gap environment. 12 | P a ge j) §19205 (b): No part of the voting system shall electronically receive or transmit election data through an exterior communication network, including the public telephone system, if the communication originates from or terminates at a polling place, satellite location, or counting center. - The system meets this requirement. No components of the voting system are connected to the internet. The system operates in a wholly contained air-gap environment. k) §19205 (c)(1): No part of the voting system shall receive or transmit wireless communications or wireless data transfers. - The system meets this requirement. No components of the voting system have the capability, including optional capability to communicate wirelessly. The system operates in a wholly contained air-gap environment. l) §19205 (c)(2): A network connection to any device not directly used and necessary for voting system functions shall not be established. Communication by or with any component of the voting system by wireless or modem transmission at any time is prohibited. A component of the voting system, or any device with network connectivity to the voting system, shall not be connected to the internet, directly or indirectly, at any time. - The system meets this requirement. No components of the voting system have the capability, including optional capability to communicate wirelessly. The system operates void of internet connectivity. m) §19205 (d): The voting system shall be used in a configuration of parallel central election management systems separated by an air-gap that includes; (A) a permanent central system known to be running unaltered, certified software and firmware that is used solely to define elections and program voting equipment and memory cards, (B) a physically isolated duplicate system, reformatted after every election to guard against the possibility of infection, that is used solely to read memory cards containing vote results, accumulate and tabulate those results, and produce reports, and (C) a separate computer dedicated solely to this purpose that is used to reformat all memory devices before they are connected to the permanent system again.. - The system meets this requirement. 2. Elections Code Review a) §305.5(b): A paper cast vote record is a ballot only if the paper cast vote record is generated on a voting device or machine that complies with ballot layout requirements and is tabulated by a separate device from the 13 | P a ge device that created the paper cast vote record. - The system meets this requirement. b) §15360: During the official canvass of every election in which a voting system is used, the elections official shall conduct a public manual tally of the ballots tabulated by those devices using either; (A) a public manual tally of the ballots canvassed in the semifinal official canvass, including vote by mail ballots, cast in 1 percent of the precincts chosen at random by the elections official, or (B) a two-part public manual tally including a public manual tally of the ballots canvassed in the semifinal official canvass, excluding vote by mail ballots, cast in 1 percent of the precincts chosen at random, and a public manual tally of not less than 1 percent of the vote by mail ballots canvassed in the semifinal official canvass. - The system meets this requirement. c) §19300: A voting machine shall, except at a direct primary election or any election at which a candidate for voter-nominated office is to appear on the ballot, permit the voter to vote for all the candidates of one party or in part for the candidates of one party and in part for the candidates of one or more other parties. - The system meets this requirement. d) §19301: A voting machine shall provide in the general election for grouping under the name of the office to be voted on, all the candidates for the office with the designation of the parties, if any, by which they were respectively nominated. The designation may be by usual or reasonable abbreviation of party names. - The system meets this requirement. e) §19302: The labels on voting machines and the way in which candidates’ names are grouped shall conform as nearly as possible to the form of ballot provided for in elections where voting machines are not used. - The system meets this requirement. f) §19303: If the voting machine is so constructed that a voter can cast a vote in part for presidential electors of one party and in part for those of one or more other parties or those not nominated by any party, it may also be provided with: (a) one device for each party for voting for all the presidential electors of that party by one operation, (b) a ballot label therefore containing only the words “presidential electors” preceded by the name of the party and followed by the names of its candidates for the offices of President and Vice President, and (c) a registering device 14 | P a ge therefore which shall register the vote cast for the electors when thus voted collectively. If a voting machine is so constructed that a voter can cast a vote in part for delegates to a national party convention of one party and in part for those of one or more other parties or those not nominated by any party, it may be provided with one device for each party for voting by one operation for each group of candidates to national conventions that may be voted for as a group according to the law governing presidential primaries. No straight party voting device shall be used except for delegates to a national convention or for presidential electors. - The system meets this requirement. g) §19304: A write-in ballot shall be cast in its appropriate place on the machine, or it shall be void and not counted. - The system supports this requirement. h) §19320: Before preparing a voting machine for any general election, the elections official shall mail written notice to the chairperson of the county central committee of at least two of the principal political parties, stating the time and place where machines will be prepared. At the specified time one representative of each of the political parties shall be afforded an opportunity to see that the machines are in proper condition for use in the election. The party representatives shall be sworn to perform faithfully their duties but shall not interfere with the officials or assume any of their duties. When a machine has been so examined by the representatives, it shall be sealed with a numbered metal seal. The representatives shall certify to the number of the machines, whether all of the counters are set at zero (000), and the number registered on the protective counter and on the seal. - The system supports this requirement. i) §19321: The elections official shall affix ballot labels to the machines to correspond with the county voter information guide for the election. He or she shall employ competent persons to assist him or her in affixing the labels and in putting the machines in order. Each machine shall be tested to ascertain if it is operating properly. - The system supports this requirement. j) §19322: When a voting machine has been properly prepared for an election, it shall be locked against voting and sealed. After that initial preparation, a member of the precinct board or some duly authorized person, other than the one preparing the machines, shall inspect each machine and submit a written report. The report shall note the following: 15 | P a ge (1) Whether all of the registering counters are set at zero (000), (2) whether the machine is arranged in all respects in good order for the election, (3) whether the machine is locked, (4) the number on the protective counter, (5) the number on the seal. The keys shall be delivered to the election board together with a copy of the written report, made on the proper blanks, stating that the machine is in every way properly prepared for the election. - The system supports this requirement. k) §19340: Any member of a precinct board who has not previously attended a training class in the use of the voting machines and the duties of a board member shall be required to do so, unless appointed to fill an emergency vacancy. - The system does not adversely impact this requirement. l) §19341: The precinct board shall consist of one inspector and two judges who shall be appointed and compensated pursuant to the general election laws. One additional inspector or judge shall be appointed for each additional voting machine used in the polling place. - The system does not adversely impact this requirement. m) §19360: Before unsealing the envelope containing the keys and opening the doors concealing the counters the precinct board shall determine that the number on the seal on the machine and the number registered on the protective counter correspond to the numbers on the envelope. Each member of the precinct board shall then carefully examine the counters to see that each registers zero (000). If the machine is provided with embossing, printing, or photography devices that record the readings of the counters the board shall, instead of opening the counter compartment, cause a “before election proofsheet” to be produced and determined by it that all counters register zero (000). If any discrepancy is found in the numbers registered on the counters or the “before election proofsheet” the precinct board shall make, sign, and post a written statement attesting to this fact. In filling out the statement of return of votes cast, the precinct board shall subtract any number shown on the counter from the number shown on the counter at the close of the polls. - The system supports this requirement. n) §19361: The keys to the voting machines shall be delivered to the precinct board no later than 12 hours before the opening of the polls. They shall be in an envelope upon which is written the designation and location of the election precinct, the number of the voting machine, the number on the 16 | P a ge seal, and the number registered on the protective counter. The precinct board member receiving the key shall sign a receipt. The envelope shall not be opened until at least two members of the precinct board are present to determine that the envelope has not been opened. At the close of the polls the keys shall be placed in the envelope supplied by the official and the number of the machine, the number of the seal, the number registered on the protective counter, shall be written on the envelope. - The system supports this requirement. o) §19362: The exterior of the voting machine and every part of the polling place shall be in plain view of the election precinct board and the poll watchers. Each machine shall be at least four feet from the poll clerk’s table. - The system supports this requirement. 3. Review of Federal Statutes or Regulations. a) The Voting Rights Act (VRA) of 1965, as amended (42 U.S.C. 1973), requires all elections in certain covered jurisdictions to provide registration and voting materials and oral assistance in the language of a qualified language minority group in addition to English. Currently in California, there are eleven VRA languages (English, Spanish, Cambodian, Chinese, Hindi, Japanese, Khmer, Korean, Tagalog, Thai, and Vietnamese) as prescribed under the law. - The system meets this requirement. The system’s paper ballots can be easily printed in these languages, as well as many others. Further, the BMD can be programmed to display the ballot in any of these languages on the touch screen interface and to provide audio instruction in any of these languages. b) The National Voter Registration Act of 1993 (42 U.S.C. 1973gg and 11 CFR 8) allows for the casting of provisional ballots through Fail-Safe Voting procedures. - The system meets this requirement. Provisional ballots can easily be cast with this system. The BMD only marks ballots (or verifies the marking of a ballot), it has no impact on provisional voting. c) The Voting Accessibility for the Elderly and Handicapped Act of 1984 (42 U.S.C. 1973ee through 1973ee-6) requires each political subdivision 17 | P a ge conducting elections within each state to assure that all polling places for federal elections are accessible to elderly and handicapped voters, except in the case of an emergency as determined by the state’s chief election officer or unless the state’s chief election officer: (1) determines, by surveying all potential polling places, that no such place in the area is accessible or can be made temporarily accessible, and (2) assures that any handicapped voter assigned to an inaccessible polling place will, upon advance request under established state procedures, either be assigned to an accessible polling place or be provided an alternative means of casting a ballot on election day. - This system supports this requirement. d) The Retention of Voting Documentation (42 U.S.C. 1974 through 1974e) statute applies in all jurisdictions and to all elections in which a federal candidate is on a ballot. It requires elections officials to preserve for 22 months all records and papers which came into their possession relating to an application, registration, payment of a poll tax, or other act requisite to voting. Note: The US Department of Justice considers this law to cover all voter registration records, all poll lists and similar documents reflecting the identity of voters casting ballots at the polls, all applications for absentee ballots, all envelopes in which absentee ballots are returned for tabulation, all documents containing oaths of voters, all documents relating to challenges to voters or absentee ballots, all tally sheets and canvass reports, all records reflecting the appointment of persons entitled to act as poll officials or poll watchers, and all computer programs used to tabulate votes electronically. In addition, it is the Department of Justice’s view that the phrase “other act requisite to voting” requires the retention of the ballots themselves, at least in those jurisdictions where a voter’s electoral preference is manifested by marking a piece of paper or by punching holes in a computer card. - This system meets this requirement. All votes in this system are recorded on paper ballots that can be easily retained. 4. Help America Vote Act (HAVA) Requirements The Help America Vote Act (HAVA) §301(a) mandates several requirements for voting systems, including: 1) The ability to verify the vote choices on the ballot before that ballot is cast and counted, 2) Notification to the voter of over-votes on a ballot, 18 | P a ge 3) Auditability with a permanent paper record of votes cast, 4) Accessibility for individuals with disabilities, including nonvisual accessibility for the blind and visually impaired, in a manner that provides the same opportunity for access and participation (including privacy and independence) − This system supports these requirements in the following manner: a) The paper ballots themselves lend themselves to visual inspection and verification. b) The BMD provides its users with a ballot review screen prior to printing the ballot. Further, any voted ballot can be inserted into the unit for review and verification. c) The BMD prevents over-voting a contest. d) Because all ballots in this system are paper based, there is a fully auditable and permanent record of the election. e) Deployment of the BMD in a precinct provides accessibility for persons with disabilities at the polling place. V. CONCLUSION The Dominion Democracy Suite 5.19 voting system meets applicable California, HAVA and Federal Elections laws. The system does however have some remaining findings, which Dominion Voting Systems Inc. has addressed, in the appropriate mitigation areas of this report. Dominion Voting Systems Inc. provided responses and/or mitigations to those findings, which will be evaluated by the California Secretary of State. 19 | P a ge