Staff Report

A P LEX ADILLA |SECRETARY OF STATE | STATE OF CALIFORNIA OFFICE OF VOTING SYSTEMS TECHNOLOGY ASSESSMENT 1500 11th Street | Sacramento, CA 95814 | Tel 916.695.1680 | Fax 916.653.4620 | www.sos.ca.gov Election Systems & Software Electronic Voting System (EVS) 6.0.4.2 DS200 Precinct Scanner v2.20.0.0, Hardware v1.3 DS450 Central Scanner v3.3.0.0, Hardware v1.0 DS850 Central Scanner v3.3.0.0, Hardware v1.0 ExpressVote v2.5.0.0, Hardware v2.1 ExpressVote XL v1.2.0.0, Hardware v1.0 Electionware Election Management System v5.3.0.0 Staff Report Prepared by: Secretary of State’s Office of Voting Systems Technology Assessment August 21, 2019 Table of Contents I. Introduction .....................................................................................................1 1. Scope ...............................................................................................1 2. Summary of the Application ...........................................................1 3. Contracting and Outsourcing ..........................................................1 II. Summary of the System .................................................................................2 1. DS200 Precinct Scanner v2.20.0.0, Hardware v1.3 ........................2 2. DS450 Central Scanner v3.3.0.0, Hardware v1.0 ...........................2 3. DS850 Central Scanner v3.3.0.0, Hardware v1.0 ...........................2 4. ExpressVote v2.5.0.0, Hardware v2.1 ............................................2 5. ExpressVote XL v1.2.0.0, Hardware v1.0 ......................................2 6. Electionware Election Management System, v5.3.0.0 ...................2 III. Testing Information and Results ....................................................................3 1. Background .....................................................................................3 2. Functional Testing Summary ..........................................................3 3. Software Review Testing Summary ...............................................6 4. Security and Telecommunications Testing Summary ....................6 5. Volume Testing Summary ..............................................................9 6. Usability, Accessibility & Privacy Testing Summary ...................10 IV. Compliance with State and Federal Laws and Regulations............................11 1. Elections Code Requirements ..........................................................11 1. Elections Code Review ....................................................................12 2. Federal Statutes Review ...................................................................15 3. HAVA Requirements .......................................................................16 V. Conclusion .......................................................................................................17 I. INTRODUCTION 1. Scope This report presents the test results for all phases of the certification test of the Election Systems and Software (ES&S) Electronic Voting System (EVS) 6.0.4.2 voting system. The purpose of the testing is to test the compliance of the voting system with California and Federal laws. Testing also uncovers other findings, which do not constitute non- compliance, and those findings are reported to the voting system vendor to address the issues procedurally. The procedures for mitigating any additional findings are made to the documentation, specifically the ES&S EVS 6.0.4.2 Use Procedures. 2. Summary of the Application Elections Systems and Software Inc. submitted an application for the EVS 6.0.4.2 voting system on February 22, 2019. The system is comprised of the following major components: a) DS200 Precinct Scanner v2.20.0.0, Hardware v1.3 b) DS450 Central Scanner v3.3.0.0, Hardware v1.0 c) DS850 Central Scanner v 3.3.0.0, Hardware v1.0 d) ExpressVote v2.5.0.0, Hardware v2.1 e) ExpressVote XL v1.2.0.0, Hardware v1.0 f) Electionware Election Management System v5.3.0.0 In addition to these major components, which includes the executable code and the source code, ES&S was required to submit the following: 1) the technical documentation package (TDP); 2) all the hardware components to field two complete working versions of the system, including all peripheral devices, one for the Functional Test Phase and one for the Red Team Penetration Test Phase; 3) all the hardware components for the Volume Test Phase; 4) all the peripherals that would be in the polling place; and 5) the ES&S EVS 6.0.4.2 Use Procedures. 3. Contracting and Consulting Upon receipt of a complete application, the Secretary of State released a Request for Quote (RFQ) for assistance with the Security Review, both Source Code and Red Team Penetration testing. The statement of work (SOW) also had an option for the Secretary of State to use the awarded contractor for Functional testing, if it deemed necessary. Through the formal California contracting process, the Secretary of State awarded a contract to SLI Compliance (SLI). SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 1 | Page II. SUMMARY OF THE SYSTEM The system consists of six components: 1. DS200 Precinct Scanner v2.20.0.0, Hardware v1.3 The DS200 is a digital scan tabulator that scans and stores a full-page image of the ballot. Ballots can be fed in any orientation. During tabulation, the images are processed by proprietary mark recognition software. It is generally used to tabulate ballots in a polling place, but may be used as a central count device in small jurisdictions. 2. DS450 Central Ballot Scanner v3.3.0.0, Hardware v1.0 The DS450 is a high-speed digital scan ballot counter that scans and stores ballot images and is used in central count operations. During tabulation, the images are processed by proprietary mark recognition software. This tabulator can out stack under votes, over votes, blank ballots, write-in ballots and unreadable ballots into separate batches. 3. DS850 Central Ballot Scanner v3.3.0.0, Hardware v1.0 The DS850 is a high-speed digital scan ballot counter that scans and stores ballot images and is used in central count operations. During tabulation, the images are processed by proprietary mark recognition software. This tabulator can out stack under votes, over votes, blank ballots, write-in ballots and unreadable ballots into separate batches. 4. ExpressVote v2.5.0.0, Hardware v2.1 The ExpressVote is a touchscreen capture device. It combines paper-based voting and touchscreen technology, which produces an independent, voter-verifiable paper record that is scanned by ES&S tabulators such as the DS200 or DS850. 5. ExpressVote XL v1.2.0.0, Hardware v1.0 The ExpressVote XL is a touchscreen capture device. It combines paper-based voting and touchscreen technology, which produces an independent, voter-verifiable paper record that is scanned by ES&S tabulators such as the DS200 or DS850. 6. Election Management System (EMS) The election management system software package is composed of the following modules: a) Electionware, v5.3.0.0 Electionware is used by a jurisdiction to create the ballot definition for an election. Electionware is then used to program the various media used by the different vote counting components. After the election, Electionware is used to compile and tabulate election returns from throughout the jurisdiction. Finally Electionware contains a series of additional reporting functions. SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 2 | Page b) Event Log Service, v1.6.0.0 The Event Log Service logs user’s actions for the election management applications. It runs in the background, logging system events to the COTS Windows Event Viewer. The log can also be used to print audit log reports. c) Removable Media Service, v1.2.0.0 The Removable Media Service supports election media programming. d) ExpressVote Previewer, v2.5.0.0 The ExpressVote Previewer allows users to preview the presentation of election data on the ExpressVote and ExpressVote XL accessible devices prior to burning election media. e) PaperBallot, v5.3.0.0 The PaperBallot module is used for designing paper ballots for use with ES&S equipment. f) Dell PowerEdge T430 The Dell PowerEdge T430 is a tower server utilized as the Electionware election management system server. g) Dell Optiplex 5050 The Dell Optiplex 5050 is a desktop computer utilized as the Electionware election management system client. h) Dell Latitude 5580 The Dell Latitude 5580 is a laptop utilized as the Electionware election management system client. III. TESTING INFORMATION AND RESULTS 1. Background California certification testing of this system was conducted by Secretary of State staff in conjunction with the State’s technical consultant, SLI, from May 13 to July 19, 2019. During each phase of testing, with the exception of Source Code and Red team testing, representatives from ES&S were present to observe and answer any questions that arose. 2. Functional Testing Summary System Configuration: Preparation for Functional Testing and all subsequent testing began on May 13, 2019. The configuration of the equipment, using trusted builds from SLI. The first round of equipment configuration was conducted at the Secretary of State’s office in Sacramento, California from May 13 to May 15, 2019. The second round of equipment configuration was conducted from May 29 to May 31, 2019. ES&S provided two (2) servers (Dell PowerEdge T430), two (2) test workstations (Dell Optiplex 5050) for use as election management system clients and two (2) standalone workstations (Dell Latitude 5580) to serve as election management system clients. SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 3 | Page ES&S also provided two (2) DS850s, two (2) DS450s, two (2) ExpressVotes, two (2) ExpressVote XLs, and six (6) DS200 machines. For approximately one week, test consultants built the test environment utilizing the vendor provided procedures, which included installation of the operating system, commercial-off-the-shelf (COTS) software, voting system trusted build software, and hardening of each system using ES&S’s documented process. Firmware updates for the DS850, DS450, ExpressVote, ExpressVote XL, and DS200 machines were also loaded using the vendor provided procedures. During the first configuration build, May 13 through May 15, 2019, 101 issues were identified. All 101 issues required mitigation as follows: a. Documentation 97 issues were related to documentation discrepancies, which were given to ES&S for modification. The documentation was subsequently modified and the changes verified by Secretary of State staff. b. Electionware Election Management System (EMS) One (1) issue occurred with the ES&S Electionware EMS software. The incorrect Electionware license was initially provided by ES&S. ES&S obtained the appropriated license and the license was replaced on all machines. c. Dell PowerEdge T430 Server One (1) issue occurred with the T430 server during installation. The T430 server failed to enable BitLocker. An initial investigation determined it was unclear whether the issue was procedural or related to the hardware. The first configuration build was halted. It was determined that the voting system vendor installation document did not provide adequate instruction to complete the installation process. The documentation was subsequently modified and the changes verified by the Secretary of State staff. d. DS450 One (1) issue occurred with one DS450 machine during installation. The image failed to reformat on two attempts. The issue was regarding the locking compact flash card with firmware already on it. The card could not be unlocked and cleared. To resolve the issue, testing continued utilizing one machine with the locking card as provided by ES&S and one machine with a non-locking/blank card with the firmware loaded by SLI. e. DS200 One (1) issue occurred regarding the DS200 during installation. DS200 #6 (DS0314340701) failed to complete an update. The c-fast card was removed and a new card was created. Due to security parameters, the old card was married to the machine and the new card fried the motherboard, as it is intended to. ES&S had a replacement machine delivered on May 16, 2019. During the second configuration build, May 29 through May 31, 2019, twelve (12) issues were identified. All twelve (12) issues required mitigation as follows: SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 4 | Page a. Documentation Twelve (12) issues were related to minor documentation discrepancies, which were given to ES&S for modification. The documentation was subsequently modified and the changes verified by the Secretary of State staff. Test Elections: Functional testing of the system included utilization of the vendor provided Use Procedures to administer test elections. The administration of test elections took place at the Secretary of State’s office in Sacramento, California, from May 31 through June 4, 2019. The testing included five (5) different election types: Vote Center, Rank Choice Vote, Primary, General, and Recall Elections. During administration of the test elections, fifty-four (54) issues were identified. All fifty-four (54) issues required mitigation as follows: a. Documentation Fifty-one (51) issues were related to minor documentation discrepancies, which were given to ES&S for modification. The documentation was subsequently modified and the changes verified by the Secretary of State staff. b. ExpressVote XL Two (2) issues were related to the ExpressVote XL. One Universal Voting Console (UVC) assistive audio-tactile keypad device did not function properly. The device was replaced and the issue did not persist. It was determined that the device was faulty as three identical UVC devices were utilized throughout functional testing and performed flawlessly. Further, 30 additional UVC devices, identical to the ones utilized in functional testing, were exercised during volume testing and no anomalies were encountered. On one occasion, while utilizing the sip ‘n’ puff (SNP) assistive technology, the machine froze when the tester accidentally entered an incorrect letter and attempted to utilize the backspace functionality with the SNP. The machine was re-set and the tester attempted to re-create the issue 10 times but was unable to recreate the issue. ES&S has added a note in their troubleshooting document that a reset may be necessary if a machine freezes. c. Dell Optiplex 5050 Client Workstation On one occasion, when attempting to exercise the ExpressVote previewer on the standalone workstation, the tester encountered the following error message, “The display DPI must be set to 96 pixels per inch to run the Previewer.” The election was removed from the workstation and recreated by the tester. The tester attempted to re-create the issue but was unable to recreate the issue. It was determined that the voting system vendor installation document did not provide adequate instruction to complete the installation process. The documentation was subsequently modified and the changes verified by the Secretary of State staff. As noted with a previously certified version of this ES&S system, the system is capable of configuring a Rank Choice Vote election for single seat contest; however, SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 5 | Page the system cannot tabulate Rank Choice Vote results. The system does produce a “Cast Vote Record,” however the data produced must be manually tabulated to follow a Rank Choice Vote algorithm. Logic and Accuracy Testing: Functional Testing also consisted of exercising the Logic and Accuracy (L&A) of the EVS 6.0.4.2 voting system. L&A testing took place at the Secretary of State’s office in Sacramento, California, over the course of the Functional Testing process, from May 13 through June 4, 2019. ES&S provided ballots for each of the five (5) aforementioned election types: Vote Center, Rank Choice Vote, Primary, General, and Recall Elections. The ballots were created in accordance with the California Elections Code to ensure system compliance with all State mandates relating to ballot layout and design. Each ballot was marked with a pre-determined marking pattern to demonstrate the L&A of the DS850, DS450 and the DS200 tabulators. A marginal markings test was also administered to assess the tabulation devices’ ability to read varying negligible markings, simulating the markings received on vote by mail ballots during an election. Ballots containing exception conditions were resolved utilizing the electronic adjudication functionality of the system. In addition, the alternative language and accessibility capabilities of the EVS 6.0.4.2 voting system were exercised. Both the ExpressVote and ExpressVote XLs were tested to verify: a) Alternative language display. b) Alternative language printing. c) Audio ballot logic. d) Large font display. e) High contrast screen capability. f) Binary switch device compatibility. g) Sip and puff device compatibility. The accessible functionality of the system was further examined during accessibility and usability testing. Please refer to the Accessibility and Usability Testing Summary below for additional information regarding this test. After closing of the polls and tabulation of all ballots, final reports were generated and verified. This is to include, but is not limited to, the Secretary of State Statement of Vote (SOV) and Supplemental Statement of Vote (SSOV) reports. There were no issues identified during the L&A test. The SLI provided Functional Test report can be located on the Secretary of State’s website. 3. Source Code Review Testing Summary The Source Code Review was conducted by SLI at their office located in Denver, Colorado. SLI evaluated the voting system code base against the applicable California SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 6 | Page Voting System Stands (CVSS) requirements. SLI also evaluated the security and integrity of the code base, by identifying any security vulnerabilities that could be exploited. SLI identified zero (0) potential vulnerabilities and non conformities with industry programming standards within the EVS 6.0.4.2 code base. The SLI provided Source Code Review Test report can be located on the Secretary of State’s website. 4. Security and Telecommunications Testing Summary Security and Telecommunications Testing of the EVS 6.0.4.2 voting system was conducted by SLI. The Security and Telecommunications Testing consisted of a security audit and a penetration test assessment of the EVS 6.0.4.2 voting system and all of the respective components. The testing took place at the offices of SLI, in Denver, Colorado. SLI identified six (6) Security and Telecommunication vulnerabilities. Table 4A: 4. Security and Telecommunications Vulnerabilities lists both physical security vulnerabilities identified, along with the vendor provided mitigations: Table 4A: 4. Security and Telecommunications Vulnerabilities Issue Consultant Assessment Vendor Mitigation User access to Electionware is restricted through use of Windows User Account Management and Electionware’s integrated The built-in windows user account management. Two-factor shortcut key commands authentication is also in place to prevent an were not restricted and unauthorized actor from modifying the all user roles are able to Electionware system. Information regarding Electionware utilize windows shortcut these security features is provided in the keys to circumvent the ES&S document, Voting System Security start menu application Specifications. In addition, on-demand launch restrictions. validation of the Electionware system can be done by following the verification procedures in the Election Management System document. The password hashes utilized in the Electionware systems comply with NIST standards SHA-2 (i.e., SHA-224, SHA-256, The Electionware SHA-384, SHA-512, SHA-512/224 and systems indicated that SHA-512/256). NIST encourages there were password application and protocol designers to Electionware hashes stored in the implement SHA-256 at a minimum for any Secure File Transfer applications of hash functions requiring Protocol (SFTP) server interoperability. In addition, on-demand XML configuration files. validation of the Electionware system can be done by following the verification procedures in the Election Management System document. SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 7 | Page ES&S offers unique keys as an option upon customer request it. Most customers chose a ES&S EVS 6.0.4.2 single key configuration to reduce equipment has the same complexity of key management. Electionware key for every type of Additionally, information regarding device. physical security is covered in the ES&S provided document, Best Practices for Physically Securing ES&S Equipment. User access to Electionware is restricted through use of Windows User Account Management and Electionware’s integrated Users can circumvent user account management. Two-factor some or all of the authentication is also in place to prevent an Electionware system unauthorized actor from modifying the programs and features Electionware system. Information regarding Electionware restriction policies by these security features is provided in the launching operating ES&S document, Voting System Security system level components Specifications. In addition, on-demand via a command prompt. validation of the Electionware system can be done by following the verification procedures in the Election Management System document. Administrative access is protected using dual-factor authentication. The first defense is BitLocker encryption and the second defense is the use of strong passwords. It is also recommended by ES&S that access to The administrative user voting system equipment and software be has the ability to disable restricted to persons and staff who have Electionware the endpoint protection been appropriately approved and authorized software without according to the security policies and requiring a password. procedures dictated by the jurisdiction. Information regarding these security features, as well as recommended access control measures, is available in the ES&S document, Voting System Security Specifications. The OKI printers were configured with active ES&S will alter the default passwords on DHCP enabled Ethernet OKI Printer each printer and disable the Ethernet port ports and were prior to distribution to the customer. configured with default user credentials. The SLI provided Security and Telecommunications Test report can be located on the Secretary of State’s website. SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 8 | Page 5. Volume Testing Summary The Volume Test simulates conditions in which the system components would be used on Election Day. Volume testing of the EVS 6.0.4.2 voting system was conducted over two days at the ES&S office in Omaha, Nebraska on June 24 and June 25, 2019. Twenty-three (23) temporary workers were hired from a third party contractor. The equipment used in the testing consisted of twenty-five (25) DS200 tabulators, twenty-five (25) ExpressVotes, and thirty (30) ExpressVote XLs. Both the DS200 and ExpressVote are currently certified for use in California, with previous firmware version numbers. Machine and Ballot Count Hardware # of # of Ballots Ballot Total for All Component Machines per Machine Pages Machines DS200 25 1000 1 25,000 ExpressVote 25 50 1 1,250 ExpressVote XL 30 100 1 3,000 The DS200 experienced five (5) errors. All the errors were related to ballot jams and were isolated to one unit. The ballot jams were remedied and instructions to resolve such issues are covered in the vendor provided Use Procedures, which were also subject to validation and review during the testing process. The ExpressVote and ExpressVote XLs did not experience any errors during the Volume Test. Error Log Hardware Component Number of Errors DS200 5 ExpressVote 0 ExpressVote XL 0 The SLI provided Volume Test report can be located on the Secretary of State’s website. 6. Usability, Accessibility & Privacy Testing Summary Usability, Accessibility & Privacy Testing of the EVS 6.0.4.2 voting system took place on June 10 and June 11, 2019, at the California Secretary of State Auditorium. The EVS 6.0.4.2 system has the ExpressVote and ExpressVote XL to meet accessibility requirements in a polling place. Each device has a touchscreen interface, and auxiliary ports that can be used for such devices such as a sip and puff or a paddle switch. Both devices are capable of allowing a user to use an audio ballot or a visual presentation of the ballot. Both types of functionality can be used exclusively or simultaneously. The systems also have features to allow a voter to verify the selections made, by having the system read the selections back to the voter, or displaying the selections onscreen. Both also support write-ins and warnings for undervotes. SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 9 | Page Five (5) testers participated in Usability, Accessibility & Privacy Testing. Three (3) testers were visually impaired, one (1) tester had mobility impairments with limited range of motion, and one (1) tester’s disability was not apparent. All testers were given a post test interview to document their experiences utilizing the ExpressVote and ExpressVote XLs. Cumulative results of the surveys are listed below in Tables 6A and 6B. Table 6A: ExpressVote Post Test Survey Agree Agree Disagree Disagree N/A or No Strongly Somewhat Somewhat Strongly Opinion The voting method was 4 1 private. I feel I can use this system 4 1 to vote independently. I am confident that my vote 5 was recorded accurately. The voting instructions 3 2 were clear and complete. The voting method was 4 1 easy to use. I could read the display 3 2 easily. I could understand the 3 2 speech output. The assistive device(s) 4 1 were easy to reach and use. I found the system 1 2 2 confusing to use. The timeframe it took to 4 1 vote was what I expected. Table 6B: ExpressVote XL Post Test Survey Agree Agree Disagree Disagree N/A or No Strongly Somewhat Somewhat Strongly Opinion The voting method was 5 private. I feel I can use this system 3 1 1 to vote independently. I am confident that my vote 5 was recorded accurately. The voting instructions 3 1 1 were clear and complete. The voting method was 3 2 easy to use. I could read the display 2 3 easily. I could understand the 2 3 speech output. SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 10 | Page The assistive device(s) 2 2 1 were easy to reach and use. I found the system 1 3 1 confusing to use. The timeframe it took to 4 1 vote was what I expected. Specific comments and opinions regarding each tester’s experience, as well as individual responses can be found in the SLI provided Accessibility Test report, located on the Secretary of State’s website. IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS 1. Elections Code Requirements Six (6) sections of the California Elections Code, Sections 19101, 19203, 19204, 19204.5, 19205, and 19270, describe in detail the requirements any voting system must meet in order to be approved for use in California elections. These sections are described in detail and analyzed for compliance below. a) §19101 (b) (1): The machine or device and its software shall be suitable for the purpose for which it is intended. The system meets this requirement. b) §19101 (b) (2): The system shall preserve the secrecy of the ballot. The system meets this requirement. c) §19101 (b) (3): The system shall be safe from fraud or manipulation. The system is at least as secure as the previously certified version of this ES&S system. The addition of the DS450 precinct scanner, the ExpressVote XL to the system does not introduce new risks to fraud or manipulation. d) §19101 (b) (4): The system shall be accessible to voters with disabilities pursuant to section 19242 and applicable federal laws. The system meets this requirement. e) §19101 (b) (5): The system shall be accessible to voters who require assistance in a language other than English if the language is one in which a ballot or ballot materials are required to be made available to voters pursuant to Section 14201 and applicable federal laws. EVS 6.0.4.2 supports English, Japanese, Hindi, Korean, Chinese, Vietnamese, Spanish, Hmong, Tagalog, Panjabi, Armenian, Bengali, Persian and Arabic. The system is capable of adding additional languages, to produce ballots or ballot materials, and accessible audio files pursuant to Section 14201, utilizing system functionality and outside translation. SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 11 | Page f) §19203: The system shall use ballot paper that is of sufficient quality that it maintains its integrity and readability throughout the retention period specified in sections 1700 through 17306. The system meets this requirement. g) §19204: The system shall not include procedures that allow a voter to produce, and leave the polling place with, a copy or facsimile of the ballot cast by that voter at that polling place. The system meets this requirement. h) §19204.5: The Secretary of State shall not certify or conditionally approve a voting system that cannot facilitate the conduct of a ballot level comparison risk- limiting audit. The system meets this requirement. i) §19205 (a): No part of the voting system shall be connected to the internet at any time. The system meets this requirement. j) §19205 (b): No part of the voting system shall electronically receive or transmit election data through an exterior communication network, including the public telephone system, if the communication originates from or terminates at a polling place, satellite location, or counting center. The system meets this requirement. k) §19205 (c): No part of the voting system shall receive or transmit wireless communications or wireless data transfers. The system meets this requirement. l) §19270 (a): The Secretary of State shall not certify or conditionally approve a direct recording electronic voting system unless the system includes an accessible voter verified paper audit trail. The system meets this requirement. 2. Elections Code Review a) §305.5(b): A paper cast vote record is a ballot only if the paper cast vote record is generated on a voting device or machine that complies with ballot layout requirements and is tabulated by a separate device from the device that created the paper cast vote record. The system meets this requirement. b) §15360: During the official canvass of every election in which a voting system is used, the official conducting the election shall conduct a public manual tally of the ballots tabulated by those devices cast in one percent of the precincts chosen at random by the elections official. If one percent of the precincts should be less than one whole precinct, the tally shall be conducted in one precinct chosen at random by the elections official. SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 12 | Page In addition to the one percent count, the elections official shall, for each race not included in the initial group of precincts, count one additional precinct. The manual tally shall apply only to the race not previously counted. The system fully supports this requirement. c) §19300: A voting machine shall, except at a direct primary election or any election at which a candidate for voter-nominated office is to appear on the ballot, permit the voter to vote for all the candidates of one party or in part for the candidates of one party and in part for the candidates of one or more other parties. The system meets this requirement. d) §19301: A voting machine shall provide in the general election for grouping under the name of the office to be voted on, all the candidates for the office with the designation of the parties, if any, by which they were respectively nominated. The designation may be by usual or reasonable abbreviation of party names. The system meets this requirement. e) §19302: The labels on voting machines and the way in which candidates’ names are grouped shall conform as nearly as possible to the form of ballot provided for in elections where voting machines are not used. The system meets this requirement. f) §19303: If the voting machine is so constructed that a voter can cast a vote in part for presidential electors of one party and in part for those of one or more other parties or those not nominated by any party, it may also be provided with: (a) one device for each party for voting for all the presidential electors of that party by one operation, (b) a ballot label therefore containing only the words “presidential electors” preceded by the name of the party and followed by the names of its candidates for the offices of President and Vice President, and (c) a registering device therefore which shall register the vote cast for the electors when thus voted collectively. If a voting machine is so constructed that a voter can cast a vote in part for delegates to a national party convention of one party and in part for those of one or more other parties or those not nominated by any party, it may be provided with one device for each party for voting by one operation for each group of candidates to national conventions that may be voted for as a group according to the law governing presidential primaries. No straight party voting device shall be used except for delegates to a national convention or for presidential electors. The system meets this requirement. g) §19304: A write-in ballot shall be cast in its appropriate place on the machine, or it shall be void and not counted. The system supports this requirement. h) §19320: Before preparing a voting machine for any general election, the elections official shall mail written notice to the chairperson of the county central SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 13 | Page committee of at least two of the principal political parties, stating the time and place where machines will be prepared. At the specified time, one representative of each of the political parties shall be afforded an opportunity to see that the machines are in proper condition for use in the election. The party representatives shall be sworn to perform faithfully their duties but shall not interfere with the officials or assume any of their duties. When a machine has been so examined by the representatives, it shall be sealed with a numbered metal seal. The representatives shall certify to the number of the machines, whether all of the counters are set at zero (000), and the number registered on the protective counter and on the seal. The system supports this requirement. i) §19321: The elections official shall affix ballot labels to the machines to correspond with the sample ballot for the election. He or she shall employ competent persons to assist him or her in affixing the labels and in putting the machines in order. Each machine shall be tested to ascertain whether it is operating properly. The system supports this requirement. j) §19322: When a voting machine has been properly prepared for an election, it shall be locked against voting and sealed. After that initial preparation, a member of the precinct board or some duly authorized person, other than the one preparing the machines, shall inspect each machine and submit a written report. The report shall note the following: (1) Whether all of the registering counters are set at zero (000), (2) whether the machine is arranged in all respects in good order for the election, (3) whether the machine is locked, (4) the number on the protective counter, (5) the number on the seal. The keys shall be delivered to the election board together with a copy of the written report, made on the proper blanks, stating that the machine is in every way properly prepared for the election. The system supports this requirement. k) §19340: Any member of a precinct board who has not previously attended a training class in the use of the voting machines and the duties of a board member shall be required to do so, unless appointed to fill an emergency vacancy. The system does not adversely impact this requirement. l) §19341: The precinct board shall consist of one inspector and two judges who shall be appointed and compensated pursuant to the general election laws. One additional inspector or judge shall be appointed for each additional voting machine used in the polling place. The system does not adversely impact this requirement. m) §19360: Before unsealing the envelope containing the keys and opening the doors concealing the counters the precinct board shall determine that the number on the seal on the machine and the number registered on the protective counter correspond to the numbers on the envelope. Each member of the precinct board shall then carefully examine the counters to see that each registers zero (000). If the machine is provided with embossing, SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 14 | Page printing, or photography devices that record the readings of the counters the board shall, instead of opening the counter compartment, cause a “before election proof sheet” to be produced and determined by it that all counters register zero (000). If any discrepancy is found in the numbers registered on the counters or the “before election proof sheet” the precinct board shall make, sign, and post a written statement attesting to this fact. In filling out the statement of return of votes cast, the precinct board shall subtract any number shown on the counter from the number shown on the counter at the close of the polls. The system supports this requirement. n) §19361: The keys to the voting machines shall be delivered to the precinct board no later than twelve hours before the opening of the polls. They shall be in an envelope upon which is written the designation and location of the election precinct, the number of the voting machine, the number on the seal, and the number registered on the protective counter. The precinct board member receiving the key shall sign a receipt. The envelope shall not be opened until at least two members of the precinct board are present to determine that the envelope has not been opened. At the close of the polls the keys shall be placed in the envelope supplied by the official and the number of the machine, the number written on the envelope. The system supports this requirement. o) §19362: The exterior of the voting machine and every part of the polling place shall be in plain view of the election precinct board and the poll watchers. Each machine shall be at least four feet from the poll clerk’s table. The system supports this requirement. 3. Review of Federal Statutes or Regulations. a) The Voting Rights Act (VRA) of 1965, as amended (42 U.S.C. 1973), requires all elections in certain covered jurisdictions to provide registration and voting materials and oral assistance in the language of a qualified language minority group in addition to English. Currently in California, there are ten VRA languages (English, Spanish, Chinese, Hindi, Japanese, Khmer, Korean, Tagalog, Thai, and Vietnamese) as prescribed under the law. The system meets this requirement. The system’s paper ballots can be easily printed in these languages, as well as any others. Further, both the ExpressVote and ExpressVote XLs can be programmed to display the ballot in any of these languages on the touch screen interface and to provide audio instruction in any of these languages. b) The National Voter Registration Act of 1993 (42 U.S.C. 1973gg and 11 CFR 8) allows for the casting of provisional ballots through Fail-Safe Voting procedures. SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 15 | Page The system meets this requirement. Provisional ballots can easily be cast with this system. The ExpressVote and ExpressVote XL only marks ballots (or verifies the marking of a ballot), it has no impact on provisional voting. c) The Voting Accessibility for the Elderly and Handicapped Act of 1984 (42 U.S.C. 1973ee through 1973ee-6) requires each political subdivision conducting elections within each state to assure that all polling places for federal elections are accessible to elderly and handicapped voters, except in the case of an emergency as determined by the state’s chief election officer or unless the state’s chief election officer: (1) determines, by surveying all potential polling places, that no such place in the area is accessible or can be made temporarily accessible, and (2) assures that any handicapped voter assigned to an inaccessible polling place will, upon advance request under established state procedures, either be assigned to an accessible polling place or be provided an alternative means of casting a ballot on election day. This system supports this requirement. d) The Retention of Voting Documentation (42 U.S.C. 1974 through 1974e) statute applies in all jurisdictions and to all elections in which a federal candidate is on a ballot. It requires elections officials to preserve for twenty two months all records and papers which came into their possession relating to an application, registration, payment of a poll tax, or other act requisite to voting. Note: The US Department of Justice considers this law to cover all voter registration records, all poll lists and similar documents reflecting the identity of voters casting ballots at the polls, all applications for absentee ballots, all envelopes in which absentee ballots are returned for tabulation, all documents containing oaths of voters, all documents relating to challenges to voters or absentee ballots, all tally sheets and canvass reports, all records reflecting the appointment of persons entitled to act as poll officials or poll watchers, and all computer programs used to tabulate votes electronically. In addition, it is the Department of Justice’s view that the phrase “other act requisite to voting” requires the retention of the ballots themselves, at least in those jurisdictions where a voter’s electoral preference is manifested by marking a piece of paper or by punching holes in a computer card. The system meets this requirement. All votes in this system are recorded on paper ballots that can be easily retained. 4. Help America Vote Act (HAVA) Requirements The Help America Vote Act (HAVA) §301(a) mandates several requirements for voting systems, including: a) The ability to verify the vote choices on the ballot before that ballot is cast and counted, b) Notification to the voter of over-votes on a ballot, SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 16 | Page c) Auditability with a permanent paper record of votes cast, d) Accessibility for individuals with disabilities, including nonvisual accessibility for the blind and visually impaired, in a manner that provides the same opportunity for access and participation (including privacy and independence) This system supports these requirements in the following manner: i. The paper ballots themselves lend themselves to visual inspection and verification. ii. The ExpressVote and ExpressVote XLs provide its users with a ballot review screen prior to printing the ballot. Further, any voted ballot can be inserted into the unit for review and verification. iii. The ExpressVote and ExpressVote XLs prevent over-voting a contest. iv. Because all ballots in this system are paper based, there is a fully auditable and permanent record of the election. v. Deployment of the ExpressVote and ExpressVote XLs in a precinct provides accessibility for persons with disabilities at the polling place. V. CONCLUSION The EVS 6.0.4.2 voting system, in the configuration tested and documented by the California Installation and ES&S’s Use Procedures, meets all applicable California and federal laws. The ES&S EVS 6.0.4.2 voting system is compliant with all California and federal laws. SECRETARY OF STATE’S STAFF REPORT – ES&S EVS 6.0.4.2 17 | Page