Staff Report

Office of Voting Systems Technology Assessment | 1500 11th Street, 6th Floor Sacramento, CA 95814 | Tel 916.695.1680 | www.sos.ca.gov Election Systems & Software Election Voting System (EVS) 6.3.0.2 Staff Report Prepared by: Secretary of State’s Office of Voting Systems Technology Assessment March 30, 2023 Table of Contents I. Introduction ......................................................................................... 1 1. Scope ................................................................................... 1 2. Summary of the Application ................................................. 1 3. Contracting and Outsourcing ............................................... 2 II. Summary of the System .................................................................... 2 1. DS200 Precinct Scanner v3.0.0.2, Hardware v1.3 ............... 2 2. DS300 Precinct Scanner v3.0.0.2, Hardware v1.0 ............... 2 3. DS450 Central Scanner v4.2.0.2, Hardware v1.0 ................ 2 4. DS850 Central Scanner v4.2.0.2, Hardware v1.0 ................ 2 5. DS950 Central Scanner v4.2.0.2, Hardware v1.1 ................ 2 6. ExpressVote v4.2.1.2, Hardware v2....…………………...…..2 7. Electionware Election Management System v6.3.0.2….…...3 .. III. Testing Information and Results. ........................................................ 4 1. Background .......................................................................... 4 2. Functional Testing Summary ............................................... 4 3. Software Review Testing Summary ..................................... 7 4. Security and Telecommunications Testing Summary .......... 9 5. Volume Testing Summary .................................................... 12 6. Usability, Accessibility & Privacy Testing Summary ............ 16 IV. Compliance with State and Federal Laws and Regulations ............... 18 1. Elections Code Requirements .............................................. 18 2. Elections Code Review ......................................................... 19 3. Review of Federal Statutes & Regulations ........................... 23 4. Help America Vote Act (HAVA) Requirements ..................... 24 V. Conclusion .......................................................................................... 25 2 Office of Voting Systems Technology Assessment | 1500 11th Street, 6th Floor Sacramento, CA 95814 | Tel 916.695.1680 | www.sos.ca.gov I. INTRODUCTION 1. Scope This report presents the test results for all phases of the certification test of the Election Systems & Software Election Voting System (EVS) 6.3.0.2 voting system. The purpose of the testing is to test the compliance of the voting system with California and Federal laws. The system was tested to the California Voting System Standards (October 2014). Testing also uncovers other findings, which do not constitute non-compliance, and those findings are reported to the voting system vendor to address the issues procedurally. The procedures for mitigating any additional findings are made to the documentation, specifically the EVS 6.3.0.2 Use Procedures. 2. Summary of the Application Election Systems & Software applied for the testing for certification of the EVS 6.3.0.2 voting system on February 14, 2022. The system is comprised of the following major components: • DS200 Precinct Scanner v3.0.0.2, Hardware v1.3 • DS300 Precinct Scanner v3.0.0.2, Hardware v1.0 • DS450 Central Scanner v4.2.0.2, Hardware v1.0 • DS850 Central Scanner v4.2.0.2, Hardware v1.0 • DS950 Central Scanner v4.2.0.2, Hardware v1.1 • ExpressVote v4.2.1.2, Hardware v2.1 • Electionware Election Management System v6.3.0.2 In addition to these major components, which includes the executable code and the source code, Election Systems & Software was required to submit the following: 1) the technical documentation package (TDP); 2) all the hardware components to field two complete working versions of the system, including all peripheral devices, one for the Functional Test Phase and one for the Security and Telecommunications Penetration Test Phase; 3) all the peripherals that would be in the polling place; and 4) the EVS 6.3.0.2 Use Procedures. 3. Contracting and Consulting Upon receipt of a complete application, the Secretary of State released a Request for Quote (RFQ) for assistance with the Functional, Volume, Software 1 (Source Code) Review, Security and Telecommunications (Red Team Penetration) Usability Accessibility and Privacy Testing. Through the formal California contracting process, the Secretary of State awarded a contract to SLI Compliance (SLI), a division of Gaming Laboratories International, LLC, to serve in the capacity as the state-approved testing agency or expert technician to examine the voting system. II. SUMMARY OF THE SYSTEM The EVS 6.3.0.2 system consists of the following components: • DS200 Precinct Scanner v3.0.0.2, Hardware v1.3 The DS200 is a digital scan tabulator that scans and stores a full-page image of the ballot. Ballots can be fed in any orientation. During tabulation, the images are processed by proprietary mark recognition software. It is generally used to tabulate ballots in a polling place but may be used as a central count device in small jurisdictions. • DS300 Precinct Scanner v3.0.0.2, Hardware v1.0 The DS300 is a digital scan tabulator that scans and stores a full-page image of the ballot. Ballots can be fed in any orientation. During tabulation, the images are processed by proprietary mark recognition software. It is generally used to tabulate ballots in a polling place but may be used as a central count device in small jurisdictions. • DS450 Central Ballot Scanner v4.2.0.2, Hardware v1.0 The DS450 is a high-speed digital scan ballot counter that scans and stores ballot images and is used in central count operations. During tabulation, the images are processed by proprietary mark recognition software. This tabulator can out stack under votes, over votes, blank ballots, write-in ballots and unreadable ballots into separate batches. • DS850 Central Ballot Scanner v4.2.0.2, Hardware v1.0 The DS850 is a high-speed digital scan ballot counter that scans and stores ballot images and is used in central count operations. During tabulation, the images are processed by proprietary mark recognition software. This tabulator can out stack under votes, over votes, blank ballots, write-in ballots and unreadable ballots into separate batches. • DS950 Central Ballot Scanner v4.2.0.2, Hardware v1.1 The DS950 is a high-speed digital scan ballot counter that scans and stores ballot images and is used in central count operations. During tabulation, the images are processed by proprietary mark recognition software. This tabulator 2 can out stack under votes, over votes, blank ballots, write-in ballots and unreadable ballots into separate batches. • ExpressVote v4.2.0.2, Hardware v2.1 The ExpressVote is a touchscreen capture device. It combines paper-based voting and touchscreen technology, which produces an independent, voter- verifiable paper record that is scanned by ES&S tabulators such as the DS200, DS300, DS450, DS850, or DS950. • Election Management System (EMS) The election management system software package is composed of the following modules: − Electionware, v6.3.0.2 Electionware is used by a jurisdiction to create the ballot definition for an election. Electionware is then used to program the various media used by the different vote counting components. After the election, Electionware is used to compile and tabulate election returns from throughout the jurisdiction. Finally, Electionware contains a series of additional reporting functions. − Event Log Service, v3.0.0.0 The Event Log Service logs user’s actions for the election management applications. It runs in the background, logging system events to the COTS Windows Event Viewer. The log can also be used to print audit log reports. − Removable Media Service, v3.0.0.0 The Removable Media Service supports election media programming. − PaperBallot, v6.3.0.2 The PaperBallot module is used for designing paper ballots for use with ES&S equipment. − Dell PowerEdge T550 The Dell PowerEdge T550 is a tower server utilized as the Electionware election management system server. − Dell Optiplex XE4 The Dell Optiplex XE4 is a desktop computer utilized as the Electionware election management system client. − Dell Latitude 5530 The Dell Latitude 5530 is a laptop utilized as the Electionware election management system client. 3 III. TESTING INFORMATION AND RESULTS 1. Background The Secretary of State staff in conjunction with SLI, oversaw all phases of testing of the system, including Functional, Software Testing (Source Code Review), Security and Telecommunications (Red Team Penetration Testing), Volume, and Accessibility, Usability and Privacy Testing, and Hardware Testing. 2. Functional Testing Summary System Configuration: The system is self-contained on an air gapped network, per the CVSS requirements. SLI performed the task of creating the Trusted Build of the EVS 6.3.0.2 voting system. The artifacts produced will be kept and distributed by the Secretary of State. Functional Testing Phase The Functional Testing consisted of following the Use Procedures to import the following eight (8) test elections in Table 2A: Test Elections into the testing environment. The vote by mail ballots (VBM) and ballot marking device (BMD) ballots used for testing were marked using predetermined ballot marking patterns. Table 2A: Test Elections Election Number of Anomaly Election Specific Details Resolution Type Ballots Identified 50 (25 Gubernatorial Tested a Gubernatorial VBM/25 None N/A General General election type. BMD) 105 (80 Gubernatorial Hand Tested a Gubernatorial None N/A Primary Marked/25 Primary election type. BMD) Tested the tabulation of Language 30 BMD facsimile ballots in a variety of None N/A Special languages. Tested the ExpressVote Activation Card Printer and 2 (1 Hand verify the functionality of the Marked Marked/1 “Review Box” on a ballot to None N/A Review BMD) ensure ballots marked for review are separated by the tabulator. 4 Table 2A: Test Elections 4,446 (3,806 Presidential Tested a Presidential General Hand None N/A General election type. Marked/640 BMD) 4,446 Tested the limitation of ballot (3,806 styles that can be used with Presidential Hand the system, and language None N/A Primary Marked/640 support for Spanish (audio BMD) and visual). Tested the systems candidate Special 60 (12 capacity, with a Recall Recall Hand Question. The ballot has the Election with None N/A Marked/ 48 specifications are 95 Recall BMD) candidates, with an 8-point Question font size. 2,020 (1,620 Tested a large number of Vote Center Hand precincts (5,000+), and long None N/A Marked, character name strings. 400 BMD) EVS 6.3.0.2 supports the following languages: • English • Japanese • Vietnamese • Bengali • Korean • French • Spanish • Russian • Chinese • Hindi • Tagalog Marginal marks were purposely made to some ballots to test out stacking functionality. The following tools were used: • Yellow highlighter • Blue Ink • Pink highlighter • Dry erase marker • Pencil • Black sharpie marker • Black Ink Each writing tool performed as expected. The system uses upper and lower thresholds that are fixed to identify marked and unmarked ballots. Dark pixel counts that fall between the two thresholds are further evaluated against known mark patterns and can be out stacked or rejected if not match is determined. This threshold setting is adjustable. 5 3. Software Review Testing Summary The review was conducted by SLI. SLI evaluated the security and integrity of the voting system by identifying any security vulnerabilities that could be exploited to: • Alter vote recording, • Alter vote results, • Alter critical data (such as audit logs), or • Conduct a “denial of service” attack on the voting system. SLI’s review of the EVS 6.3.0.2 source code against the applicable standards of the CVSS in sections 5 and 7 determined that no discrepancies were found in the source code. 4. Security and Telecommunications Testing Security and Telecommunications (Red Team Penetration) testing of the EVS 6.3.0.2 system was conducted in November of 2022, by SLI. Additional testing of the system was conducted in January of 2023, by SLI. The Security and Telecommunications Testing resulted in the following finding requiring a resolution, response and/or mitigation as described in Table 4: Security Findings: Table 4: Security Findings SLI determined the following security concern to be rated as an insider threat with low probability of exploitation as the threat would require extended physical access to the machine, and the ability to circumvent in place physical security controls, including lock/key and tamper evident seals. Issue Status Consultant Vendor Mitigation Assessment ES&S is evaluating both software and hardware encryption options, as well as The DS450/850/950 our internal processes to support these devices audit log technologies on fielded units that must data that was found be repaired, replaced, and updated in the to be deficient of field. Our expectation is that we will have 1 Unresolved security these options and a go-forward path considerations, such selected in the next few months, as full disk immediately followed by development, encryption. testing, and security evaluations to allow this to be offered in near-term certifications. 5. Volume Testing Summary 2 The Volume Test simulates conditions in which the ballot marking devices would be used on Election Day. Twenty (20) ExpressVote HW2.1 devices, and fifteen (15) DS300 devices were tested during the volume test. Over two days, eighteen (18) temporary workers marking and casting up to one hundred thirty (130) ballots per ExpressVote HW2.1 device, and 2,360 ballots per DS300 device. The devices were each loaded with a California Presidential Primary Election, including all supported languages, with complete audio files for the testers to choose from. The testing resulted in the following findings as described in Table 5: Volume Testing Issue Log: Table 5: Volume Testing Issue Log Issue Description Vendor Response This was caused by ballots that were mishandled, and the ends of the ballots curled up as a result. This was resolved by One DS300 experienced multiple errors feeding the ballots in a different related to ballot jams. orientation. The vendor documented instructions to resolve such issues are available in the vendor user documentation. This was a result of a thermal printer error. One DS300 device encountered issues The tabulation results were still available with its thermal printer. on the device and were able to be verified against the expected totals. The paper jam was caused by pulling on the voter card before prompted by the machine to do so. This caused the voter card to get caught on the rubber wheels in the paper path. The issue was resolved by One ExpressVote HW2.1, in a kiosk, pressing the red error sign on the screen experienced a paper jam. then slowly pulling out the voter card from where the paper path ejects the voter card. The vendor documented instructions to resolve such issues are available in the vendor user documentation. The paper jam was caused by inserting the voter card slightly skewed into the paper path. The issue was resolved by pressing the red error sign on the screen then opening the paper path covering One ExpressVote HW2.1, on a table, using a special key which the vendor experienced a paper jam. provided. After the paper path covering was opened, the voter card was clearly visible and by turning the rubber wheels located on the inside, the voter card was able to be ejected. The vendor documented instructions to resolve such 3 Table 5: Volume Testing Issue Log Issue Description Vendor Response issues are available in the vendor user documentation Nothing was visibly wrong with the card. On screen instructions were followed. The One ExpressVote HW2.1, in a kiosk, card was fed back into the same device experienced a ‘Printed Card Not Read.’ and the card could be read and displayed message displayed after printing a card. details were accurate. The issue was not able to be duplicated. Nothing was visibly wrong with the card. On screen instructions were followed. The One ExpressVote HW2.1, on a table, card was fed back into the same device experienced a ‘Printed Card Not Read.’ and the card could be read and displayed message displayed after printing a card. details were accurate. The issue was not able to be duplicated. 6. Usability, Accessibility and Privacy Testing Summary The Accessibility, Usability and Privacy testing took place on November 30, 2022. The ExpressVote HW2.1 devices used for this test were programmed with a California Presidential Primary Election. Each volunteer tester was asked to complete a ballot on their own, with assistance provided as requested. Upon completion of the session, each volunteer testers were asked to participate in a post-test survey regarding their experience. The survey results are included in Table 6: Accessibility Survey. Table 6: Accessibility Survey Tester Survey Results Vendor Response The election loaded onto the machine Write-in process can feel contained ballots that contained no cumbersome and time- candidates and such that the voter could only consuming when having to vote write-in contests. ES&S will re-assess be performed several the ballot used for this particular test to allow Tester 1 times, and the audio speed for an improved test experience. of moving through the alphabet was too slow Had the voter used the option to increase the which only added to the tempo of the audio prompts, it would have cumbersome feeling. read them in a more responsive fashion. These prompts are appropriate when there is Confusion over the audio, only 1 candidate choice, making it the first giving instructions for a choice and the last choice. This is not single write-in candidate Tester 1 generally expected by a voter, but is contest as “First choice, common in uncontested races that do not write-in, last choice” as a allow a write-in. The system does allow for single sentence. some configuration of messages and 4 Table 6: Accessibility Survey instructions that would allow jurisdictions to improve on this experience if desired. This was informative feedback for the vendor. The participant noted that when going back into edit a write-in entry, the first thing they want to hear is instructions having to do with editing, such as backspacing, Confusion over going back clearing, etc. and not the standard info on a character during write-in how to enter the write-in with the editing Tester 1 as to whether it required instructions at the very end. The vendor is pressing the back key or looking at a possible prompt improvement left arrow key. that would recognize this edit scenario and put the editing instructions first. This will be evaluated and tested with accessibility resources and brought in a future version if it proves to be a valid solution. Although this is frustrating, a feature that While reviewing write-ins would properly read back any entered name, that were typed in having including those that are misspelled is not Tester 1 the letters played back practical. The "spell back" method has been individually was confusing. a best practice on accessible devices for write-ins since the inception of these devices. In assistive mode, contests are presented one contest per screen followed by a Tester suggested a method summary screen that occurs before the voter of finding what contests can print their selections. The summary were skipped during the screen has both visual and audio indications ballot review before of which contests are voted, undervoted, or Tester 1 printing their ballot and the unvoted when navigating the summary ability to repeat the screen. Also in this mode, navigation forces instructions using a keypad the voter to navigate through all contests key. without the ability to skip a contest. Additionally, there is a repeat key on the keypad that allows prompts to be replayed. This navigation was developed to support Tester would like the both sighted and blind voters. Decades of keyboard to navigate field use and usability testing have Tester 1 utilizing left/right keys determined that up/down for navigation in the instead of the up/down contest and left/right for navigation from keys. contest to contest is the optimum way to support all voters using the keypad. Tester suggested options ES&S has evaluated this and has not been to allow a voter to change Tester 3 able to identify a way to offer user-adjustable the sensitivity of the pressure for the buttons. keypad button presses. 5 IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS 1. Elections Code Requirements Six (6) sections of the California Elections Code, Sections 19101, 19203, 19204, 19204.5, 19205, and 19270, describe in detail the requirements any voting system must meet in order to be approved for use in California elections. These sections are described in detail and analyzed for compliance below. a) §19101 (b) (1): The machine or device and its software shall be suitable for the purpose for which it is intended. The system meets this requirement. b) §19101 (b) (2): The system shall preserve the secrecy of the ballot. The system meets this requirement. Vote by mail and ballot marking device ballots can both be secretly cast. c) §19101 (b) (3): The system shall be safe from fraud or manipulation. The system meets this requirement. The tabulation system is wholly contained within an air-gapped environment, in addition to the Use Procedures prescribe strict chain of custody requirement, including the use of tamper evident seals, port security locks, and physical security mitigations/best practices. d) §19101 (b) (4): The system shall be accessible to voters with disabilities pursuant to section 19242 and applicable federal laws. The system meets this requirement. Accessibility testing conducted with members of the accessibility community verified that the system is accessible and voters with accessibility needs can cast a ballot privately and independently. e) §19101 (b) (5): The system shall be accessible to voters who require assistance in a language other than English if the language is one in which a ballot or ballot materials are required to be made available to voters pursuant to Section 14201 and applicable federal laws. EVS 6.3.0.2 supports 14201 languages, as applicable to the jurisdictions it serves. The system can add additional languages, to produce ballots or ballot materials, and accessible audio files pursuant to Section 14201, utilizing system functionality and outside translation. 6 f) §19203: The system shall use ballot paper that is of sufficient quality that it maintains its integrity and readability throughout the retention period specified in sections 1700 through 17306. The system meets this requirement. g) §19204: The system shall not include procedures that allow a voter to produce, and leave the polling place with, a copy or facsimile of the ballot cast by that voter at that polling place. The system meets this requirement as the ballot marking devices retain the ballots, in the integrated ballot box, upon casting. h) §19204.5: The Secretary of State shall not certify or conditionally approve a voting system that cannot facilitate the conduct of a ballot level comparison risk-limiting audit. The system meets this requirement. The systems components in addition to processes and procedures, prepare ballots during the tabulation process for a risk-limiting audit. i) §19205 (a): No part of the voting system shall be connected to the internet at any time. The system meets this requirement. No components of the voting system are connected to the internet. The system operates in a wholly contained air-gap environment. j) §19205 (b): No part of the voting system shall electronically receive or transmit election data through an exterior communication network, including the public telephone system, if the communication originates from or terminates at a polling place, satellite location, or counting center. The system meets this requirement. No components of the voting system are connected to the internet. The system operates in a wholly contained air-gap environment. k) §19205 (c): No part of the voting system shall receive or transmit wireless communications or wireless data transfers. The system meets this requirement. No components of the voting system have the capability, including optional capability to communicate wirelessly. The system operates in a wholly contained air-gap environment. l) §19270 (a): The Secretary of State shall not certify or conditionally approve a direct recording electronic voting system unless the system includes an accessible voter verified paper audit trail. 7 The system meets this requirement. 2. Elections Code Review a) §305.5(b): A paper cast vote record is a ballot only if the paper cast vote record is generated on a voting device or machine that complies with ballot layout requirements and is tabulated by a separate device from the device that created the paper cast vote record. The system meets this requirement. b) §15360: During the official canvass of every election in which a voting system is used, the official conducting the election shall conduct a public manual tally of the ballots tabulated by those devices cast in one percent of the precincts chosen at random by the elections official. If one percent of the precincts should be less than one whole precinct, the tally shall be conducted in one precinct chosen at random by the elections official. In addition to the one percent count, the elections official shall, for each race not included in the initial group of precincts, count one additional precinct. The manual tally shall apply only to the race not previously counted. The system fully supports this requirement. c) §19300: A voting machine shall, except at a direct primary election or any election at which a candidate for voter-nominated office is to appear on the ballot, permit the voter to vote for all the candidates of one party or in part for the candidates of one party and in part for the candidates of one or more other parties. The system meets this requirement. d) §19301: A voting machine shall provide in the general election for grouping under the name of the office to be voted on, all the candidates for the office with the designation of the parties, if any, by which they were respectively nominated. The designation may be by usual or reasonable abbreviation of party names. The system meets this requirement. e) §19302: The labels on voting machines and the way in which candidates’ names are grouped shall conform as nearly as possible to the form of ballot provided for in elections where voting machines are not used. 8 The system meets this requirement. f) §19303: If the voting machine is so constructed that a voter can cast a vote in part for presidential electors of one party and in part for those of one or more other parties or those not nominated by any party, it may also be provided with: (a) one device for each party for voting for all the presidential electors of that party by one operation, (b) a ballot label therefore containing only the words “presidential electors” preceded by the name of the party and followed by the names of its candidates for the offices of President and Vice President, and (c) a registering device therefore which shall register the vote cast for the electors when thus voted collectively. If a voting machine is so constructed that a voter can cast a vote in part for delegates to a national party convention of one party and in part for those of one or more other parties or those not nominated by any party, it may be provided with one device for each party for voting by one operation for each group of candidates to national conventions that may be voted for as a group according to the law governing presidential primaries. No straight party voting device shall be used except for delegates to a national convention or for presidential electors. The system meets this requirement. g) §19304: A write-in ballot shall be cast in its appropriate place on the machine, or it shall be void and not counted. The system supports this requirement. h) §19320: Before preparing a voting machine for any general election, the elections official shall mail written notice to the chairperson of the county central committee of at least two of the principal political parties, stating the time and place where machines will be prepared. At the specified time, one representative of each of the political parties shall be afforded an opportunity to see that the machines are in proper condition for use in the election. The party representatives shall be sworn to perform faithfully their duties but shall not interfere with the officials or assume any of their duties. When a machine has been so examined by the representatives, it shall be sealed with a numbered metal seal. The representatives shall certify to the number of the machines, whether all of the counters are set at zero (000), and the number registered on the protective counter and on the seal. The system supports this requirement. i) §19321: The elections official shall affix ballot labels to the machines to correspond with the sample ballot for the election. He or she shall employ competent persons to assist him or her in affixing the labels and in putting 9 the machines in order. Each machine shall be tested to ascertain whether it is operating properly. The system supports this requirement. j) §19322: When a voting machine has been properly prepared for an election, it shall be locked against voting and sealed. After that initial preparation, a member of the precinct board or some duly authorized person, other than the one preparing the machines, shall inspect each machine and submit a written report. The report shall note the following: (1) Whether all of the registering counters are set at zero (000), (2) whether the machine is arranged in all respects in good order for the election, (3) whether the machine is locked, (4) the number on the protective counter, (5) the number on the seal. The keys shall be delivered to the election board together with a copy of the written report, made on the proper blanks, stating that the machine is in every way properly prepared for the election. The system supports this requirement. k) §19360: Before unsealing the envelope containing the keys and opening the doors concealing the counters the precinct board shall determine that the number on the seal on the machine and the number registered on the protective counter correspond to the numbers on the envelope. Each member of the precinct board shall then carefully examine the counters to see that each registers zero (000). If the machine is provided with embossing, printing, or photography devices that record the readings of the counters the board shall, instead of opening the counter compartment, cause a “before election proof sheet” to be produced and determined by it that all counters register zero (000). If any discrepancy is found in the numbers registered on the counters or the “before election proof sheet” the precinct board shall make, sign, and post a written statement attesting to this fact. In filling out the statement of return of votes cast, the precinct board shall subtract any number shown on the counter from the number shown on the counter at the close of the polls. The system supports this requirement. l) §19361: The keys to the voting machines shall be delivered to the precinct board no later than twelve hours before the opening of the polls. They shall be in an envelope upon which is written the designation and location of the election precinct, the number of the voting machine, the number on the seal, and the number registered on the protective counter. The precinct board member receiving the key shall sign a receipt. 10 The envelope shall not be opened until at least two members of the precinct board are present to determine that the envelope has not been opened. At the close of the polls the keys shall be placed in the envelope supplied by the official and the number of the machine, the number written on the envelope. The system supports this requirement. m) §19362: The exterior of the voting machine and every part of the polling place shall be in plain view of the election precinct board and the poll watchers. Each machine shall be at least four feet from the poll clerk’s table. The system supports this requirement. 3. Review of Federal Statutes or Regulations. a) The Voting Rights Act (VRA) of 1965, as amended (42 U.S.C. 1973), requires all elections in certain covered jurisdictions to provide registration and voting materials and oral assistance in the language of a qualified language minority group in addition to English. Currently in California, there are eleven VRA languages (English, Spanish, Cambodian, Chinese, Hindi, Japanese, Khmer, Korean, Tagalog, Thai, and Vietnamese) as prescribed under the law. The system meets this requirement. The system’s paper ballots can be printed in these languages, as well as any others. b) The National Voter Registration Act of 1993 (42 U.S.C. 1973gg and 11 CFR 8) allows for the casting of provisional ballots through Fail-Safe Voting procedures. The system meets this requirement. Provisional ballots can easily be cast with this system. The ballot marking device only marks ballots (or verifies the marking of a ballot), it has no impact on provisional voting. c) The Voting Accessibility for the Elderly and Handicapped Act of 1984 (42 U.S.C. 1973ee through 1973ee-6) requires each political subdivision conducting elections within each state to assure that all polling places for federal elections are accessible to elderly and handicapped voters, except in the case of an emergency as determined by the state’s chief election officer or unless the state’s chief election officer: (1) determines, by 11 surveying all potential polling places, that no such place in the area is accessible or can be made temporarily accessible, and (2) assures that any handicapped voter assigned to an inaccessible polling place will, upon advance request under established state procedures, either be assigned to an accessible polling place or be provided an alternative means of casting a ballot on election day. This system supports this requirement. d) The Retention of Voting Documentation (42 U.S.C. 1974 through 1974e) statute applies in all jurisdictions and to all elections in which a federal candidate is on a ballot. It requires elections officials to preserve for 22 months all records and papers which came into their possession relating to an application, registration, payment of a poll tax, or other act requisite to voting. Note: The US Department of Justice considers this law to cover all voter registration records, all poll lists and similar documents reflecting the identity of voters casting ballots at the polls, all applications for absentee ballots, all envelopes in which absentee ballots are returned for tabulation, all documents containing oaths of voters, all documents relating to challenges to voters or absentee ballots, all tally sheets and canvass reports, all records reflecting the appointment of persons entitled to act as poll officials or poll watchers, and all computer programs used to tabulate votes electronically. In addition, it is the Department of Justice’s view that the phrase “other act requisite to voting” requires the retention of the ballots themselves, at least in those jurisdictions where a voter’s electoral preference is manifested by marking a piece of paper or by punching holes in a computer card. The system meets this requirement. All votes in this system are recorded on paper ballots that can be retained. 4. Help America Vote Act (HAVA) Requirements The Help America Vote Act (HAVA) §301(a) mandates several requirements for voting systems, including: 1) The ability to verify the vote choices on the ballot before that ballot is cast and counted, 2) Notification to the voter of over-votes on a ballot, 3) Auditability with a permanent paper record of votes cast, 4) Accessibility for individuals with disabilities, including nonvisual accessibility for the blind and visually impaired, in a manner that provides the same opportunity for access and participation (including privacy and independence) − This system supports these requirements in the following manner: 12 a) The paper ballots themselves lend themselves to visual inspection and verification. b) The ballot marking device provides its users with a ballot review screen prior to printing the ballot. Further, any voted ballot can be inserted into the unit for review and verification. c) The ballot marking device prevents over-voting a contest. d) Because all ballots in this system are paper based, there is a fully auditable and permanent record of the election. e) Deployment of the ballot marking device in a precinct provides accessibility for persons with disabilities at the polling place. V. CONCLUSION The EVS 6.3.0.2 voting system meets applicable California and Federal Elections laws. The system does however have some remaining findings, which Election Systems & Software will address or has addressed in the appropriate mitigation areas of this report. Election Systems & Software provided responses and/or mitigations to those findings, which will be evaluated by the California Secretary of State. 13