Procedures: Item 4A

State of California PROCEDURES Required for Use of the eSlateä Electronic Voting System These procedures have been adopted by the Secretary of State pursuant to Elections Code sections 19100 and 19205 and shall regulate and govern the use of the eSlate Electronic Voting System at all elections governed by the California Elections Code. These procedures shall be effective beginning February 21, 2003 and shall be used in conjunction with all other statutory and regulatory requirements. Insofar as feasible, all procedures prescribed herein shall be carried out in full view of the public. These procedures constitute a minimum standard of performance. They are not intended to preclude additional steps being taken by individual election officials to enhance the security and reliability of the electoral process. CONFIDENTIAL This DOCUMENT contains confidential Hart InterCivic and proprietary information belonging exclusively to Hart InterCivic, Inc. No part Part Number: 6000-122 REV: F of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means electronic, Part Name: Spec, Procedure, California, eSlate mechanical, photocopied, recorded, or otherwise without prior written permission of Hart InterCivic, Inc. File Name: Spec, Procedure, California, eSlate.doc Page 1 of 29 Change History Version Date Author Description A 11-11-02 Sandy Green Initial Release B 2/19/03 Sandy Green Addition of Multilanguage, SERVO System, tabulation and records retention, and recount procedures. C 12/2/03 Neil McClure Addition of Rally application D 12/9/03 Neil McClure Added section 9.4.3 under Operational Security E 9/9/04 Neil McClure Changes to security to support System 3.4 F 9/20/97 Sandy Green Addition of JBC Tally Report posting requirement 2 Table of Contents 1. Overview....................................................................................................5 1.1. Introduction.................................................................................................5 1.2. Precinct Voting System................................................................................5 1.3. Description of the eSlate components...........................................................5 2. eSlate General Specifications....................................................................10 3. The eSlate Electronic Voting System Election Cycle...............................11 3.1. Pre-Election Activities................................................................................11 3.2. Pre-Election Tests – Logic and Accuracy...................................................12 4. ELECTION PROCEDURES..................................................................15 4.1. Voting Equipment Setup.............................................................................15 4.2. JBC and eSlate Power-up..........................................................................15 4.3. Provisional Ballots......................................................................................15 4.4. Polling Place Procedures............................................................................15 4.5. While the Polls are Open............................................................................17 4.6. Closing the Polls.........................................................................................18 4.7. Central Counting:.......................................................................................18 5. Tabulation and Records Retention...........................................................19 5.1. Tabulation..................................................................................................19 5.2. Archiving...................................................................................................19 5.3. Retention...................................................................................................19 6. Official Canvass and Post-Election Procedures.......................................20 6.1. Process provisional ballots..........................................................................20 6.2. Reconcile Tabulation..................................................................................20 6.3. Automatic Manual Recount in One Percent of the Precincts.........................20 6.4. Manual Recount Procedures.......................................................................22 7. Audit Logs................................................................................................22 7.1. BOSS Audit Log.......................................................................................22 7.2. PVS Audit Log..........................................................................................23 7.3. Tally Audit Log -- Real-Time Print-Out......................................................23 8. Certification and Reporting Requirements................................................23 8.1. Biennial Certification of Hardware..............................................................23 8.2. Hardware Certification and Notification......................................................23 8.3. Election Observer Panel.............................................................................24 8.4. Logic and Accuracy Certification................................................................24 9. Computer Security and Recovery..............................................................25 9.1 General Security Considerations.................................................................25 9.2 Physical Security........................................................................................25 9.3 Disaster Security........................................................................................26 9.4 Operational Security...................................................................................26 9.5 Data Security.............................................................................................26 9.6 Precinct Voting Security.............................................................................27 9.7 Security Seals............................................................................................27 10 Software Operation and System State......................................................27 10.1 Error message with “OK” button................................................................28 3 10.2 Application locks-up..................................................................................28 10.3 Windows NT error or locks-up..................................................................28 4 1. Overview 1.1. Introduction The Hart InterCivic eSlateTM Electronic Voting System is a completely integrated suite of products that offers the most streamlined and efficient method for conducting and reporting elections. The eSlateTM 1.13 Electronic DRE Voting System has these major components: · The Ballot Origination Software System (BOSS) · Precinct Voting System (PVS) · Ballot Now · Tally System (Tally) · SERVO · Rally Hart InterCivic’s eSlate Electronic Voting System automates the balloting and tabulation process using a suite of hardware and software products. The eSlate system and its components provide central, regional, and precinct tabulation, as well as complete reporting and auditing. The system is bracketed by the ballot definition and tabulation functions. The Ballot Origination Software System, BOSS, provides the user the means to enter jurisdictional and election specific information. The tabulation function is support by Tally that accumulates the Cast Vote Records (CVRs) from components of the system that interface with the voter. These voter interface components consist of the eSlate and Ballot Now. This procedure addresses the use of the eSlate voting terminal. 1.2. Precinct Voting System The Precinct Voting System (PVS) is a Direct Recording Electronic (DRE) voting system designed to manage and conduct polling place activities during an election. The PVS is used for Election Day polling places and early voting sites. The PVS is electronically networked and is made up of: · ä Judge’s Booth Controller (JBC 1000) · eSlate 3000 · ä DAU 5000 · ä Mobile Ballot Box · ä Ballot Origination Software System (BOSS) · ä Tally 1.3. Description of the eSlate components 1.3.1. eSlate Electronic Voting System Hart’s Precinct Voting System (PVS) is a Direct Recording Electronic (DRE) system designed to manage, conduct, and report on elections. The Precinct Voting System supports multiple languages (English, Chinese, Korean, Spanish, Tagalog, and Vietnamese) as required by a jurisdiction. It is used in Election Day 5 precinct polling places and early voting sites. The Electronic Voting System is distributed from a central location to geographically distributed polling places and/or early voting sites. The central location, or headquarters, corresponds to the main offices of the jurisdiction. The precincts are election districts divided geographically according to population and jurisdictional boundaries. Early voting sites are selected locations within a jurisdiction that support the complete election and allow voters from any precinct to cast their vote prior to Election Day. When an election requires that the ballot be displayed in multiple languages, the eSlate displays the available languages to the voter. The voter is required to select the desired language, and all subsequent information is displayed in that language. The networked EVS consists of a controller (Judge's Booth Controller), and multiple voter input devices (the eSlate). 1.3.2. Judge’s Booth Controllerä (JBC 1000) The JBC is a stand-alone device located at each precinct-polling place. The JBC controls up to twelve eSlates and has the following features: · A display for delivery of instructions and messages, public and private counter, and battery status to the operator. · Selection buttons, called softkeys, located on the perimeter of the display, used for the operator to make selections. The functions of the softkeys change, similar to an Automated Teller Machine. · Fixed buttons for Printer Feed, Contrast Up, Contrast Down, and Closing the Polls. · An alphanumeric keypad for entering precinct names, passwords and other data. · A built-in printer for printing Access Codes, zero tape, test results and election results (if required). · Supports multiple language elections (English, Chinese, Korean, Spanish, Tagalog, and Vietnamese) · A set of connectors located at the rear of the device to connect to the first eSlate, mains power and a port used for warehouse functions. · A slot to insert a Mobile Ballot Box (portable FLASH memory device). · Twelve status lights used to indicate the current state of each connected eSlate. · Provides a complete Audit Trail of all events. · Includes a battery chamber for back-up battery power. 6 Illustration of the JBC 1000 1.3.3. eSlateä 3000: The eSlate is used by the voters to cast their ballots. It presents the ballot to the voting public and accepts their selections. The eSlate has the following features: · A Liquid Crystal Display (LCD), 246mm x 184.5mm, used in portrait mode to display a language selection screen, an access code screen, ballot pages, write-in enter screen, ballot summary, and help text. · A user input area that includes a set of push buttons for Enter, Previous page, Next page, Help, and Cast Ballot. · A rotary navigational device used to highlight selections. · User selectable multiple language support. · A connector for receiving a cable from the JBC or previous eSlate and an attached cable for connecting to the next eSlate. The eSlates are connected “serially,” one connected to another, so there is only one cable attached to the JBC. · Recessed cavity in the back for installation of an optional Disabled Access Unit. · A battery chamber for back-up battery power. Illustration of the eSlate 3000 7 1.3.4. Disabled Access Unit (DAU 5000ä ) The DAU is an optional device that can be installed in the eSlate. It allows disabled voters to cast their votes independently. The DAU includes all the features of the eSlate, as well as the following: · A slot to insert a FLASH memory card containing audio data. · User selectable multiple language support. · Audio output for “reading” the ballot to the voter in the selected language via headphones. · Remote switch input used for the physically disabled (either tactile input switched or sip and puff device). Illustration of the DAU 5000 1.3.5. 1.3.5 Mobile Ballot Boxä (MBB) A reusable, portable FLASH memory device, the MBB is used to store and transport election information to and from the polling places. The MBB is reusable and allows data to be stored to it many times. FLASH memory does not require batteries to maintain the data written to it. When deployed in a JBC, the MBB contains: · Election identification · All possible ballot types in all required languages for the jurisdiction. · A list of polling places, precincts, and allowable ballot types for each. · A list of serial numbers, both public and private, for allowable eSlates and JBCs. · Passwords (optional). When the polls are closed, the MBB also contains: · Audit logs · Cast vote records (CVRs) 8 The Mobile Ballot Box (MBB) 1.3.6. Ballot Origination Software Systemä (BOSS) The Ballot Origination Software System (BOSS) is a software application that accepts user input of jurisdictional and election specific information. BOSS is a Windows-based program and uses a commercial database product to store and manipulate data. The ballot generation feature of BOSS creates electronic ballot styles based on the jurisdictional and election specific information supplied by the user. Ballot generation creates a single data file that is used to conduct the election at any polling location. The eSlate proprietary data file is written to multiple PC card memory devices called the Mobile Ballot Boxes (MBBs). MBBs are transported to the various polling locations throughout the county. Each MBB contains the same information so that they can be used in any location. In a polling place, the MBB is used to configure the Precinct Voting System (PVS) and supply ballot data for the election. The same MBB is used to return the ballot images captured by the PVS to Election Headquarters for tabulation by Tally. Once BOSS generates the file for the MBB, the BOSS database becomes locked so that no more changes can be made, thus protecting the integrity of the MBB data file. The BOSS database is subsequently used to initialize the Tally database. 1.3.7. Tallyä Tally is a software application that reads, stores, and tabulates the CVRs from the MBBs. At the close of polls on Election Day, all of the MBBs are returned to the central location, including early voting MBBs, and Tally copies the data stored on each. The MBBs contain CVRs captured by the PVS and audit trail data that authenticates the CVRs. Tally is initialized with the locked BOSS database that was used to create the election. This initialization “programs” Tally for tabulation. The only required task prior to beginning the tabulation process is to input any approved write-in candidate names. 1.3.8. Rallyä Rally is a software application that operates in conjunction with Tally. Rally enables remote MBB card reading, thus permitting distributed capture of cast vote record and audit data on election night. Jurisdictions using Rally will typically deploy multiple Rally stations in a geographically distributed manner that permits efficient MBB card collection. Rally reads the cast vote record and audit data from the MBBs and stores the data locally. Tally, deployed at a central election location, initiates the connection with each Rally station - one after the other and determines 9 if there is any new data stored by the Rally station. The frequency at which Tally “polls” each Rally station is configurable by the user. If there is new data then it is transferred to the Tally station and is ready for tabulation and reporting. 1.3.9. SERVOä SERVO is an election records and recount management system for the eSlate Precinct Voting System (PVS). SERVO uses the redundantly saved Cast Vote Records as part of the triple redundancy feature of the eSlate Electronic Voting System to their fullest advantage. Election results are initially generated from the direct reading of voted Cast Vote Records on the MBBs into Tally. When the JBCs and eSlates are returned to the warehouse, the devices are connected to SERVO and make an exact copy of the redundantly stored Cast Vote Records. SERVO then reconciles the data and generates recount data from the JBC and eSlate memories can also be used to compare against the MBB results, creating a distributed, closed-loop process that provides redundant cross verification of election results. This makes recounting of election results part of every election cycle, increasing system reliability and security. When the PVS equipment is required for use in a new election, SERVO initializes the JBCs and eSlates, which erase all previously recorded information, with the exception of the Private Counter in the JBC, which remains at its existing count to provide an outgoing usage record. SERVO provides other functions such as setting of the real time clock, printing of Cast Vote Records and audit logs. 2. eSlate General Specifications 2.1. eSlate Performance requirements and Specifications The following outlines the general eSlate performance requirements and includes performance specifications. The eSlate shall: · Provide Facilities for voting for such candidates as may be nominated and upon such questions as may be submitted; · Permit each voter in a presidential general election to vote by selecting one box for electors for a pair of candidates for President and Vice President of the United States · Provide a method for write-in voting and shall report the number of votes cast in each contest in the write-in voting position; · Permit each voter to vote at any election, for any person, for any office, for as many persons for an office, and for or against any question for which the voter is entitled; · Preclude each voter from voting for more persons for any office than he is entitled to vote for and from voting for any candidate for the same office for the same office or upon any question more than once; · Be capable of adjustment by election officers, so as to permit voters in primary elections to vote only for the candidates seeking nomination of the 10 political party with which they are affiliated, or non partisan candidates only if they are not affiliated with a political party; · Permit non partisan voters to vote either a non partisan ballot or a party ballot for any political party that has chosen to allow non partisan voters to participate in its primary election; · Permit each voter to change his or her vote for any candidate or upon any question appearing upon the ballot face, up to the time of the final operation to register his or her vote by pressing the “cast ballot” button; · Permit and require voting in absolute secrecy, and shall be so constructed that no person can see or know for whom any other voter has voted or is voting, except voters receiving assistance as prescribed by law; · Have a “public counter” which is visible at all times, which shall show during any period of voting the total number of voters who have voted during the applicable period of voting; · Have a “protective counter” which is visible at all times, which cannot be reset and which shall record the cumulative total number of votes cast; · Upon poll closing, the system must not permit the voting resume; · Be provided with a voting booth which shall conceal the actions of the voter while voting; · Be so constructed, that during the progress of voting, it shall preclude every person from seeing or knowing the number of votes registered for any candidate and from tampering with any of the recorded votes; · Register and record votes correctly and accurately. This shall be done by recording the votes in non-volatile memory on the eSlate, JBC and MBB in the form of Cast Vote Records (CVRs). The storage of the CVRs shall be in a random manner to protect the voter’s secrecy. In the event that any CVR is not captured accurately and stored correctly in the three independent memory locations, the system will notify the voter and poll worker. · The system shall be capable of automatically printing system totals in printed form after the polls are closed. The system shall be capable of printing the same number of results reports as the number of return sheets required by law. · The system has the capability to print a paper copy of each CVR after the polls are closed. 2.2. The central tabulation system The central tabulation system, Tally, shall: · Be capable of accumulating and reporting by precinct the total votes cast for each candidate and for or against each question. · Be capable of tabulating and reporting the vote cast for each candidate and for or against each question, by groups of precincts, such as legislative districts, wards and complete jurisdictions. 3. The eSlate Electronic Voting System Election Cycle 3.1. Pre-Election Activities 3.1.1. Create a BOSS Election Database 11 The eSlate Ballot Origination Software System (BOSS) from the Election Solutions Group of Hart InterCivic is a software application for creating election databases that contain ballot definitions specific to a jurisdiction and an election. The target users for this product are county-level election offices that define and produce their own ballots. BOSS can be used by election officials that may have very little training in the software and don’t use it very often. The user interface is simple, yet powerful and flexible enough to do the job of defining an election ballot in a manner that can easily be assimilated by the user with election knowledge. The election database created in BOSS is used in conjunction with the Precinct Voting System (PVS) and Tally software. BOSS’ primary function is to generate ballot definition information that can be used in these other products. BOSS lays out ballots in an organized, readable fashion, and adheres to the jurisdiction’s legal requirements. A single file is generated by BOSS and contains all the information necessary to support the election from any geographic location and in any required language. This file is called the Electronic Ballot Data and is written to the MBB for use by the Electronic Voting System. 3.1.2. Data Entry into the BOSS Election Database The steps for creating a BOSS election database include: · Gather data for creating the BOSS election database. · Enter all jurisdiction information into the BOSS election database. · Entering jurisdiction information should be done in advance of an election cycle. This information can be saved as a starting point for future elections. · Enter all election information into the BOSS election database. · Proofread all information entered into the BOSS election database. · Create test or official MBBs. 3.1.3. Verify the Data in the BOSS Election Database · Generate BOSS reports and compare the data to the information gathered and organized prior to data entry. · Check for all Contests on ballot and candidate/proposition spelling is correct · Verify the correct number of votes allowed in each contest · Verify that write-in positions are correct 3.1.4. Mobile Ballot Boxes (MBBs) When the BOSS election database is complete, and ballot formats have been created, BOSS will write the ballot information to the MBBs for use in the PVS JBC. 3.2. Pre-Election Tests – Logic and Accuracy 12 3.2.1. Pre-Election Equipment Test The operation of the PVS must be verified prior to deploying the equipment to the polling location. As part of preparing for transport, each piece of equipment must have power applied to it and verify that it reaches the ready state in the power up cycle. This indicates that the equipment is functioning properly and has passed the resident power-up diagnostics. The JBC prints out a report indicating that it, and all connected eSlates, have passed diagnostics and identifies each device by serial number. These reports are retained as part of the election record. 3.2.2. SERVO Device Preparation SERVO is intended to be used at a jurisdiction’s warehouse, where all of the PVS devices are stored. A conveyor line will lead up to the PC running SERVO, where one PVS device after another will get attached to the parallel cable for processing. PVS devices will be added to the SERVO database and reset. · Resetting of the devices includes: · erasing any cast vote records to achieve zero-public-count, · erasing internal audit logs that may exist from a previous election or testing on each device, · setting the clock on a JBC. 3.2.3. Screen cleaning When performing the pre-election power-up verification, clean the eSlate and JBC screens with soft cloth. A non-abrasive cleaning fluid may be used if required. 3.2.4. Election-Specific Test Not more than 10 days before Election Day, the local election official shall have the entire system, tested to ascertain that it will count properly, the votes cast for all offices and all questions. Successful testing will demonstrate that, each candidate and ballot measure receives the proper number of votes, the system accepts only the proper ballot types and all tabulations are reported accurately. In the case of offices for which the voter is allowed to vote for more than one candidate, at least one ballot shall be voted with the maximum allowed number of choices. The election-specific test is an essential method of testing electronic ballots to be used in that particular election to ensure that the eSlates perform adequately. The purpose of this test is to ensure that the ballot used with a particular election will function properly when run with the ballot tabulation software for that election. 13 3.2.5. Accuracy Testing Accuracy testing consists of those procedures necessary to ensure hardware and software to be used in the election is working properly, both as individual units and as a combined system. 3.2.6. Performance of Accuracy Tests Accuracy tests shall be performed prior to Logic and Accuracy Certification to the Secretary of State and again within 72 hours prior to tabulation on Election Day. In the event of hardware failure and the component has been repaired, replaced or adjusted the accuracy test should be re-run. The test shall be conducted by using a pre-determined test script of at least one vote for each possible selection within an office or question. The test script for each voting machine must test all possible candidates or questions for each precinct. If a voting machine or the central tabulating system does not accurately count the test script or test vote, the cause for the error shall be as ascertained and corrected and an errorless count shall be made before the system is approved for use of counting votes. 3.2.7 Preparation of Accuracy Test The responsible elections official shall prepare the following accuracy test deck to be prepared and tested. Predetermined results of accuracy test must be available for inspection and sign off by the Logic and Accuracy Board. 3.2.8 Ballot Inspection and Verification (BIV) All ballot logic and accuracy functions of the eSlate Electronic Voting System are static. This means that the functions are compiled, tested and verified as part of extensive system testing and certification processes and do not change between elections. The only element of the system that changes from one election to the next is the content and format of the ballots. The pre-election ballot inspection and verification for the eSlate system ensures that the Electronic Ballot Data provides properly formatted ballots. This process requires an MBB containing the Electronic Ballot Data file, a Judges Booth Controller, and an eSlate. A proof report from BOSS that lists the various ballot styles is used to optimize the verification process. The following steps are followed to perform the Ballot Inspection and Verification: 1. Create a BIV Mobile Ballot Box in the "test" mode using the Ballot Origination Software System 2. Configure the eSlate, insert the MBB and open the polls 3. Using the ballot style proof sheet from BOSS, select a representative precinct for the first ballot style and print an Access Code 4. Enter the Access Code into the eSlate and display the ballot 5. If multiple languages are required, select the language to be verified. 6. Review the text on the ballot and verify the following: 14 § The text on the ballot is displayed, as desired. § The position of contests relative to pages and columns are accurate § The required contests are present 7. After verifying each of the ballot pages, go to the ballot summary screen. 8. Move to the first contest and verify the formatting of the contest name. 9. Press enter and return to the contest. 10. Select an option in the contest and verify the formatting of the option on the summary screen 11. Repeat for each option in the contest. For contests with write-ins, enter three alpha characters, sequencing through the alphabet for subsequent contests 12. Repeat steps 9 through 11 for each contest 13. Repeat steps 3 through 12 for each ballot style. 14. Repeat steps 3 through 13 for each language, as required 15. Close the polls and remove the MBB, label it and retain as part of the Election record. This process verifies that the ballot(s) will be correctly presented to the voter for a given revision of the Electronic Ballot Data. Formatting errors or changes require that the information be updated in BOSS, generation of new ballots and repeating the above process. 4. ELECTION PROCEDURES 4.1. Voting Equipment Setup The eSlate Precinct Voting System voting equipment for a polling place includes a Mobile Ballot Box installed in a Judge’s Booth Controller and one to twelve eSlates or DAUs. The eSlates in the booths are “daisy-chained” together using the provided cables, with the first eSlate in the chain connected to the JBC using the JBC-to-eSlate cable (provided with the JBC). 4.2. JBC and eSlate Power-up During voting day, the JBC is used to communicate with the eSlates and print Access Code tickets for voters. The JBC and eSlates power up when the power cord is plugged in. The JBC screen displays instructions and allows user entry of desired selections. 4.3. Provisional Ballots Provisional ballots shall be cast using a paper ballot from the Ballot Now voting system. 4.4. Polling Place Procedures Before the Polls Open, the following actions are performed. 15 4.4.1. Election Forms: Complete the Oath of Office and Declaration of Intention forms pursuant to Elections Code section 12321. 4.4.2. Arrange polling place equipment. Locate equipment in a way that maximizes traffic flow. Display a copy of materials required by the Elections Code in each booth. 4.4.3. Connect the System Put the JBC on a table near the first booth, an electrical outlet, and a table for the voter registration book. Connect the JBC to the eSlate in the nearest voting booth with the JBC-to-eSlate cable. Then connect the eSlates to each other. The eSlates inside the booths will be connected together in a chain using the eSlate-to-eSlate cables. Plug the JBC in to power. Check the JBC printer paper. 4.4.4. Install the Mobile Ballot Box If the MBB is not already installed, hold the MBB so that the connector end is pointed to the slot and the polling place ID on the MBB is face up, then place the MBB in the slot and close the slot door. 4.4.5. Button/Wheel check Plug the JBC into the wall outlet and allow the system to “boot-up.” Go to each voting booth and exercise the voter input controls and verify correct button/wheel operation. 4.4.6. Enter Polling Place ID Return to the JBC and locate your Polling Place ID. Type in the Polling Place ID, verifying each digit displays on the JBC screen. If you make a mistake, press Clear and start over. After the correct ID is entered, press Accept. 4.4.7. Choose between Early Voting and Election Day Voting The first display asks if the location is conducting Early Voting. Press Yes or No. 4.4.8. Verify the Polling Place Location Verify that the accurate name of the Polling Place is displayed on the Polling Place Location screen. If the correct location is displayed, press Yes. If not, press No and repeat the steps to enter the Polling Place ID. 4.4.9. Booth Assignment 16 The Booth Assignment screen displays on the JBC, requiring that each eSlate be assigned a booth number. To assign booth numbers to the eSlates: 1. Walk to the booth you want to assign as #1. The screen on the eSlate in the booth should read “Booth Assignment. 2. Press ENTER on the eSlate in that booth. The screen on that eSlate shows: “This is Booth Number: 01” 3. Use the selected signage to indicate Booth #1. Hang the #1 sign on that Booth. 4. Repeat Steps 1 through 3 to assign successive reference numbers to the remainder of the eSlates. When you have assigned a number to each eSlate in every booth, press DONE at the Booth Assignment screen on the JBC. Verify that the number of status lights illuminated on the JBC equates to the number of connected booths. If the booth assignment is correct, press NEXT. 4.4.10. Printing the Zero Tape The voting equipment is ready for the election when the Print Zero Tape operation appears on the screen of the JBC. Press Print Zero Tape. Retain the Zero tape print out as part of the election record. 4.4.11. Opening the Polls The polls can be opened when the Open Polls choice on the Ready To Open Polls screen appears on the JBC. One minute before the polls are scheduled to open, press Open Polls. The printer prints the Polls Opened report. Tear off the printer tape and store it in a polling place records envelope. Announce that the polls are open. 4.5. While the Polls are Open 4.5.1. Issuing an Access Code to a Voter Each voter needs an Access Code to access one of the eSlates. When a voter has signed in and the election judge has verified the voter is registered to vote within the polling place, the judge uses the JBC to enter the voter’s PRECINCT I.D. The precinct ID may be selected from the screen or manually entered to assign the correct ballot type for the voter. The JBC prints the voter’s Access Code on a slip of paper marked “Access Code” (Access Code ticket). 4.5.2. Check the status of an Access Code upon voter requests. Cancel an Access Code if the voter received the wrong ballot type upon entering their Access Code. 17 4.6. Closing the Polls The following procedures must be completed in public view. 4.6.1. Announcement: Promptly at the time declared, announce, “The polls are closed.” 4.6.2. Voters standing in line: Any voter standing in line when it was announced that the polls were closed may cast their vote before the judge presses the Close Polls button on the JBC. 4.6.3. Late Arrivals: No one who arrives after the declared time may be issued an Access Code to vote. 4.6.4. Closing the Polls: After all the voters have finished voting, press the CLOSE POLLS button located below the JBC screen. 4.6.5 Printing Polling Place Report: The Polls Closed screen on the JBC includes the capability for printing the Tally Report. A copy of the Tally Report shall be posted outside each polling place for public inspection. Follow the instructions in the eSlate Election Day Manual. 4.7. Central Counting: Jurisdictional procedures may require that the entire JBC be returned to Election Headquarters, or require that the MBB be removed from the JBC, so that only the MBB is transported to Election Headquarters. 4.7.1. MBB Transport: If the instructions are to remove the MBB from the JBC at the end of the day, remove the Security Seal over the MBB slot on the side of the JBC. Take the MBB out of the slot and place in its carrying case return to Election Headquarters. 4.7.2. JBC Transport: If the instructions require that the entire JBC be transported to Election Headquarters, without removing the MBB, unplug the JBC and disconnect it from the eSlate, then return the JBC to the Election Headquarters. 18 5. Tabulation and Records Retention 5.1. Tabulation On or before Election Day, the BOSS database for the election is used to initialize the Tally database for tallying the election. Acceptable write-in candidate names or aliases are input into Tally. When all the polls have closed, the MBBs from the polling sites are read into the Tally System or Rally station(s). The unique serial number in the MBBs is used to prevent duplicate storage of the information in the MBB. The Tally System tabulates the Cast Vote Records from the PVS MBBs and generates reports that can be viewed on screen and/or printed. When all MBBs have been read by Tally, including MBBs read by Rally, the election officials resolve write-in votes and Provisional Ballots from contested voters. The Tally database is closed and archived when the officials determine all information for the election has been stored and resolved in the Tally System. 5.2. Archiving At the close of the election, all data from the election is to be archived. Archiving of data is a simple process of copying information to a CD. The Tally application stores the complete record of the election. The BOSS database is used to initiate Tally, and when the MBBs are read into Tally, all CVRs and PVS audit data are stored by Tally. By copying the Tally database to CD you have archived the entire election. Data stored by the Rally stations is also archived. It is recommended to archive the BOSS database separately, as well, so that both ends of the election cycle are distinct datasets. This will aid any subsequent review process that may be required. The data is copied to a CD-R disc (a read-only CD) using standard CD- writing software. Once the write process closes the CD-R disc, no additional information can be written to the disc, and the disc will function as a read-only disc. 5.3. Retention · Master copies of the Cast Vote Records and the accumulated results from Tally shall be retained in secure locations designated by the local election official and separate from the location of working copies from the time of completion of pre-election Ballot Inspection and Verification process: · For as long after the election as required by law; or · By order of a court or directive of the Secretary of State After certification of the election results, any changes to the central tabulating software or the ballot results sets shall be completely documented in the central system internal audit log. Ballot control logic source code shall be placed in escrow pursuant to state law. Upon certification of the election results, elections code section 17300 through 17306 and 15307 apply to the handling security and disposition of unused materials. The retention of electronic ballots and related election materials is six months for all elections if no federal elections are involved. The federal 19 election retention period is twenty-two months. Retention periods may be extended in the event of a court challenge. 6. Official Canvass and Post-Election Procedures The official canvass consists of a post-election audit of the polling place returns and the absent voters returns; · To validate the outcome of the election by verifying that there were not more ballots cast than the sum of the numbers of voters who signed the precinct Roster/Index and who applied for and were issued absent voter ballots; · To ensure that all required certificates and oaths were properly executed by the precinct board; and, · To verify the accuracy of the computer count by manually recounting the voter ballots from at least one percent of the voting precincts and comparing the manually-tallied results to the computer-generated results. · Each official canvass function must be performed by a minimum of three persons 6.1. Process provisional ballots · Verify eligibility of provisional ballots · Process in the manner prescribed for Ballot Inspection Boards · Identify original or duplicate provisional ballots by precinct and deliver to the designated official for updating computer tallies 6.2. Reconcile Tabulation · Compare the number of voters on precinct report to the number in the Roster-Index issued by the elections official. Resolve or explain any discrepancy. · Verify that the number of ballots voted (including provisional), plus absentee mail-in equals the number received by the precinct. Resolve or explain any discrepancy. · Reconcile Absent Voter Ballots · The elections official is accountable for absent voter ballots to the same extent, as nearly as practicable, as for precinct ballots. · Process any outstanding absentee ballots not counted in the semi-official count. · Canvassing Write-ins · Examine the write in candidates on the mail absentee ballot and the write in candidates from the write-in report generated from the electronic ballot stations to verify that the names written in are for valid candidates. · Prepare “Statement of Write-In Votes” for inclusion in the official “Certified Statement of Election Results.” 6.3. Automatic Manual Recount in One Percent of the Precincts 6.3.1. Sample size 20 For the purpose of validating the accuracy of the computer count, within fifteen days after every election at which the Electronic Ballot Stations are used, a public manual recount of the ballots cast in at least one percent of the precincts, chosen at random, shall be conducted as to all candidates and ballot measures voted on in each of the precincts. If the random selection of precincts results in an office or ballot measure not being manually recounted, as many additional precincts as necessary shall be selected and manually recounted as to any office or ballot measure not recounted in the original sample 6.3.2. Sample Selection Precincts selected at random pursuant to Elections Code section 15645 shall not be chosen by an individual who is designated by the responsible elections official and who is not the same person responsible for programming the electronic ballot. Selected precinct numbers shall not be revealed to the person/s responsible for programming the electronic ballot until the semi- official count is complete. 6.3.3. Count Discrepancy If a discrepancy is discovered between the automated tally and the automatic manual recount tally, the votes will be tabulated again. 6.3.4 SERVO Post-Election Tasks After an Election, the PVS devices (JBCs and eSlates) are connected to the SERVO PC and the Election data stored in them is backed-up into an Event. The Event could have been created prior to equipment deployment, or at the moment that the backup process begins. NOTE: A single Event is used for the backup of the Election. Recount MBBs SERVO can create MBBs with recount data in a format readable by Tally. The MBBs are created from either the JBCs’ or the eSlates’ backup data contained in a SERVO Event. For recount MBBs, blank (unvoted) BOSS MBBs from the Election are used. Recount MBBs can be produced for either: · Early Voting OR · Election Day voting. For either type of voting, you can create either: · A set of recount MBBs that contains all the CVRs from all the JBCs for an Event. OR · A set of recount MBBs that contains all the CVRs from all the eSlates for an Event. Recovery MBBs 21 SERVO can recreate an MBB that has been lost or damaged. This is called a “recovery MBB.” The MBB is recreated from the backup of the JBC that contained that MBB. For a recovery MBB, a blank (unvoted) BOSS MBB from the Election is used. · In order to create a recovery MBB from the SERVO database, the JBC that contained the MBB must already be backed up in an Event in the SERVO database. To create a recovery MBB from the SERVO database, you will be required to choose either: · The serial number of the missing MBB or · The serial number of the JBC that the missing MBB. 6.4. Manual Recount Procedures 6.4.1. Request for Recount A request for a recount and the conduct of the recount shall be made in accordance with the Elections Code section 15600 and following. 6.4.2. Observers Each candidate and each side in the case of a ballot measure, shall be allowed not more than two observers for each recount board, and may not touch or handle the transport media. All questions must be directed to the elections official in charge of the recount. 6.4.3. Hours of Operation Prior to the beginning of the recount, all parties will be notified of the hours of operation 6.4.4. Ballot Supervision/breaks At least two people will attend ballots at all times during the recount, including breaks and lunch periods. Recount boards will be permitted break periods in the morning and afternoon, in addition to a lunch break. They will not stop for a break or for lunch while recounting a precinct. 7. Audit Logs 7.1. BOSS Audit Log The BOSS Audit Trail report provides audit trail data of activity in the BOSS database for an election. The date, time, event name, transaction type, and user ID is included for each event printed in the BOSS Audit Trail report. The operator can view and/or print the BOSS Audit Trail report at any time during the creation of an 22 election. The primary sort order for the report is alphanumeric by timestamp; the secondary sort order for the report is alphanumeric by action. 7.2. PVS Audit Log The Precinct Voting System maintains a complete electronic audit trail of all events that occur during the voting process. From the point that the JBC receives power to begin the voting process, entries are made to the Audit Log. Beginning with the results of the power on self-test through to the time that power was removed, any event that changes the state of the system or data is recorded with a time and date stamp. The detail contained in the resulting Audit Log is very specific and includes the time and date that each vote was cast (but not the ballot itself). A complete network Audit Log is saved both in the JBC internal memory and in the MBB as events occur. Each eSlate connected to the network maintains its own, separate Audit Log of events, specific to that eSlate. All Audit Log entries are saved in FLASH memory so therefore are unaffected by power cycling. · The Precinct Voting System contains an audit trail that can be used to reconstruct · events in an election. This audit log contains the following information: · Audit Code – Unique code identifying the type of audit entry (16-bits) · Date/Time – Data/Time of the entry (32-bits) · Status/Data – Status of the entry Pass/Fail (32-bits) · Data – Data associated with audit log 32 Bits · CRC – 16 Bit CRC of the Audit log entry 7.3. Tally Audit Log -- Real-Time Print-Out The Tally System application prints a real-time audit log to the system line printer. The real-time audit messages include a log of the operator’s activities with the Tally System application and error messages presented during a session. The date, time, event name, and user ID is included for each event printed in the audit log. 8. Certification and Reporting Requirements 8.1. Biennial Certification of Hardware Elections code section 19220 requires elections official to inspect and certify the accuracy of their voting equipment at least once every two years. The elections official shall certify the results of this inspection to the Secretary of State. 8.2. Hardware Certification and Notification 8.2.1. Certification All vote tabulating equipment must be certified for use in elections by the Secretary of State prior to use in any election Certification Procedures are available upon request from the Secretary of State's Elections Division. 8.2.2. Notification 23 For each statewide election the responsible county official shall cause to be prepared a list, including quantities, of all equipment to be used to tabulate votes during the semi-official and official canvass. · Seven days before each statewide election, the elections official shall certify to the Secretary of State the results of the logic tests as well as the accurate functioning of all ballot counting equipment. This certification shall also affirm the use of the same equipment for pre-election testing and for semi- official and official vote canvass. In the event of a change to the ballot tabulation program occurring after this certification an amended certificate shall be submitted no later than the day before the election. · In the event any equipment is repaired, altered or replaced following the certification specified, and prior to completion of the official canvass of the vote, an amended certification of logic and accuracy testing and a revised list of equipment used must be submitted to the Secretary of State not later than submission of official canvass results. 8.3. Election Observer Panel All procedures prescribed herein shall be carried out in full view of the public insofar as feasible. In addition, the responsible elections official shall devise a plan, subject to the approval of the Secretary of State, whereby all critical procedures of the vote tabulation process described herein are open to observation by an Election Observer Panel. Representatives of the qualified political parties and representatives of the news media shall be among those invited to serve on this Panel and shall be given the opportunity to observe that the correct procedures have been followed in the receiving, processing and tabulation of the voted electronic ballots. 8.4. Logic and Accuracy Certification 8.4.1. Logic and Accuracy Board shall be appointed by the responsible elections official and, insofar as is practicable, shall be comprised of the same persons prior to, during, and after the election. The board shall have the following duties: 8.4.2. Receive from the elections official all required test materials and take steps to ensure the security of said materials prior to, during, and after the election, except when the materials are properly in the possession of one of the other boards of elections officials as required by these procedures. 8.4.3. Verify the correctness of the program, logic and accuracy test program. This verification shall also be required for any of said material that must be replaced. 8.4.4. Observe the performance and verify results of all required tests. 8.4.5. Note any discrepancies and problems and affirm their resolution or correction. 24 8.4.6. Deliver into the custody of the elections official all required test materials and printed output. 8.4.7. Certify to the performance of each of the above prescribed duties as well as those otherwise established by the procedures; provided that all members of the Board shall sign the appropriate certificate or certificates. Final pre- election certification shall be made to the Secretary of State no less than seven days before each statewide election. The responsible election official shall make this certification based on the Logic and Accuracy Board's certification of successful testing. In the event an amendment to the ballot counting program is required following this certification, the elections official must immediately re-certify to the Secretary of State. 9. Computer Security and Recovery 9.1 General Security Considerations The idea of computer security is to secure your computer and your eSlate Electronic Voting System software application against unauthorized use, alteration, or deletion. The people against whom you are securing your computer vary from the co-worker who wants to surf the Internet to hackers attempting to subvert elections. Computer security is always a balancing act between security and ease of use. In the following you will find tips and techniques towards maintaining a secure computer environment. It is up to the election administrator to choose and implement the appropriate level of computer security. 9.2 Physical Security 9.2.1 Controlled Access Environment Computers should be operated in a room that is limited to only authorized personnel. The room should be locked except during working hours. 9.2.2 Lock Your Computer to a Desk Computers should be locked to a desk, table, or stanchion using a Kensington or similar lock. The cost of recreating the data lost in a stolen election computer could be many times the cost of the computer itself. 9.2.3 Lock Your Computer Housing The housing of a computer should be locked to prevent unauthorized people from accessing the computer boards, memory and hard drives. No data is safe from talented intruders with access to the inside of your computer. 9.2.4 Lock Your Floppy Drive and CD Drive The floppy drive and CD drive of your computer should be physically locked against unauthorized use. Hackers that can boot your machine onto their floppy or CD may be able to install malicious software on your computer, read your hard drive, or alter your BIOS settings. 25 9.2.5 No Network The computer running the eSlate Electronic Voting System election software should not be connected to a county’s computer network. Most computer security attacks are through a network, which allows a hacker to work anonymously and provides a handy access path to your computer. 9.2.6 No Internet Access The computer running the eSlate Electronic Voting System election software should not have access to the Internet. Computer security attacks can be made through active Internet connections. In addition, even an employee innocently browsing the web can unknowingly download malicious viruses. 9.3 Disaster Security Back Up Your Data: Frequently back up important election data created using eSlate Electronic Voting System election software. Properly label back-up data disks and store them in a secure location. 9.4 Operational Security 9.4.1 Always Log Off Computer Log off your computer anytime you are not actively using the eSlate Electronic Voting System election software, even if you leave your terminal for just a few minutes. 9.4.2 Never Give Administration Privileges If the county is given administration passwords with the computer hosting the eSlate Electronic Voting System election software, administrators must never give the administration password to any regular operator. A regular election worker can perform his or her work well without the use of administrator passwords. An election official should never log in as an administrator unless they need to perform a function only available as an administrator. At least two persons in the jurisdiction should have administrator passwords. 9.4.3 The BOSS software supports user permissions identified as “ALL” and “Update”. Under certain conditions in BOSS release version 3.03.44, some functions performed when logged under an “All” permission will remove permissions for performing some functions by an “Update” user. These Update functions include: Create database, enter districts/precincts and import translated text. If this condition occurs, see the system administrator. 9.5 Data Security 9.5.1 Never Run Personal Software on Computer 26 No personal software of any kind should be run on computers hosting eSlate Electronic Voting System election software. These computers should be used for election purposes only. No programs should be installed unless authorized personnel have previously approved them and they have been tested for viruses, worms, Trojan horses or other malicious code. Even seemingly innocent software can introduce viruses into your computer. 9.5.2 Protect Against Viruses Regularly run the anti-virus software that comes standard on your eSlate Electronic Voting System computer. Be sure to run the software immediately prior to each election. Register the computer with your county’s computer support specialist so they can provide anti-virus software updates as they become available. 9.5.3 Password Security Selecting, storing, and changing your password properly is vital to computer security. A typical 8-character password has trillions of possible combinations and, if properly picked and managed, can help keep your computer be secure. But passwords that are taped to the screen or keyboard, passwords that the user has used on their primary desktop machine, or passwords like “bob2” are not very secure at all. Never give anyone your password or let them use your login. 9.5.4 Change Your Password Frequently Your password should be changed at least every 6 months and before each election. Immediately change the password when the administrator gives it to you initially. Administrators should remove usernames and passwords when employees are no longer engaged in election business. 9.6 Precinct Voting Security Voting terminals should be kept in a secure location after being programmed for the election both before and after distribution to the precinct. 9.7 Security Seals Security seals that are tamper evident should be installed on any key locks, access doors/panels, and unused ports on any component of the system. Logs should be kept to record the use of each seal. 10 Software Operation and System State Software is not bug-free. The most popular computer operating system in the world still has software bugs in it that can cause your computer to produce an error or lock-up. The same is possible for your eSlate Electronic Voting System election software. The eSlate Electronic Voting System election software has an extensive list of error messages that are displayed in clear English and are related to whatever action you were involved in at the time of its occurrence. This is not an abnormal system state and is resolved by acknowledging the error and correcting the condition. An abnormal system state results in a cryptic “computer-type” message. Given the combination of 27 the operating system (Windows NT) and the eSlate Electronic Voting System applications, you may encounter an abnormal system state. If such a state occurs within one of your eSlate Electronic Voting System election software applications, your data is safe. The applications are designed to require frequent “saves” of your data, so should an error or lock-up occur, the data that existed at the time of your last save action is secure. In all cases, write down the exact error message, the conditions under which it occurred, and forward the information to your customer service contact. In most instances, you will be able to continue working by resolving the error or power cycling the computer. Match your condition to those given below and follow the steps given for each. 10.1 Error message with “OK” button Read the error message and write it down. If the message contains any information about the data that you were entering at the time, it should indicate the problem, select “OK” and correct the data or re-try the event. If no description is given, select “OK” and continue with your task. If the problem persists, contact customer service. 10.2 Application locks-up If the application locks-up, the mouse pointer or the keyboard will not responds. By pressing CONTROL-ALT-DELETE, the Windows NT Task Manager will come up and allow you to shut down the application. Again, data entered and saved is safe. If the problem persists, contact customer service. 10.3 Windows NT error or locks-up Windows errors or lock-up are best resolved by either shutting down the task causing the problem as described above, or by power-cycling the computer. Power cycling requires the power be turned off and then back on again. When Windows is shut down in this manner and subsequently turned back on, Windows will run a series of diagnostics that you my have to respond to. If the problem persists, contact customer service. 28