Staff Report: Item 4A

HART ESLATE SYSTEM Hart Intercivic eSlate System Version 3.4 (BOSS Version 3.4.0, Ballot Now Version 2.3, Servo Version 2.0.10, Rally Version 1.2.0, Tally Version 3.2.0, eSlate 3000 Version 2.3.8, JBC 1000 version 2.3.8), the KODAK I830 AND THE FUJITSU 4099 Administrative Review and Analysis Prepared by: Secretary of State Elections Division September 10, 2004 ________________________________________________________________________________________________________ HART ESLATE SYSTEM V. 3.4 SEPTEMBER 10, 2004 Table of Contents I. Summary of the Application ....................................................................................................3 II. Summary of the System ..........................................................................................................3 III. Testing Information and Results .............................................................................................5 IV. Compliance with State and Federal Laws and Regulations ...................................................5 V. Additional Considerations .......................................................................................................17 VI. Public Comment ....................................................................................................................17 VII. Recommendation ...................................................................................................................17 ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 2 of 18 I. SUMMARY OF THE APPLICATION Procedures, hardware, firmware and software developed by Hart Intercivic for use with its eSlate Voting System v. 3.4, the Kodak i830 and the Fujitsu 4099. The eSlate Voting System v. 3.4 consists of several subcomponents BOSS version 3.5.4, Ballot Now v. 2.3, Servo v. 2.0.10, Rally v. 1.2.0, Tally v. 3.2.0, eSlate 3000 v. 2.3.8 and JBC 1000 v. 2.3.8. II. SUMMARY OF THE SYSTEM This proposed system would be a modification to the eSlate Direct Recording Electronic (DRE) and Ballot Now optical scan voting systems currently used and configured in California. The application consists of nine voting system components. 1. BOSS v. 3.5.4 BOSS is a software package used before an election by a jurisdiction to create the ballot definition for that election. BOSS is then used to program the Mobile Ballot Boxes (MBBs) used by both the eSlate and Ballot Now systems. The modifications to the software from the previously certified version of BOSS (v. 3.4.0) consist of anomaly fixes. These include improvements to the audio function and changes to the list of alternative languages available. 2. Ballot Now v. 2.3 Ballot Now v. 2.3 is a software package used in conjunction with Hart Intercivic’s optical scan voting system. Before an election, Ballot Now takes the information stored on the MBBs and uses it to produce paper ballots. After an election, Ballot Now takes the ballot images stored by the optical scanners and is used to resolve any ballots needing human intervention to determine voter intent. Ballot Now does not tally ballots. The modifications to the software from the previously certified version of Ballot Now (v. 2.2.6) consist of two anomaly fixes related to ballot resolution. 3. Servo v. 2.0.10 Servo is a software package used to back-up data from the JBCs and eSlates and to reset them for a new election. There have been no changes to Servo from the previously certified version. 4. Rally v. 1.2.0 ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 3 of 18 Rally is a software package used to collect data from the MBBs so that it can then be transferred to Tally. There have been no changes to Rally from the previously certified version. 5. Tally v. 3.2.0 Tally is a software package used to collect and tabulate election returns from throughout the jurisdiction. Tally also contains a series of reporting functions. There have been no changes to Rally from the previously certified version. 6. JBC 1000 v. 2.3.8 The JBC is used by the poll worker to issue voter access codes to the voter that is then used to activate the eSlate. The poll worker to manage the voting equipment and to generate opening, closing and audit reports also uses the JBC. Finally the JBC is used to collect votes from the individual eSlates that are connected directly to the JBC The modifications to the software from the previously certified version of Ballot Now (v. 2.0.13) consist primarily of added functionalities. Two of these are of note. First, the system has been modified to support the use of a barcode reader to issue voter access codes. The second is a change that excludes provisional ballots from the tally tape produced by the JBC. 7. eSlate 3000 v. 2.3.8 eSlate v. 2.3.8 is the firmware package used by the DRE voting system. Using a voter access code issued by the JBC the voter activates the eSlate. The voter then makes his/her selections using a set of controls on the bottom of the unit. Units designed to be accessible to the blind or visually impaired also include a separate set of additional controls and audio functionality to lead the voter through the selection and ballot casting procedures. The application does not include any modifications to the hardware of the eSlate. The modifications to the software from the previously certified version of the eSlate(v. 2.0.13) consisted of both added functionalities and anomaly corrections. The major added functionality was support for contests that wrapped onto more than one page. 8/9. Kodak i830/Fujitsu 4099 The Kodak i830 and Fujutsu 4099 are the optical scanners used in the only jurisdiction currently using the Hart system (Orange). These scanners are used to scan and capture the ballot image from the cast ballots. These scanners are unmodified commercial off the shelf pieces of (COTS) equipment that do not tabulate the ballots. ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 4 of 18 III. TESTING INFORMATION AND RESULTS 1. Federal Testing All of the system components covered in the application have been federally qualified under NASED # N-1-04-12-12-005. The qualification is to the 1990 standards. 2. State Testing by the Secretary of State and Consultant. The system was tested in Sacramento, California on August 30, 2004 and August 31, 2004 by Secretary of State staff in conjunction with the state’s technical expert, Mr. Steve Freeman. The Kodak i830 and Fujutsu 4099 were not available and were not included in the state testing. In addition, during testing it was identified that the vendor had developed several additional stand-alone utilities beyond the 3.4 system that added additional functionality to the system. None of these were required to meet California requirements and were not included in the state testing. IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS The Secretary of State of California has developed and promulgated a procedure for approving, certifying, reviewing, modifying, and decertifying voting systems, vote tabulating systems, election observer panel plans, and auxiliary equipment, materials and procedures. Four sections of this procedure, Sections 103, 104, 504, and 601, describe in detail the requirements any voting system must meet in order to be approved for use in California elections. These sections will be described in detail and the system will be analyzed for compliance in this Administrative Review and Analysis of the system. 1. §103 (a) (1): The machine or device and its software shall be suitable for the purpose for which it is intended. The system meets this requirement. 2. §103 (a) (2): The system shall preserve the secrecy of the ballot. The system meets this requirement. ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 5 of 18 3. §103 (a) (3): The system shall be safe from fraud or manipulation. The proposed system includes modifications to the current use procedures designed to improve the overall security of the system. 4. §103 (a) (4): The system shall be auditable for the purposes of an election recount or contest procedure. The system meets current requirements relating to audits for the purposes of an election recount or contest procedures. The system does not include an Accessible Voter Verified Paper Audit trail (AVVPAT) as required in jurisdictions where the system was not used in the March 2004 primary election and in all jurisdictions beginning July 1, 2006. 5. §103 (a) (5): The system shall comply with all appropriate federal and California laws and regulations. The system meets this requirement. 6. §103 (a) (6): The system shall have been certified, if applicable, by means of qualification testing by a Nationally Recognized Test Laboratory (NRTL) and shall meet or exceed the minimum requirements set forth in the Performance and Test Standards for Punch Card, Mark Sense, and Direct Recording Electronic Voting Systems, or in any successor voluntary standard document, developed and promulgated by the Federal Election Commission. The system has been federally qualified to the 1990 standards. 7. §103 (b): In addition to the requirements of subdivision (a) of this section, voting systems, procedures, and equipment approved and certified by the Secretary of State shall promote accessible voting opportunities for persons with physical disabilities. The system is at least as accessible as the currently certified version. It includes improvements to the audio function. 8. §104 (a): Certification consists of three separate levels of testing: qualification, certification and acceptance. Qualification was completed to the 1990 qualification standards. A technical consultant to the Secretary of State performed state certification testing. Acceptance testing will be conducted by the county elections official once a county takes receipt of the modifications. ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 6 of 18 9. §104 (b): Certification tests shall include functional tests and qualitative assessment to ensure that the system operates in a manner that is acceptable under federal and state law and regulations. It is the opinion of the expert technical consultant that the scope of the certification test was adequate to make basic recommendations and observations about the logical accuracy, some user friendliness issues, and compliance with state law. 10. §104 (c): Certification tests shall enhance public confidence by assuring that the system protects the secrecy of the ballot and the security of the voting process, and records and counts votes accurately. The proposed system includes modifications to the current use procedures designed to improve the overall security of the system. 11. §104 (d): Certification tests shall promote public confidence that the system is easy to use or ‘voter friendly.’ The proposed system is at least as voter friendly than the currently certified system. The addition of the barcode function to the JBC may make the system more voter/poll worker friendly. 12. §104 (e): Certification testing shall demonstrate that the system creates an audit trail showing both that the voter was able to vote for the candidate or for or against a measure of his or her choice and that the system correctly and consistently interpreted the voter’s votes. The system meets this requirement. 13. §504: The Evaluation shall include a review of California Elections Code sections, which address the application. A review of the appropriate Elections Code sections was conducted. §15360. During the official canvass of every election in which a voting system is used, the official conducting the election shall conduct a public manual tally of the ballots tabulated by those devices cast in 1 percent of the precincts chosen at random by the elections official. If 1 percent of the precincts should be less than one whole precinct, the tally shall be conducted in one precinct chosen at random by the elections official. In addition to the 1 percent count, the elections official shall, for each race not included in the initial group of precincts, count one additional precinct. The manual tally shall apply only to the race not previously counted. ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 7 of 18 The system meets this requirement. §19300 permit the voter to vote for all the candidates of one party or in part for the candidates of one party and in part for the candidates of one or more other parties. The system meets this requirement. §19301. A voting machine shall provide in the general election for grouping under the name of the office to be voted on, all the candidates for the office with the designation of the parties, if any, by which they were respectively nominated. The designation may be by usual or reasonable abbreviation of party names. The system meets this requirement. §19302. The labels on voting machines and the way in which candidates’ names are grouped shall conform as nearly as possible to the form of ballot provided for in elections where voting machines are not used. The system meets this requirement. §19303. If the voting machine is so constructed that a voter can cast a vote in part for presidential electors of one party and in part for those of one or more other parties or those not nominated by any party, it may also be provided with: (a) one device for each party for voting for all the presidential electors of that party by one operation, (b) a ballot label therefore containing only the words “presidential electors” preceded by the name of the party and followed by the names of its candidates for the offices of President and Vice President, and (c) a registering device therefore which shall register the vote cast for the electors when thus voted collectively. If a voting machine is so constructed that a voter can cast a vote in part for delegates to a national party convention of one party and in part for those of one or more other parties or those not nominated by any party, it may be provided with one device for each party for voting by one operation for each group of candidates to national conventions that may be voted for as a group according to the law governing presidential primaries. No straight party voting device shall be used except for delegates to a national convention or for presidential electors. The system complies with these requirements. ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 8 of 18 §19304. A write-in ballot shall be cast in its appropriate place on the machine, or it shall be void and not counted. The systems allows for write-in votes. §19320. Before preparing a voting machine for any general election, the elections official shall mail written notice to the chairperson of the county central committee of at least two of the principal political parties, stating the time and place where machines will be prepared. At the specified time, one representative of each of the political parties shall be afforded an opportunity to see that the machines are in proper condition for use in the election. The party representatives shall be sworn to perform faithfully their duties but shall not interfere with the officials or assume any of their duties. When a machine has been so examined by the representatives, it shall be sealed with a numbered metal seal. The representatives shall certify to the number of the machines, whether all of the counters are set at zero (000), and the number registered on the protective counter and on the seal. The system meets this requirement. §19321. The elections official shall affix ballot labels to the machines to correspond with the sample ballot for the election. He or she shall employ competent persons to assist him or her in affixing the labels and in putting the machines in order. Each machine shall be tested to ascertain whether it is operating properly. The system meets this requirement. §19322. When a voting machine has been properly prepared for an election, it shall be locked against voting and sealed. After that initial preparation, a member of the precinct board or some duly authorized person, other than the one preparing the machines, shall inspect each machine and submit a written report. The report shall note the following: (1) Whether all of the registering counters are set at zero (000), (2) whether the machine is arranged in all respects in good order for the election, (3) whether the machine is locked, (4) the number on the protective counter, (5) the number on the seal. The keys shall be delivered to the election board together with a copy of the written report, made on the proper blanks, stating that the machine is in every way properly prepared for the election. The system meets this requirement. ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 9 of 18 §19340. Any member of a precinct board who has not previously attended a training class in the use of the voting machines and the duties of a board member shall be required to do so, unless appointed to fill an emergency vacancy. The system meets this requirement. §19341. The precinct board shall consist of one inspector and two judges who shall be appointed and compensated pursuant to the general election laws. One additional inspector or judge shall be appointed for each additional voting machine used in the polling place. The system meets this requirement. §19360. Before unsealing the envelope containing the keys and opening the doors concealing the counters the precinct board shall determine that the number on the seal on the machine and the number registered on the protective counter correspond to the numbers on the envelope. Each member of the precinct board shall then carefully examine the counters to see that each registers zero (000). If the machine is provided with embossing, printing, or photography devices that record the readings of the counters the board shall, instead of opening the counter compartment, cause a “before election proof sheet” to be produced and determined by it that all counters register zero (000). If any discrepancy is found in the numbers registered on the counters or the “before election proof sheet” the precinct board shall make, sign, and post a written statement attesting to this fact. In filling out the statement of return of votes cast, the precinct board shall subtract any number shown on the counter from the number shown on the counter at the close of the polls. The system meets this requirement. §19361. The keys to the voting machines shall be delivered to the precinct board no later than 12 hours before the opening of the polls. They shall be in an envelope upon which is written the designation and location of the election precinct, the number of the voting machine, the number on the seal, and the number registered on the protective counter. The precinct board member receiving the key shall sign a receipt. ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 10 of 18 The envelope shall not be opened until at least two members of the precinct board are present to determine that the envelope has not been opened. At the close of the polls the keys shall be placed in the envelope supplied by the official and the number of the machine, the number written on the envelope. The system meets this requirement. §19362. The exterior of the voting machine and every part of the polling place shall be in plain view of the election precinct board and the poll watchers. Each machine shall be at least four feet from the poll clerk’s table. The system meets this requirement. §19363. Voters shall not remain in or occupy the booths or compartments longer than is necessary to mark their ballots, which shall not exceed five minutes. However, where no other voter would be inconvenienced, a longer period shall be allowed. The system meets this requirement. §19370. As soon as the polls are closed, the precinct board, in the presence of the watchers and all others lawfully present, shall immediately lock the voting machine against voting and open the counting compartments, giving full view of all counter numbers. A board member shall in the order of the offices as their titles are arranged on the machine, read and distinctly announce the name or designating number and letter on each counter for each candidate’s name and the result as shown by the counter numbers. He or she shall also in the same manner announce the vote on each measure. If the machine is provided with a recording device, in lieu of opening the counter compartment the precinct board shall proceed to operate the mechanism to produce the statement of return of votes cast record in a minimum of three copies, remove the irregular ballot, if any, record on the statement of return of votes cast record. The irregular ballot shall, be attached to the statement of result record of votes cast for the machine and become a part thereof. One copy of the statement of return of votes cast for each machine shall be posted upon the outside wall of the precinct for all to see. The statement of return of votes cast for each machine for the precinct shall constitute the precinct statement of result of votes cast. The system meets this requirement. ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 11 of 18 §19371. Before adjourning, the precinct board shall seal the operating lever with the seal provided and lock the machine so that the voting and counting mechanism may not be operated. It shall remain locked and sealed against operation until the time for filing a contest of election has expired, which shall not exceed a period of 30 days following the declaration of the result of the election by the body canvassing the returns. Does not apply. §19380. During the reading of the result of votes cast, any candidate or watcher who may desire to be present shall be admitted to the polling place. The proclamation of the result of the votes cast shall be distinctly announced by the precinct board who shall read the name of each candidate, or the designating number and letter of his or her counter, and the vote registered on the counter. The board shall also read the vote cast for and against each measure submitted. The board shall not count votes cast for write-in candidates, but shall have these counted by the elections official. During the proclamation, many opportunities shall be given to any person lawfully present to compare the result so announced with the counter dials of the machine, and any necessary corrections shall immediately be made by the precinct board, after which the doors of the voting machine shall be closed and locked. If the machine is provided with a recording device, the alternate procedures in Section 19370 may be used. The system meets this requirement. §19381. In each election district where voting machines are used, statements of the results of the vote cast shall be printed to conform with the type of voting machine used. The designating number and letter on the counter for each candidate shall be printed next to the candidate’s name on the statements of result of the vote cast. Two such statements shall be used in each election district. The system meets this requirement. §19382. The statement of the result of votes cast, which shall be certified by the precinct board, shall contain: (a) The total number of votes cast. (b) The number of votes cast for each candidate and measure as shown on the counter. (c) The number of votes for persons not nominated. ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 12 of 18 (d) Printed directions to the precinct board for their guidance before the polls are opened and when the polls are closed. (e) A certificate, which shall be signed by the election officers before the polls are opened, showing: (1) The delivery of the keys in a sealed envelope. (2) The number on the seal. (3) The number registered on the protective counter. (4) Whether all of the counters are set at zero (000). (5) Whether the public counter is set at zero (000). (6) Whether the ballot labels are properly placed in the machine. (f) A certificate that shall be filled out after the polls have been closed, showing: (1) That the machine has been locked against voting and sealed. (2) The number of voters as shown on the public counter. (3) The number on the seal. (4) The number registered on the protective counter. (5) That the voting machine is closed and locked. The system meets this requirement. §19383. A member of the precinct board shall enter the vote, as registered, on the statements of result of votes cast, in the same order on the space that has the same name or designating number and letter, after which another member shall verify the figures by calling them off in the same manner from the counters of the machine. The counter compartment of the voting machine shall remain open until the official returns and all other reports have been fully completed and verified by the precinct board. If the machine is provided with a recording device, the alternate procedures in Section 19370 may be used. The system meets this requirement. §19384. The precinct board shall, before it adjourns, post conspicuously on the outside of the polling place a copy of the result of the votes cast at the polling place. The copy of the result shall be signed by the members of the precinct board. If the machine is provided with a recording device, the statement of result of vote’s cast produced by operating its mechanism may be considered the “result of the votes cast” at the polling place. The system meets this requirement. §19385. The precinct board shall immediately transmit unsealed to the elections official a copy of the result of the votes cast at the polling place, the ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 13 of 18 copy shall be signed by the members of the precinct board, and shall be open to public inspection. The system meets this requirement. §19386. Before proceeding to canvass the returns of an election at which voting machines have been used to register the votes cast, the board authorized to canvass returns shall open the counter compartment and compare the records of votes cast for the several candidates voted for and for and against the several measures voted upon shown on each machine with those recorded on the statement of results of votes cast prepared from that machine by the precinct board. Any errors found on the statement shall be corrected by crossing out the recorded incorrect number, and recording the correct number nearby. The system meets this requirement. 14. §504 (b): A review of federal statutes or regulations, which address the application. The Voting Rights Act of 1965, as amended (42 U.S.C. 1973), requires all elections in certain covered jurisdictions to provide registration and voting materials and oral assistance in the language of a qualified language minority group in addition to English. Currently in California, there are six VRA languages (Spanish, Chinese, Japanese, Vietnamese Korean and Tagalog) as prescribed under the law. Information can be displayed by on the DRE in additional languages as required by the jurisdiction for all required languages. Tagalog has been renamed Filipino in the new version. The National Voter Registration Act of 1993 (42 U.S.C. 1973gg and 11 CFR 8) allows for the casting of provisional ballots through Fail-Safe Voting procedures. The system allows for the casting of fail-safe or provisional ballots using the Ballot Now system. The eSlate system is not capable of handling provisional ballots, as it does not allow for the counting of only the portion of the ballot for which the voter was eligible to vote. The Voting Accessibility for the Elderly and Handicapped Act of 1984 (42 U.S.C. 1973ee through 1973ee-6) requires each political subdivision conducting elections within each state to assure that all polling places for federal elections are accessible to elderly and handicapped voters, except in the case of an emergency as determined by the state’s chief election officer or unless the state’s chief election officer: (1) determines, by surveying all potential polling places, that no such place in the area is accessible or can be made temporarily accessible, and (2) assures that any handicapped voter assigned to an inaccessible polling place will, upon advance ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 14 of 18 request under established state procedures, either be assigned to an accessible polling place or be provided an alternative means of casting a ballot on election day. The system is at least as accessible as the currently certified version. It includes improvements to the audio function. The Retention of Voting Documentation (42 U.S.C. 1974 through 1974e) statute applies in all jurisdictions and to all elections in which a federal candidate is on a ballot. It requires elections officials to preserve for 22 months all records and papers which came into their possession relating to an application, registration, payment of a poll tax, or other act requisite to voting. Note: The US Department of Justice considers this law to cover all voter registration records, all poll lists and similar documents reflecting the identity of voters casting ballots at the polls, all applications for absentee ballots, all envelopes in which absentee ballots are returned for tabulation, all documents containing oaths of voters, all documents relating to challenges to voters or absentee ballots, all tally sheets and canvass reports, all records reflecting the appointment of persons entitled to act as poll officials or poll watchers, and all computer programs used to tabulate votes electronically. In addition, it is the Department of Justice’s view that the phrase “other act requisite to voting” requires the retention of the ballots themselves, at least in those jurisdictions where a voter’s electoral preference is manifested by marking a piece of paper or by punching holes in a computer card. The system allows for the retention of the electronic record of the ballots. 15. 504 (c): A copy of the approved Qualification Test results released directly to the Secretary of State by a Nationally Recognized Test Laboratory (NRTL). All required reports from the Independent Testing Authorities (ITAs) have been received. 16. §504 (d): A review, if applicable, of transcripts or other materials from prior meetings or hearings on the proposed system, procedure, or modification, either in whole or in part. The relevant documentation has been reviewed. 17. §504 (e): A review, if applicable, of any procedures manuals, guidelines or other materials adopted for use with the system addressed by the application. The procedures for use with this system have been reviewed. 18. §504 (f): A review of any effect the application will have on the security of the election system. The proposed system includes modifications to the current use procedures designed to improve the overall security of the system. ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 15 of 18 19. §504 (g): A review of any effect the application will have on the accuracy of the election system. The system was tested by federal and state testers and deemed to record votes accurately. 20. §504 (h): A review of any effect the application will have on the ease and convenience with which voters use the system. The proposed system is not any less voter friendly than the currently certified system. The added functionality of the barcode with the JBC may increase ease and convenience for voters and poll workers. 21. §504 (i): A review of any effect the application will have on the timeliness of vote reporting. The proposed system should not affect the timeliness of vote reporting. 22. §504 (j): A review of any effect the application will have on the overall efficiency of the election system. The proposed system is presumably more efficient than the currently certified system as it contains correction to anomalies as well as added functionality. 23. §504 (k): A Description of Deposit Materials showing that the Ballot Tally Software Source Code has been deposited in Escrow with an Escrow Company approved pursuant to Chapter 6, Division 7, Title 2 of the California Administrative Code, beginning with Section 20630. Proof of Escrow documents have been received by the Secretary of State’s office. 24. §601: The Secretary of State shall not approve a proposed item without a finding that the item conforms to all applicable laws, procedures and regulations, including the right to a secret ballot, does not compromise the accuracy, security or integrity of the election process, nor interferes with the voter’s ease and convenience in voting. The proposed system maintains the secrecy of the ballot, the accuracy, security and integrity of the elections process and does not interfering with the voter’s ease and convenience in voting at least as effectively as the currently certified system. ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 16 of 18 V. ADDITIONAL CONSIDERATIONS 1. Accessible Voter Verified Paper Audit Trail Standards The system does not include an Accessible Voter Verified Paper Audit Trail (AVVPAT). Therefore, under the June 15, 2004 AVVPAT standards and the April 30, 2004 decertification directive, the proposed eSlate system can only be used in jurisdictions that used the system in the March 2004 election. Further, the proposed system, without a modification to include an AVVPAT, can only be used through July 1, 2006 in those jurisdictions. 2. Decertification and Withdrawal of Approval of Certain DRE Voting Systems and Conditional Approval of the Use of Certain DRE Voting Systems. The Secretary of State has imposed a series of additional security requirements for the use of DRE voting systems not including an AVVPAT. VI. PUBLIC COMMENT In response to the public meeting notice being issued and allowing for written submissions, we have received no correspondences specific to this application. VII. RECOMMENDATION Staff recommends the certification of Hart Intercivic’s eSlate System Version 3.4 consisting of BOSS Version 3.4.0, Ballot Now Version 2.3, Servo Version 2.0.10, Rally Version 1.2.0, Tally Version 3.2.0, eSlate 3000 Version 2.3.8, JBC 1000 version 2.3.8 along with the Kodak i830 and the Fujitsu 4099 with the following conditions: 1. Staff from the Secretary of State’s office shall successfully test the Kodak i830 and Fujitsu 4099 in conjunction with System version 3.4 by October 5, 2004. 2. No additional software developed by Hart Intercivic other than that specifically listed in this certification shall be installed on a computer running BOSS v. 3.4.0, Ballot Now v. 2.3, Servo v. 2.0.10, Rally v. 1.2.0 or Tally v. 3.2.0. 3. The voting system shall only be used if the requestor complies with the security measures contain in the directive of the Secretary of State dated April 30, 2004 entitled Decertification and Withdrawal of Approval of Certain DRE ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 17 of 18 Voting Systems and Conditional Approval of the Use of Certain DRE Voting Systems. 4. The voting system shall only be used in the County of Orange and only if the county using the Voting System complies with the security measures that apply to the county as contained in the directive of the Secretary of State dated April 30, 2004, entitled Decertification and Withdrawal of Approval of Certain DRE Voting Systems and Conditional Approval of the Use of Certain DRE Voting Systems, as further clarified by the Secretary of State’s memorandum dated May 14, 2004, and any other agreement between the county and the Secretary of State. 5. The voting system shall not be used after July 1, 2006, or such earlier date as provided for by statute unless it is modified to include an accessible, voter- verified paper audit trail and is approved or certified for use by the Secretary of State with such a feature. 6. The Secretary of State reserves the right, with reasonable notice to the requestor and to the counties using the Voting System, to modify the Procedures used with the Voting System and to impose additional requirements with respect to the use of the system if the Secretary of State determines that such modifications or additions are necessary to enhance the accuracy, reliability or security of the Voting System. ________________________________________________________________________________________________________ Hart eSlate System v. 3.4 September 10, 2004 Page 18 of 18