Proposed Use Procedures

Voting System Use Procedures for California Hart Voting System 6.1 These procedures have been adopted by the Secretary of State pursuant to Elections Code sections 19100 and 19205 and shall regulate and govern the use of the Hart Voting System at all elections governed by the California Elections Code. These procedures shall be effective beginning December 2005 and shall be used in conjunction with all other statutory and regulatory requirements. Insofar as feasible, all procedures prescribed herein shall be carried out in full view of the public. These procedures constitute a minimum standard of performance. They are not intended to preclude additional steps being taken by individual election officials to enhance the security and reliability of the electoral process. This DOCUMENT contains confidential Hart InterCivic and proprietary information belonging exclusively to Hart InterCivic, Inc. No Part Number: 6000-122 REV: I part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means electronic, Part Name Spec, Procedure, California, eSlate mechanical, photocopied, recorded, or otherwise without prior written permission File Name: Spec_Procedure_California_eSlate.doc of Hart InterCivic, Inc. Page 1 of 49501 Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I Change History Version Date Author Description A 11-11-02 Sandy Green Initial Release B 2/19/03 Sandy Green Addition of Multilanguage, SERVO System, tabulation and records retention, and recount procedures. C 12/2/03 Neil McClure Addition of Rally application D 12/9/03 Neil McClure Added section 9.4.3 under Operational Security E 9/9/04 Neil McClure Changes to security to support System 3.4 F 9/20/04 Sandy Green Addition of JBC Tally Report posting requirement G 07/27/05 Linda Woods, Re-structured to meet California Sandy Green Voting System Use Procedure template H 12/09/05 Linda Woods, Updated for System 6 and VBO Sandy Green (Verified Ballot Option) I 02/19/06 Linda Woods, Updated for review comments from Sandy Green Bruce McDannold, State of CA for System 6.1 Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 2 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I Contents 1 INTRODUCTION................................................................................................................................................713 1.1 eSlate System.............................................................................................................................................713 1.1.1 Description of the eSlate System Components...................................................................................713 1.1.1.1 Judge’s Booth Controller (JBC 1000)..........................................................................................814 1.1.1.2 eSlate 3000.................................................................................................................................814 1.1.1.3 Disabled Access Unit (DAU 5000)..............................................................................................915 1.1.1.4 VBO (Verifiable Ballot Option).....................................................................................................915 1.1.1.5 Mobile Ballot Box (MBB)...........................................................................................................1016 1.1.2 Description of the Hart Election Management System Components................................................1016 1.1.2.1 Ballot Origination Software System (BOSS).............................................................................1016 1.1.2.2 Tally...........................................................................................................................................1016 1.1.2.3 Rally...........................................................................................................................................1117 1.1.2.4 SERVO......................................................................................................................................1117 1.2 eScan System...........................................................................................................................................1218 1.2.1 Description of the eScan Device........................................................................................................1218 1.2.2 Description of the eScan Ballot Box..................................................................................................1218 1.3 Terms and Definitions...............................................................................................................................1319 2 BALLOT DEFINITION......................................................................................................................................1319 2.1 Overview...................................................................................................................................................1319 2.2 Paper and printing specifications..............................................................................................................1420 2.3 Layout Requirements and Specifications..................................................................................................1521 3 SYSTEM INSTALLATION AND CONFIGURATION.......................................................................................1521 3.1 Hardware Requirements and Specifications.............................................................................................1521 3.1.1 BOSS Hardware Requirements.........................................................................................................1521 3.1.2 Tally Hardware Requirements...........................................................................................................1521 3.1.3 Rally Hardware Requirements...........................................................................................................1622 3.1.4 SERVO Hardware Requirements......................................................................................................1623 3.2 Hardware and Network Setup and Configuration.....................................................................................1723 3.3 Software Installation and Configuration....................................................................................................1723 3.3.1 User IDs, Passwords, and Permissions.............................................................................................1723 3.4 Acceptance Testing...................................................................................................................................1824 3.5 Software and Firmware Upgrades............................................................................................................1824 4 ELECTION SETUP AND DEFINITION............................................................................................................1825 4.1 Programming and Configuration of Election Management System..........................................................1825 4.2 Programming and Configuration of Vote Recording/Tabulation Devices.................................................1926 4.3 System Diagnostic Testing Procedures....................................................................................................2026 4.3.1 JBC Diagnostic Test..........................................................................................................................2026 4.3.2 eScan Diagnostic Test.......................................................................................................................2026 4.3.3 Tally Diagnostic Test..........................................................................................................................2026 4.4 System Proofing........................................................................................................................................2026 4.5 Logic and Accuracy Testing of System and Components........................................................................2127 4.5.1 Pre-Conditions for Performance of Tests..........................................................................................2127 4.5.2 Accuracy Test Procedures.................................................................................................................2127 4.5.2.1 BIV for the eSlate System.........................................................................................................2228 4.5.2.2 BIV for the eScan System.........................................................................................................2228 4.5.3 Logic Test Procedures.......................................................................................................................2329 Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 3 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 4.5.4 Retention of Test Materials................................................................................................................2329 4.5.5 Logic and Accuracy Board and Certification of Testing.....................................................................2329 4.6 Ballot Tally Programs................................................................................................................................2329 4.7 Election Observer Panel...........................................................................................................................2330 4.8 Hardware Maintenance and Preparation for Use......................................................................................2430 4.8.1 Maintenance of Devices Between Elections......................................................................................2430 4.8.2 Preparation of Devices for Use in an Election...................................................................................2430 4.8.2.1 JBC and eScan Preparation......................................................................................................2430 4.8.2.2 VBO Preparation.......................................................................................................................2531 4.8.2.3 eSlate and Booth Preparation...................................................................................................2531 4.8.2.4 DAU eSlate and Booth Preparation...........................................................................................2531 5 POLLING PLACE PROCEDURES..................................................................................................................2632 5.1 Precinct Supplies, Delivery, and Inspection..............................................................................................2632 5.2 Polling Place Setup for eSlate System......................................................................................................2632 5.2.1 Arrange Polling Place Equipment......................................................................................................2632 5.2.2 Set Up the Booths..............................................................................................................................2632 5.2.3 JBC to eSlate Connections................................................................................................................2632 5.2.4 JBC Printer.........................................................................................................................................2733 5.2.5 JBC and eSlate Power-Up.................................................................................................................2733 5.2.6 DAU eSlate Tactile Switches Connection..........................................................................................2733 5.2.7 Button/Select Wheel Check...............................................................................................................2733 5.2.8 Enter the Polling Place ID..................................................................................................................2733 5.2.9 Verify the Polling Place Location.......................................................................................................2733 5.2.10 Choose Between Early Voting and Election Day Voting.................................................................2733 5.2.11 Assign the Booths............................................................................................................................2734 5.2.12 Print the Zero Tape..........................................................................................................................2834 5.2.13 Complete the Election Form............................................................................................................2834 5.3 Opening the Polls......................................................................................................................................2834 5.4 Polling Place Procedures..........................................................................................................................2834 5.4.1 Issuing an Access Code to a Voter....................................................................................................2834 5.4.1.1 Check the Status of An Access Code.......................................................................................2835 5.4.1.2 Cancel An Access Code............................................................................................................2835 5.4.2 Voter Interaction with the VBO..........................................................................................................2935 5.4.3 Handling a “Fleeing Voter”.................................................................................................................2935 5.5 Special Needs Voters................................................................................................................................2936 5.5.1 Accessible Voting Booth....................................................................................................................2936 5.5.2 Curbside Voting.................................................................................................................................2936 5.6 Provisional Voters.....................................................................................................................................3036 5.6.1 In Precinct..........................................................................................................................................3036 5.6.1.1 eSlate System Provisional Ballots.............................................................................................3036 5.6.1.2 eScan System Provisional Ballots.............................................................................................3037 5.6.2 Extended Voting Time........................................................................................................................3037 5.7 Closing the Polls and Vote Reporting.......................................................................................................3137 5.7.1 Announcement...................................................................................................................................3137 5.7.2 Voters Standing In Line......................................................................................................................3137 5.7.3 Late Arrivals.......................................................................................................................................3137 5.7.4 Closing the Polls................................................................................................................................3138 5.7.5 Printing Polling Place Reports...........................................................................................................3138 5.7.5.1 Early Voting Reports.................................................................................................................3138 5.7.5.2 The Tally Report........................................................................................................................3138 5.8 Polling Place Setup for eScan System used with a DAU eSlate/JBC for Voter Accessibility...................3138 5.8.1 Arrange Polling Place Equipment......................................................................................................3238 5.8.2 eScan Printer.....................................................................................................................................3238 5.8.3 MBB...................................................................................................................................................3238 Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 4 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 5.8.4 eScan Power-Up................................................................................................................................3239 5.8.5 Enter Start-Up Password...................................................................................................................3239 5.8.6 Enter the Polling Place ID..................................................................................................................3239 5.8.7 Choose Between Early Voting and Election Day Voting...................................................................3239 5.8.8 Verify the Polling Place Location.......................................................................................................3239 5.8.9 Print the Zero Tape............................................................................................................................3239 5.8.10 Complete the Election Form............................................................................................................3239 5.9 Opening the Polls......................................................................................................................................3339 5.10 Closing the Polls and Vote Reporting.....................................................................................................3339 5.10.1 Announcement.................................................................................................................................3339 5.10.2 Voters Standing In Line....................................................................................................................3340 5.10.3 Late Arrivals.....................................................................................................................................3340 5.10.4 Closing the Polls..............................................................................................................................3340 5.10.5 Printing Polling Place Reports.........................................................................................................3340 5.10.5.1 Early Voting Reports...............................................................................................................3340 5.10.5.2 The Tally Report......................................................................................................................3340 5.11 Securing Audit Logs and Backup Records.............................................................................................3440 5.11.1 Printed Reports Transport...............................................................................................................3440 5.11.2 MBB Transport.................................................................................................................................3441 5.11.3 JBC Transport..................................................................................................................................3441 5.11.4 eScan Transport..............................................................................................................................3441 5.12 Troubleshooting and Problem Resolution...............................................................................................3441 6 ABSENTEE/MAIL BALLOT PROCEDURES (CENTRAL TABULATION).....................................................3441 6.1 System Startup and Pre-Tabulation Report Procedures...........................................................................3542 6.1.1 Paper Ballot Templates......................................................................................................................3542 6.1.2 Printing Paper Ballots........................................................................................................................3542 6.1.3 Pre-Tabulation Report........................................................................................................................3643 6.1.3.1 Election Report..........................................................................................................................3643 6.1.3.2 Printed Ballots By Precinct Report............................................................................................3643 6.2 Tabulation Procedures..............................................................................................................................3643 6.3 Post Tabulation Report and Shutdown Procedures..................................................................................3743 6.3.1 Post-Election Reports from Ballot Now..............................................................................................3744 7 SEMI-OFFICIAL CANVASS TABULATION AND REPORTING....................................................................3744 7.1 System Startup and Pre-Tabulation Reports............................................................................................3744 7.1.1 JBC or eScan Zero Tape...................................................................................................................3744 7.1.2 Tally Zero Count Reports...................................................................................................................3844 7.1.3 Rally Zero Count Reports..................................................................................................................3844 7.2 Processing Vote Reports..........................................................................................................................3844 7.2.1 Central Tabulation..............................................................................................................................3845 7.2.2 Precinct Tabulation............................................................................................................................3945 7.3 Integration with County Systems and Calvoter.........................................................................................3945 8 OFFICIAL CANVASS AND POST-ELECTION PROCEDURES.....................................................................3946 8.1 Election Observer Panel...........................................................................................................................3946 8.2 Canvassing Precinct Returns....................................................................................................................3946 8.3 Canvassing Absentee Ballots...................................................................................................................3946 8.4 Canvassing Provisional Ballots.................................................................................................................3946 8.5 Canvassing Write-In Votes........................................................................................................................3946 8.6 1% Manual Recount Procedures..............................................................................................................4047 8.6.1 Sample Size.......................................................................................................................................4047 8.6.2 Count Discrepancy.............................................................................................................................4047 8.7 Handling Ballot Exceptions.......................................................................................................................4047 8.7.1 Undervotes.........................................................................................................................................4047 Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 5 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I Overvotes....................................................................................................................................................4047 8.8 Post Election Logic and Accuracy Testing................................................................................................4048 8.9 Final Reporting of Official Canvass...........................................................................................................4148 8.10 Backup and Retention of Election Material.............................................................................................4149 8.10.1 Archiving..........................................................................................................................................4149 8.10.2 Retention..........................................................................................................................................4149 9 MANUAL RECOUNT PROCEDURES.............................................................................................................4250 9.1 Request for Recount.................................................................................................................................4250 9.2 Observers..................................................................................................................................................4250 9.3 Hours of Operation....................................................................................................................................4250 9.4 Ballot Supervision/Breaks.........................................................................................................................4250 9.5 Recount from SERVO...............................................................................................................................4250 9.6 Recount from Verified Paper Audit Trail....................................................................................................4250 9.7 Recount from Ballots Scanned by eScans................................................................................................4350 9.8 Recount from Ballots Scanned by Ballot Now..........................................................................................4350 10 SECURITY......................................................................................................................................................4351 10.1 Physical Security of System and Components.......................................................................................4351 10.1.1 Controlled Access to Election Computers.......................................................................................4351 10.1.2 eCMs (eSlate Crytographic Modules)..............................................................................................4351 10.1.3 Security Seals on JBCs, eScans, and VBOs...................................................................................4351 10.1.4 Voting Devices in Transit to the Polling Place.................................................................................4351 10.1.5 Voting Devices in the Polling Place.................................................................................................4351 10.1.6 Voting Devices in the Warehouse....................................................................................................4351 10.2 Logical Security of System and Components.........................................................................................4351 10.2.1 Essential and Non-Essential Services and Ports............................................................................4351 10.2.2 Signing Key for Software and Hardware..........................................................................................4452 10.2.3 User Level Security..........................................................................................................................4452 10.2.4 Anti-Virus Protection........................................................................................................................4553 10.2.5 Procedures for Verifying, Checking, and Installing Essential Updates and Changes.....................4553 10.2.5.1 Audit Records for the Changes...............................................................................................4553 10.2.5.2 Installation Procedures for Updates........................................................................................4553 10.2.5.3 Acceptance Testing After the Installation................................................................................4553 10.3 Security Procedures for Central Processing...........................................................................................4653 10.4 Security Procedures for Polling Place.....................................................................................................4654 10.5 Audit Trails..............................................................................................................................................4654 10.5.1 Checklist of Audit Trail Reports.......................................................................................................4755 11 BIENNIAL HARDWARE CERTIFICATION AND NOTIFICATION................................................................4755 11.1 eSlate System Test Procedure...............................................................................................................4755 11.1.1 eSlate System Equipment Test.......................................................................................................4755 11.1.2 eSlate System Logic and Accuracy Test.........................................................................................4856 11.2 eScan System Test Procedure...............................................................................................................4856 11.2.1 eScan System Equipment Test.......................................................................................................4856 11.2.2 eScan System Logic and Accuracy Test.........................................................................................4856 Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 6 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 1 Introduction The Hart Voting System is a completely integrated suite of products that offers the most streamlined and efficient method for conducting and reporting elections. The Hart Voting System automates the balloting and tabulation process using a suite of hardware and software products. The eSlate and eScan systems and their components provide central, regional, and precinct tabulation, as well as complete reporting and auditing. The system is bracketed by the ballot definition and tabulation functions. The Ballot Origination Software System, BOSS, provides the user the means to enter jurisdictional and election specific information. The tabulation function is support by Tally that accumulates the Cast Vote Records (CVRs) from components of the system that interface with the voter. These voter interface components consist of the eSlate and paper ballots printed with Ballot Now. 1.1 eSlate System This procedure addresses the use of the eSlate System’s eSlate voting terminal. The eSlate System, a Direct Recording Electronic (DRE) voting system, is designed to manage and conduct polling place activities during an election. The eSlate System is used for Election Day polling places and Early Voting sites. The Hart Voting System has these major components: (cid:131) Hart Election Management System • The Ballot Origination Software SystemTM (BOSS) Ver. 4.2 • Ballot NowTM Ver. 3.2 (the paper ballot system, not required for DRE) • TallyTM System (Tally) Ver. 4.2 • SERVOTM Ver. 4.1 • RallyTM Ver. 2.2 • eCM Manager Ver. 1.1 (security key application used by Hart InterCivic to generated signing keys) (cid:131) eSlate System devices (Ver. 4.1) • Judge’s Booth ControllerTM (JBC 1000) • eSlateTM 3000 • DAU 5000 • VBO (Verifiable Ballot Option) Ver. 1.7 • Mobile Ballot BoxTM (cid:131) eScan System devices (Ver. 1.2) • eScan • Mobile Ballot Box 1.1.1 Description of the eSlate System Components Hart’s eSlate System is a Direct Recording Electronic (DRE) system designed to manage, conduct, and report on elections. The eSlate System supports multiple languages (English, Armenian, Chinese, Ilocano, Japanese, Korean, Russian, Spanish, Tagalog, and Vietnamese) as required by a jurisdiction. It is used in Election Day precinct polling places and Early Voting sites. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 7 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I The eSlate System is distributed from a central location to geographically distributed polling places and/or early voting sites. The central location, or headquarters, corresponds to the main offices of the jurisdiction. The precincts are election districts divided geographically according to population and jurisdictional boundaries. Early Voting sites are selected locations within a jurisdiction that support the complete election and allow voters from any precinct to cast their vote prior to Election Day. When an election requires that the ballot be displayed in multiple languages, the eSlate displays the available languages to the voter. The voter is required to select the desired language, and all subsequent information is displayed in that language. The networked eSlate System consists of a controller (Judge's Booth Controller), and multiple voter input devices (the eSlate). 1.1.1.1 Judge’s Booth Controller (JBC 1000) The JBC is a stand-alone device located at each precinct-polling place. The JBC controls up to twelve eSlates and has the following features: (cid:131) A display for delivery of instructions and messages, public and private counter, and battery status to the operator. (cid:131) Selection buttons, called softkeys, located on the perimeter of the display, used for the operator to make selections. The functions of the softkeys change, similar to an Automated Teller Machine. (cid:131) Fixed buttons for Printer Feed, Contrast Up, Contrast Down, and Closing the Polls. (cid:131) An alphanumeric keypad for entering precinct names, passwords and other data. (cid:131) A built-in printer for printing Access Codes, zero tape, test results and election results (if required). (cid:131) Supports multiple-language elections (English, Chinese, Korean, Spanish, Tagalog, and Vietnamese) (cid:131) A set of connectors located at the rear of the device to connect to the first eSlate, mains power and a port used for warehouse functions. (cid:131) A slot to insert a Mobile Ballot Box (portable FLASH memory device) that can be secured with a tamper-proof security seal. (cid:131) Twelve status lights used to indicate the current state of each connected eSlate. (cid:131) Provides a complete Audit Trail of all events. (cid:131) Includes a battery chamber for back-up battery power. (cid:131) Election signing key 1.1.1.2 eSlate 3000 The eSlate is used by the voters to cast their ballots. It presents the ballot to the voting public and accepts their selections. The eSlate has the following features: (cid:131) A Liquid Crystal Display (LCD), 246mm x 184.5mm, used in portrait mode to display a language selection screen, an access code screen, ballot pages, write-in enter screen, ballot summary, and help text. (cid:131) A user input area that includes a set of push buttons for Enter, Previous page, Next page, Help, and Cast Ballot. (cid:131) A rotary navigational device used to highlight selections. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 8 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I (cid:131) User selectable multiple language support. (cid:131) A connector for receiving a cable from the JBC or previous eSlate and an attached cable for connecting to the next eSlate. The eSlates are connected “serially,” one connected to another, so there is only one cable attached to the JBC. (cid:131) Recessed cavity in the back for installation of an optional Disabled Access Unit. (cid:131) A battery chamber for back-up battery power. (cid:131) A VBO module with a connector for receiving a cable from the VBO printer. 1.1.1.3 Disabled Access Unit (DAU 5000) The DAU is an optional device that can be installed in the eSlate. It allows disabled voters to cast their votes independently. The DAU includes all the features of the eSlate, as well as the following: (cid:131) A slot to insert a FLASH memory card containing audio data. (cid:131) User selectable multiple language support. (cid:131) Audio output for “reading” the ballot to the voter in the selected language via headphones. (cid:131) Remote switch input used for the physically disabled (either tactile input switched or sip and puff device). (cid:131) A VBO module with a connector for receiving a cable from the VBO printer. 1.1.1.4 VBO (Verifiable Ballot Option) The VBO is the VVPAT (Voter-Verified Paper Audit Trail) device that can be connected to the eSlate voting unit inside the voting booth in order to print a paper record of every ballot cast through the eSlate voting unit. The VBO consists of a printer unit and a VBO module installed in the eSlate or DAU eSlate. The VBO printer unit has the following features: (cid:131) Glass-covered viewing area. (cid:131) Thermal printer with a take-up reel. (cid:131) Dedicated power cord. (cid:131) An area for batteries. (cid:131) Security seal on the paper compartment. (cid:131) Security seal in the Security Button that secures the VBO printer to the booth. (cid:131) A connector for the cable that connects to the eSlate or DAU eSlate. (cid:131) Can be “hot-swapped” to correct paper jam or if end-of-paper roll occurs. (cid:131) Can be transported inside the voting booth. (cid:131) The printout has the cast vote record in: (cid:131) Human-readable text (cid:131) Machine-readable barcode (cid:131) The VBO printer paper is managed within the enclosure. It is intended that the VBO be sealed at the warehouse and remain sealed in the field so that the pollworker will not be required to change the paper. Any problem with the VBO requires that the unit be replaced in order to preserve the VBO Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 9 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I as a traditional ballot box. When a VBO unit is removed from a “live” booth, the booth's LED on the JBC flashes to indicate the booth is not ready for use. 1.1.1.5 Mobile Ballot Box (MBB) A reusable, portable FLASH memory device, the MBB is used to store and transport election information to and from the polling places. The MBB is reusable and allows data to be stored to it many times. FLASH memory does not require batteries to maintain the data written to it. When deployed in a JBC, an eScan, or Ballot Now, the MBB contains: (cid:131) Election identification and Election signing key. (cid:131) All possible ballot types in all required languages for the jurisdiction. (cid:131) A list of polling places, precincts, and allowable ballot types for each. (cid:131) Passwords for JBCs and eScans. When the polls are closed, the MBB from a JBC or an eScan also contains: (cid:131) Audit logs (cid:131) Cast vote records (CVRs) The MBB(s) used in Ballot Now to scan and resolve ballots also contains: (cid:131) Audit logs (cid:131) Cast vote records (CVRs) Flash memory cards can be purchased from Hart InterCivic or from vendors approved by Hart InterCivic. Contact Hart InterCivic for the approved vendors list. 1.1.2 Description of the Hart Election Management System Components 1.1.2.1 Ballot Origination Software System (BOSS) The Ballot Origination Software System (BOSS) is a software application that accepts user input of jurisdictional and election specific information. BOSS is a Windows-based program and uses a commercial database product to store and manipulate data. The ballot generation feature of BOSS creates electronic ballot styles based on the jurisdictional and election specific information supplied by the user. Ballot generation creates a single data file that is used to conduct the election at any polling location. The Hart Voting System proprietary data file is written to multiple PC card memory devices called the Mobile Ballot Boxes (MBBs). MBBs are transported to the various polling locations throughout the county. Each MBB contains the same information so that they can be used in any location. In a polling place, the MBB is used to configure the Judge’s Booth Controller and supply ballot data for the election. The same MBB is used to return the ballot images captured by the eSlate System to Election Headquarters for tabulation by Tally. Once BOSS generates the file for the MBB, the BOSS database becomes locked so that no more changes can be made, thus protecting the integrity of the MBB data file. The BOSS database is subsequently used to initialize the Tally database. Refer to the BOSS Operations Manual 6100-019 for detailed instructions. 1.1.2.2 Tally Tally is a software application that reads, stores, and tabulates the CVRs from the MBBs. At the close of polls on Election Day, all of the MBBs are returned to the central location, including early voting MBBs, where Tally copies the data stored on each MBB into the election’s Tally database. The MBBs contain CVRs captured by the eSlate System, eScan System, and Ballot Now, and audit trail data that authenticates the CVRs. Tally is initialized with the locked BOSS database that was used to create the election. This initialization “programs” Tally for tabulation. The only required task prior to reading MBBs Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 10 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I into Tally is to print the Cumulative Report to create a zero count report from Tally. The only task prior to beginning the tabulation process is to input any approved write-in candidate names. Refer to the Tally Operations Manual 6100-049 for detailed instructions. 1.1.2.3 Rally Rally is a software application that operates in conjunction with Tally. Rally enables remote reading of MBBs from JBCs and eScans, thus permitting distributed capture of cast vote record and audit data on election night. Jurisdictions using Rally will typically deploy multiple Rally stations in a geographically distributed manner that permits efficient MBB card collection. Rally reads the cast vote record and audit data from the MBBs and stores the data locally. Tally, deployed at a central election location, initiates the connection with each Rally station, one after the other, and determines if there is any new data stored by the Rally station. The frequency at which Tally “polls” each Rally station is configurable by the user. If there is new data, it is transferred to the Tally station and is ready for tabulation and reporting. Refer to the Rally Operations Manual 6100-114 for detailed instructions. 1.1.2.4 SERVO SERVO is an election records and recount management system for the Hart Voting System. SERVO uses the redundantly saved Cast Vote Records as part of the triple redundancy feature of the eSlate System to their fullest advantage. Election results are initially generated from the direct reading of voted Cast Vote Records on the MBBs into Tally. When the JBCs, eSlates, and eScans are returned to the warehouse, the devices are connected to SERVO in order to make an exact copy of the redundantly stored Cast Vote Records. SERVO’s data from the JBC, eSlate, and eScan memories can also be used as recount data to compare against the MBB results, creating a distributed, closed-loop process that provides redundant cross verification of election results. This makes recounting of election results part of every election cycle, increasing system reliability and security. When the eSlate System and eScan System equipment is required for use in a new election, SERVO is used to: (cid:131) Initialize the JBCs, eSlates, and eScans, which erases all previously recorded information, with the exception of the Private Counter in the JBC, which remains at its existing count to provide an outgoing usage record. (cid:131) Write the new election’s signing key to the JBC. (cid:131) SERVO provides other functions such as setting of the real time clock, printing of Cast Vote Records and audit logs. Refer to the SERVO Operations Manual 6100-102 for detailed instructions. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 11 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 1.2 eScan System This procedure addresses the use of the eScan System’s paper ballot scanner. The eScan System is a Hart VS paper ballot polling place scanner system that scans a voter’s Hart Voting System paper ballot and records their selections as ballot images (Cast Vote Records [CVRs]) to an MBB. The eScan System is used for Election Day polling places and Early Voting sites. Paper ballots for use with the eScan are generated by the BOSS application and printed by the Ballot Now application. MBBs used in eScans are read by the Tally application to tally Election results. 1.2.1 Description of the eScan Device The eScan device has the following features: • A screen for display of: (cid:131) instructions and messages to the pollworker (cid:131) the private and public counters to the pollworker (cid:131) battery status to the pollworker (cid:131) instructions and messages to the voter • Selection buttons located on one side of the screen for responding to choices displayed on the screen • Password requirements to set the polling place location, open the polls, and close the polls • Cryptographic signing key for the Election • A dedicated button located at the back of the unit for special operations by the pollworker or warehouse technician • A built-in printer for printing election reports • A slot to insert a PC Card (Mobile Ballot Box [MBB]) that can be secured with a tamper-proof security seal • An On/Off switch • A scanner for scanning voted ballots. 1.2.2 Description of the eScan Ballot Box The eScan device sits on top of a secure ballot box receptacle for collecting scanned ballots. The ballot box has a second compartment in the ballot box receptacle for storage of voted ballots in case the eScan is disabled. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 12 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 1.3 Terms and Definitions BOSS Ballot Origination Software System CVR Cast Vote Record. An electronic version of a voted ballot cast in the eSlate System and eScan System that contains the information on how contests were voted. In Ballot Now, contains information on how contests were voted, including any resolutions that were needed during the resolve process. DRE Direct Recording Electronic JBC Judge’s Booth Controller MBB Mobile Ballot Box PCMCIA Personal Computer Memory Card International Association SERVO System for Election Records and Verification of Operations TRANS Translation, Recording, and Audio Normalization System VBO Verifiable Ballot Option 2 Ballot Definition 2.1 Overview Preparing for an election begins with entering information into BOSS. Typically, jurisdictional information such as precinct and polling place names is entered prior to an election cycle. Once an election cycle begins, election specific information is entered into BOSS. The BOSS election database is configured to: (cid:131) Define political parties (cid:131) Define ballot instructions (cid:131) Define passwords for the eSlate System and the eScan System (cid:131) Set the eSlate and eScan to allow printing the Tally Report at the polling place (cid:131) Set the eScan to require the voter’s approval for scanning a blank ballot or a ballot with undervotes, and to require the pollworker to approve scanning a ballot with overvotes (cid:131) Set the requirement for using the VBO in the eSlate System, allowing the voter to reject the verification twice After the ballot information has been input: (cid:131) Ballot content is proofed using the reports produced by BOSS, including review of all ballot styles. (cid:131) Ballot layouts are viewed or printed with the BOSS preview feature. At this point, changes can easily be made to the ballot data and/or layout. When all changes to the ballot data and/or layout have been made, the text strings and audio prompts are exported out of BOSS to files for delivery to text translation experts and voice recording professionals. The text for each language is translated via a software application that uses UNICODE fonts. The audio is recorded to .WAV files. The translated text files and audio recordings are then imported into BOSS. When ballot content and layout, and language translations and recordings have been verified, ballot generation produces the electronic ballot data file that contains all the ballot styles necessary for conducting the election at any polling location and for printing paper ballots with Ballot Now. The Hart VS proprietary data file is written to multiple PC card memory devices called the Mobile Ballot Boxes (MBBs). Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 13 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I BOSS requires authentication from the election’s security keys in order to generate the data file. This file is written to the MBBs: (cid:131) In a polling place, the MBB is used to configure the eSlate System and supply ballot data for the election. (cid:131) In Ballot Now, the MBB is used to print paper ballots, scan paper ballots, resolve scanned ballots, and record CVRs from scanned, resolved ballots. (cid:131) In the eScan system, the MBB is used to verify scanned ballots and record CVRs. (cid:131) The MBBs are used to return the ballot images captured by the eSlate System, the eScan System, or Ballot Now to Election Headquarters for tabulation by Tally. (cid:131) Once BOSS generates the data file for the MBB, the BOSS election database becomes locked automatically so that no more changes can be made to the ballot data, thus protecting the integrity of the data that will be written to MBBs. Each MBB contains: (cid:131) The same information so that they can be used in any location. (cid:131) All possible ballot styles for the jurisdiction. (cid:131) A list of polling places and precincts, and allowable ballot styles for each. (cid:131) Ballot format information in all languages for display on the eSlate voting units, and for scanning ballots with Ballot Now or the eScan device. (cid:131) Encrypted serial number and election ID. (cid:131) Cryptographic signing key for the Election (cid:131) Passwords for access to the Judge’s Booth Controller. (cid:131) Passwords for access to the eScan. (cid:131) Requirement for the eSlate to have a VBO printer and the number of times the voter is allowed to reject their printout of their ballot. Any MBB may be installed: (cid:131) In a JBC at Election Headquarters or at the precinct-polling place. Once installed, information is written to that MBB to associate it with the JBC and the eSlate voting units connected to the JBC. (cid:131) In an eScan at Election Headquarters or at the precinct-polling place. Once installed, information is written to that MBB to associate it with the eScan device. 2.2 Paper and printing specifications Paper ballot dimensions are set in BOSS. Paper ballot printing is done in Ballot Now. Printing of ballot serial numbers must be turned off in Ballot Now before any ballots are printed. Printing of a serial number in the Ballot Key field in the layout for the printout from the VBO is disabled in BOSS by Hart InterCivic personnel. Printing specifications for printing ballots from Ballot Now are described in the Hart InterCivic document titled Ballot Now Ballot Printing Specification 6000-261 Rev. A. Paper stock for printed ballots is specified in California Election Code §13002, which describes tints and watermarks required for each election. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 14 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 2.3 Layout Requirements and Specifications Layout for the eSlate System and for Ballot Now paper ballots is defined in BOSS by selecting one or more templates before the data file for the MBB is generated. Templates contain the language and the number of columns for the electronic and paper ballots, and the paper size for the paper ballots. 3 System Installation and Configuration 3.1 Hardware Requirements and Specifications 3.1.1 BOSS Hardware Requirements BOSS runs on Windows 2000 Professional, Service Pack 3. Various third-party drivers for PCMCIA slots are required for installation. The installation of a third party database is required. Third party software is also used for print preview functions. BOSS is capable of running on any standard PC with the following minimum system configuration. • 1 GHz Pentium 4 system processor • 512 MB of RAM • One (1) 40 GB Hard disk • CD-ROM drive • Laser or ink jet printer • USB/Parallel interface to support report printer • Monitor screen resolution set to 1024 x 768 or higher • 1 or more ATA flash card drives • One (1) Spyrus USB security key provided by Hart InterCivic and USB port Recommended hardware configuration: • 2GHz Pentium 4 processor • 1G of RAM • 1280X1024 screen resolution • 12/24 GB DAT Tape Drive or CD/RW drive • One (1) non-interruptible power supply (UPS) (for the event of a power outage) capable to power the computer for sufficient time to stop the current process in the application and shut down the computer. • All else configured as described above. 3.1.2 Tally Hardware Requirements Tally runs on Windows 2000 Professional, Service Pack 3. Various third-party drivers for PCMCIA slots are required for installation. The installation of a third party database is required. Tally is capable of running on any standard PC with the following minimum system configuration. • 1 GHz Pentium 4 system processor • 512 MB RAM • 1024 x 768 display resolution, High color (16 bit) • 30 GB hard drive • R/W CD drive Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 15 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I • 1 or more ATA flash card drives • Standard Parallel port to support real-time audit log • USB/Parallel interface to support report printer • Audit line printer • Report printer • Communication Port • One (1) Spyrus USB security key provided by Hart InterCivic and USB port Recommended hardware configuration: • One (1) non-interruptible power supply (UPS) (for the event of a power outage) capable to power the computer for sufficient time to stop the current process in the application and shut down the computer. • All else configured as described above. 3.1.3 Rally Hardware Requirements Rally runs on Windows 2000 Professional, Service Pack 3. Various third-party drivers for PCMCIA slots are required for installation. The installation of a third party database is required. • TCP/IP Networking Protocol • Tvich • ASA 7.0 ODBC drivers Rally is capable of running on any standard PC with the following minimum system configuration. • 733 MHz processor • 512 MB RAM • 20 GB free hard drive space • 1 Parallel port • 1 USB Port • 1 or more ATA flash card drives • 1 External communications interface: • 1 Network Interface Card • 1 Serial port + 1 external modem • 1 Internal modem card • Audit line printer • Report printer • One (1) Spyrus USB security key provided by Hart InterCivic and USB port Recommended hardware configuration: • One (1) non-interruptible power supply (UPS) (for the event of a power outage) capable to power the computer for sufficient time to stop the current process in the application and shut down the computer. • All else configured as described above. 3.1.4 SERVO Hardware Requirements SERVO is capable of running on any standard PC with the following minimum system configuration. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 16 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I Windows 2000 Professional, Service Pack 3. Various third-party drivers for PCMCIA slots are required for installation. The installation of a third party database is required. • 1 GHz Pentium 4 system processor • 512 MB RAM • 1024 x 768 display resolution, 16 bit color • 20 GB hard drive • R/W CD drive • 733MHz processor • 1 EPP parallel port • Optional Ethernet connection and server-based operating system • 1 ATA flash card drive • Laser printer for report printing • One (1) Spyrus USB security key provided by Hart InterCivic and USB port • Optional audio card and speakers for the “ding” upon reset or backup-complete 3.2 Hardware and Network Setup and Configuration Hardware configuration is performed by Hart InterCivic personnel to ensure that operation and security standards for the network and hardware configuration are met. If the Rally software application will be used to transfer election results from remote sites to the Tally system, Hart InterCivic personnel configures either a network or a dial-up connection to the Tally system, protected by security certificates through SSL (Secure Sockets Layer). In a large jurisdiction, Ballot Now can be run on a server and multiple clients for resolving voted ballots. Communication between the Ballot Now server and a client is protected by security certificates through SSL. Each network of a Ballot Now server and its clients must be physically separate. 3.3 Software Installation and Configuration Software installation and configuration is exclusively performed by Hart InterCivic personnel. For the State of California, the following options will be set during installation as indicated below: • BOSS application must have the printing of a serial number in the Ballot Key field in the layout for the printout from the VBO disabled. • Tally application must be installed with the options to allow parsing of retrievable and provisional ballots. • Tally and Rally applications must have the requirement for a line printer for the real-time audit logs changed to write the audit logs to a FILE. 3.3.1 User IDs, Passwords, and Permissions After installation of each Hart Voting System software application, the jurisdiction creates new users for the software application, then deletes the user defined by Hart InterCivic. BOSS users are created by the jurisdiction. See the Hart InterCivic Ballot Origination Software System Operations Manual 6100-019 Rev. 42-60B and Ballot Origination Software System Training Manual 6300- 002 6XA. Ballot Now users are created by the jurisdiction. See the Hart InterCivic Ballot Now Operations Manual 6100-067 Rev. 32-60B and Ballot Origination Software System Training Manual 6300-002 6XA. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 17 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I Tally users are created by the jurisdiction. See the Hart InterCivic Tally Operations Manual 6100-049 Rev. 42-60B and Tally Software Training Manual 6300-005 6XA. Rally users are created by the jurisdiction. See the Hart InterCivic Rally Operations Manual 6100-114 Rev. 22-60A and Tally Software Training Manual 6300-005 6XA. SERVO users are created by the jurisdiction. See the Hart InterCivic SERVO Operations Manual 6100-102 Rev. 41-60B and Hart Voting System Support Procedures Training Manual 6300-006 6XA. 3.4 Acceptance Testing The Hart InterCivic document titled Polling Place Equipment Acceptance and Functionality Test Procedures, Part Number 6300-006 provides the detailed description of Acceptance Test procedures for the eSlate System. In brief, the eSlate System Acceptance Test procedure includes: • Checking receipt of equipment and supplies. • Unbox equipment and supplies. • Set up and test voting booths. • Set up and test JBCs and eSlate voting units. • Use SERVO to: • Log the serial numbers of the JBCs and eSlates • Write the signing key to the JBCs • Set the clock in the JBCs • Verify firmware revisions in the JBCs and eSlates. • Inventory (scan and record serial numbers of booths, eSlates, JBCs, booth caddies). • Reconfigure booths and JBCs for storage. • Transfer equipment to storage area. • Stow booths on caddies and JBC boxes on shelving. • Move caddies into place in storage area. 3.5 Software and Firmware Upgrades Software and firmware upgrades to the Hart Voting System are only performed by Hart InterCivic personnel, and only then, after certification by the Secretary of State. Operating system upgrades to the computers on which the Hart Voting System applications are installed are only performed by Hart InterCivic personnel, and only then, after certification by the Secretary of State. Anti-virus software installation is only installed by Hart InterCivic personnel, but updates to definitions may be performed by the jurisdiction personnel. 4 Election Setup and Definition 4.1 Programming and Configuration of Election Management System A database for the election is created in the Ballot Origination Software System (BOSS) software, a component of the Hart Election Management System. The BOSS application user interface is described in the Hart InterCivic Ballot Origination Software System Operations Manual 6100-019 Rev. 42-60B. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 18 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I The procedures for using BOSS to create a database for an election are described in the Hart InterCivic Ballot Origination Software System Training Manual 6300-002 6XA. The steps for creating a BOSS election database include: (cid:131) Gather data for creating the BOSS election database. (cid:131) In BOSS: • Create a new election database. • Enter all jurisdiction information into the BOSS election database. NOTE: The jurisdiction information can be done in advance of an election cycle. This information can be saved as a starting point for future elections. • Enter all election information into the BOSS election database. • Proofread all information entered into the BOSS election database. • Generate ballot formats from the election database, preview/print the ballot layouts and proof them. • Make necessary corrections to the ballot layouts. • Generate ballot formats and accept them. NOTE: Accepting the ballot formats for a BOSS election database writes the signing key from the eCM installed in the BOSS PC to the election database AND changes the BOSS data entry fields for election definitions to display-only. • Create test or official MBBs, and create Audio cards for the DAU eSlates. The Hart InterCivic Ballot Origination Software System Training Manual 6300-002 6XA contains recommendations for how to figure how many MBBs and Audio cards should be written for an election. NOTE: The election’s signing key is written to each MBB. • Lock the election database for use with Tally. NOTE: After the election database is locked for use with Tally, no more MBBs or Audio cards can be written from the BOSS database. Each MBB for the election can: • Configure one Judge’s Booth Controller to supply ballot data for the presentation of the ballot to voters on an eSlate voting unit, and record cast vote records. • Configure one eScan to supply ballot data for scanning paper ballots and record cast vote records. • Configure Ballot Now to print paper ballots and record cast vote records. NOTE: Ballot Now can print paper ballots to PostScript files for delivery to a print vendor. Use of Ballot Now to print ballots is described in Section 6.1.2 Printing Ballots. The same MBB used in a Judge’s Booth Controller, an eScan, or in Ballot Now is used to return the cast vote records to Election Headquarters for tabulation by Tally. 4.2 Programming and Configuration of Vote Recording/Tabulation Devices SERVO is used at a jurisdiction’s warehouse where all of the JBCs and eSlate voting devices, and eScan devices are stored. A conveyor line will lead up to the PC running SERVO, where one JBC/eSlate device, or eScan device, after another will get attached to the SERVO computer for processing. JBCs, eSlates, and eScans are added to the SERVO database and reset. Resetting of the devices includes: (cid:131) Erasing any cast vote records to achieve zero-public-count. (cid:131) Erasing internal audit logs that may exist from a previous election or testing on a device. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 19 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I (cid:131) Setting the clock on a JBC or eScan. (cid:131) Writing the election’s signing key to a JBC or eScan. The signing key for an election is described in Section 10.2.2 Signing Key for Software and Hardware. 4.3 System Diagnostic Testing Procedures 4.3.1 JBC Diagnostic Test The JBC automatically performs a diagnostic test at power-up and prints the JBC Initialized Report that includes the following information: • Date / time. • Software version. • Device serial number • Results of power-on diagnostics (Pass or Fail). Store the JBC Initialized Report in a JBC Diagnostic Test records envelope. A zero tape report must be printed from the JBC prior to opening the polls and stored in a JBC Diagnostic Test records envelope. 4.3.2 eScan Diagnostic Test The eScan automatically performs a diagnostic test at power-up and prints the eScan Power-Up Report that includes the following information: • Date / time. • Software version. • Device serial number • Results of power-on diagnostics (Pass or Fail). Store the eScan Power-Up Report in an eScan Diagnostic Test records envelope. A zero tape report must be printed from the eScan prior to opening the polls and stored in an eScan Diagnostic Test records envelope. 4.3.3 Tally Diagnostic Test After the election’s Tally database is created in Tally, zero reports are printed and reviewed before MBBs are read into Tally. 4.4 System Proofing Proofing of ballots is performed in BOSS: (cid:131) Generate BOSS reports and compare the data to the information gathered and organized prior to data entry. • Active Contests Options List Report • Ballot Content Proof Report • Ballot Style List by Precinct Report • Ballot Style List by District Report • Contest List With Details Report • Assigned Precinct Report Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 20 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I • Polling Place List - Early Voting - Detail Report • Polling Place List - Early Voting - Summary Report • Polling Place List - Election Day Voting - Detail Report • Polling Place List - Election Day Voting - Summary Report • Precinct List Report (cid:131) Check for all Contests on ballot and candidate/proposition spelling is correct (cid:131) Verify the correct number of votes allowed in each contest (cid:131) Verify that write-in positions are correct 4.5 Logic and Accuracy Testing of System and Components 4.5.1 Pre-Conditions for Performance of Tests The operation of the eSlate System devices (JBCs and eSlate voting units) and eScan devices must be verified prior to deploying the equipment to the polling location. As part of preparing for transport, each piece of equipment must have power applied to it and verify that it reaches the ready state in the power up cycle. This indicates that the equipment is functioning properly and has passed the resident power-up diagnostics. • The JBC prints out a report indicating that it, and all connected eSlates, have passed diagnostics and identifies each device by serial number. • The eScan prints out a report indicating that it has passed diagnostics and identifies the device by serial number. These reports are retained as part of the election record. 4.5.2 Accuracy Test Procedures Accuracy testing consists of those procedures necessary to ensure hardware and software to be used in the election are working properly, both as individual units and as a combined system. Instructions for performing the accuracy test are described in the Hart InterCivic Hart Voting System Support Procedures Training Manual 6300-006 6XA. Not more than 10 days before Election Day, the local election official shall have the entire system, tested to ascertain that it will count properly, the votes cast for all offices and all questions. Successful testing will demonstrate that, each candidate and ballot measure receives the proper number of votes, the system accepts only the proper ballot types and all tabulations are reported accurately. In the case of offices for which the voter is allowed to vote for more than one candidate, at least one ballot shall be voted with the maximum allowed number of choices. The election-specific test is an essential method of testing electronic ballots to be used in that particular election to ensure that the eSlate System and eScan System devices perform adequately. The purpose of this test is to ensure that the ballot used with a particular election will function properly when run with the ballot tabulation software for that election. All ballot logic and accuracy functions of the Hart VS are static. This means that the functions are compiled, tested and verified as part of extensive system testing and certification processes and do not change between elections. The only element of the system that changes from one election to the next is the content and format of the ballots. The responsible elections official shall prepare the following accuracy test deck to be prepared and tested. Predetermined results of accuracy test must be available for inspection and sign off by the Logic and Accuracy Board. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 21 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I The pre-election ballot inspection and verification for the eSlate System and eScan System ensures that the Electronic Ballot Data provides properly formatted ballots. This process requires an MBB containing the Electronic Ballot Data file, a Judges Booth Controller, and an eSlate. The Ballot Content Proof Report proof report printed from BOSS lists the various ballot styles is used to optimize the verification process. 4.5.2.1 BIV for the eSlate System The following steps are followed to perform the Ballot Inspection and Verification (BIV) for the eSlate System: 1. Create a BIV Mobile Ballot Box in the "test" mode using the Ballot Origination Software System 2. Reset the JBC and its eSlates 3. Insert the MBB in the JBC and open the polls 4. Using the ballot style proof sheet from BOSS, select a representative precinct for the first ballot style and print an Access Code 5. Enter the Access Code into the eSlate and display the ballot 6. If multiple languages are required, select the language to be verified. 7. Review the text on the ballot and verify the following: (cid:131) The text on the ballot is displayed, as desired. (cid:131) The position of contests relative to pages and columns are accurate. (cid:131) The required contests are present. 8. After verifying each of the ballot pages, go to the ballot summary screen. 9. Move to the first contest and verify the formatting of the contest name. 10. Press enter and return to the contest. 11. Select an option in the contest and verify the formatting of the option on the summary screen. 12. Repeat for each option in the contest. For contests with write-ins, enter three alpha characters, sequencing through the alphabet for subsequent contests. 13. Repeat steps 9 through 11 for each contest. 14. Repeat steps 4 through 12 for each ballot style. 15. Repeat steps 4 through 13 for each language, as required. 16. Close the polls and remove the MBB, label it and retain as part of the Election record. This process verifies that the ballot(s) will be correctly presented to the voter for a given revision of the Electronic Ballot Data. Formatting errors or changes require that the information be updated in BOSS, generation of new ballots and repeating the above process. 4.5.2.2 BIV for the eScan System The following steps are followed to perform the Ballot Inspection and Verification (BIV) for the eScan System: 1. Create a BIV Mobile Ballot Box in the "test" mode using the Ballot Origination Software System. 2. Reset the eScan. 3. Insert the MBB in the eScan and open the polls. 4. Print representative ballot styles from Ballot Now. 5. Review the text on the ballot and verify the following: (cid:131) The text on the ballot is laid out, as desired. (cid:131) The position of contests relative to pages and columns are accurate. (cid:131) The required contests are present. 6. After verifying each of the ballot pages, mark the ballot to vote it. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 22 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 7. Scan the ballot in the eScan 8. Repeat steps 5 through 7 for each language and each ballot style, as required. 9. Close the polls and remove the MBB, label it and retain as part of the Election record. This process verifies that the ballot(s) will be correctly printed for the voter and scanned correctly for a given revision of the Electronic Ballot Data. Formatting errors or changes require that the information be updated in BOSS, generation of new ballots and repeating the above process. 4.5.3 Logic Test Procedures Ballot logic is verified by the jurisdiction using their Ballot Inspection and Verification process. Instructions for performing the logic and accuracy testing for the eSlates and eScans are described in the Hart InterCivic Hart Voting System Support Procedures Training Manual 6300-006 6XA. 4.5.4 Retention of Test Materials Copies of the Cast Vote Records and the accumulated results from the logic and accuracy tests shall be retained in secure locations designated by the jurisdiction: • For as long after the election as required by law; or • By order of a court or directive of the Secretary of State. 4.5.5 Logic and Accuracy Board and Certification of Testing Accuracy tests shall be performed prior to Logic and Accuracy Certification to the Secretary of State and again within 72 hours prior to tabulation on Election Day. In the event of hardware failure and the component has been repaired, replaced or adjusted the accuracy test should be re-run. The test shall be conducted by using a pre-determined test script of at least one vote for each possible selection within an office or question. The test script for each voting machine must test all possible candidates or questions for each precinct. If a voting machine or the central tabulating system does not accurately count the test script or test vote, the cause for the error shall be as ascertained and corrected and an errorless count shall be made before the system is approved for use of counting votes. 4.6 Ballot Tally Programs The Tally software, a component of the Hart Election Management System is used to record and tally cast vote records from the election’s MBBs. A Tally database is initialized with the locked BOSS database that was used to create the election. This initialization “programs” Tally for tabulation of election results. After the election’s Tally database is created in Tally, zero reports are printed and reviewed before MBBs are read into Tally. The only required task prior to beginning the tabulation process is to input into the election’s Tally database any approved write-in candidate names. In compliance with EC §15001, a copy of the Tally software executable is deposited with the Secretary of State as a requirement of certification of the Hart Voting System. 4.7 Election Observer Panel Each candidate and each side in the case of a ballot measure, shall be allowed not more than two observers for each election testing board, and may not touch or handle the transport media. All questions must be directed to the elections official in charge of the election testing. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 23 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 4.8 Hardware Maintenance and Preparation for Use 4.8.1 Maintenance of Devices Between Elections Maintenance procedures for the JBC, eSlate, DAU eSlate, VBO, and eScan devices are minimal. The eSlate and eScan equipment does not require any calibration or regular upgrading. Any problems detected in functionality testing should be re-tested, logged, and equipment returned to Hart InterCivic for replacement. There are only a few regularly scheduled maintenance procedures necessary: • Cleaning the equipment screens • Checking battery levels • Performing functionality tests • Other repair, replacement, and miscellaneous maintenance procedures • PC printer, Ballot Now PC scanner, and PC peripheral maintenance • eScan scanner path cleaning Details of hardware maintenance procedures are described in the Hart InterCivic Hart Voting System Support Procedures Training Manual 6300-006 6XA. 4.8.2 Preparation of Devices for Use in an Election JBC, eSlate, and eScan devices are prepared for use in a new election using the reset procedure in the SERVO application as described in Section 4.2 Programming and Configuration of Vote Recording/Tabulation Devices. Details of the reset procedures for JBCs, eSlates, and eScans are described in the Hart InterCivic Hart Voting System Support Procedures Training Manual 6300-006 6XA. In addition: • Batteries are installed in the JBCs, eSlates, DAU eSlates, and VBOs. • Printer paper is installed in the JBCs, eScans, and VBOs. 4.8.2.1 JBC and eScan Preparation Before a JBC or an eScan is deployed to a polling place, an Election MBB is installed and the device is configured at the warehouse to assign it to a specific polling place. Device preparation steps are recorded on checklists, listed by device type and device serial number. Details of the installation of batteries and configuration of its MBB are described in the Hart InterCivic Hart Voting System Support Procedures Training Manual 6300-006 6XA. The details include: (cid:131) Install an Election MBB, install a security seal, and record the serial number. (cid:131) For a JBC, the battery key is connected, then the JBC is connected to power. For an eScan, the eScan is connected to power and turned ON. (cid:131) The Start-Up password is entered. (cid:131) The polling place ID is entered. (cid:131) If available, the choice is made to set the device for Early Voting or Election Day voting. (cid:131) The device is disconnected from power. (cid:131) All printed reports are torn off of the device printer and placed in an election records envelope. (cid:131) The preparation checklist is updated. (cid:131) The device is labeled with its polling place identifier so that it will be delivered to the targeted polling place. (cid:131) One power cord accompanies each JBC and eScan, and one JBC to eSlate cable accompanies each JBC. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 24 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I (cid:131) The device is boxed up and the box is labeled with its polling place identifier and grouped with the other equipment for that polling place. 4.8.2.2 VBO Preparation The procedure for preparation of a VBO unit is described in the Hart InterCivic Hart Voting System Support Procedures Training Manual 6300-006 6XA. (cid:131) A new roll of paper is installed in the VBO unit. (cid:131) Install a security seal on the VBO unit case and record the serial number. (cid:131) The VBO units are installed in the booths (described in Section 4.8.2.3 and 4.8.2.4). (cid:131) One VBO power supply accompanies each VBO unit. 4.8.2.3 eSlate and Booth Preparation It is not necessary to configure an eSlate or its booth for any particular polling place. Preparation of an eSlate booth for an election involves installing the eSlate and the VBO in the booth: (cid:131) Connect the eSlate serial port to the pigtail cable in the booth. (cid:131) Lock the eSlate into place in the booth. (cid:131) Connect the VBO data cable to the eSlate slider cable. (cid:131) Connect the VBO power cable to the VBO unit. (cid:131) Lock the VBO unit into place in the booth. (cid:131) Install a security seal in the VBO security post. (cid:131) Close the booth. (cid:131) A label can be put on the eSlate booth to indicate its polling place destination. 4.8.2.4 DAU eSlate and Booth Preparation It is not necessary to configure a DAU eSlate or its booth for any particular polling place. Preparation of a DAU eSlate booth for accessible voters in an election involves installing the DAU eSlate and the VBO in the booth. An accessible voting booth has front legs that are shorter than the front legs in standard booths. (cid:131) Label the DAU eSlate booth with a RED strip on the handle-side to indicate it is an accessible voting booth. (cid:131) Install the Audio Card. (cid:131) Connect the headphones to the headphone jack. (cid:131) Connect the DAU eSlate serial port to the pigtail cable in the booth. (cid:131) Lock the DAU eSlate into place in the booth. (cid:131) Connect the VBO data cable to the DAU eSlate slider cable. (cid:131) Connect the VBO power cable to the VBO unit. (cid:131) Lock the VBO unit into place in the booth. (cid:131) Tuck the headphones into the storage compartment. (cid:131) Install a security seal in the VBO security post and record the serial number. (cid:131) Close the booth. (cid:131) A label can be put on the DAU eSlate booth to indicate its polling place destination. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 25 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 5 Polling Place Procedures 5.1 Precinct Supplies, Delivery, and Inspection The jurisdiction provides, delivers, and inspects precinct supplies according to their procedures. Hart InterCivic can supply blank forms that can be customized by the jurisdiction for managing the polling place. The Hart InterCivic Hart Voting System Support Procedures Training Manual 6300-006 6XA contains instructions for: • Polling place equipment acceptance. • Equipment functionality tests. • Planning for the layout and for the equipment and supplies needed for each polling place. • Delivery of passwords for access to the Judge’s Booth Controller or the eScan. 5.2 Polling Place Setup for eSlate System The eSlate System voting equipment for a polling place includes an MBB installed in a JBC and one to twelve eSlates or DAUs. During voting day, the JBC is used to communicate with the eSlates and print Access Code tickets for voters. The following documents that contain poll worker instructions from Hart InterCivic are provided to each polling place: • eSlate Polling Place System Early Voting Desk Reference #6300-133 6XA EV PD • eSlate Polling Place System Election Day Desk Reference #6300-134 6XA ED PD These desk references provide instructions for polling place security, troubleshooting problems, and serving voters with disabilities, and definitions of terms. 5.2.1 Arrange Polling Place Equipment Locate equipment in a way that maximizes traffic flow, yet allows for clear observation of all equipment by pollworkers. Display a copy of materials required by the Elections Code in each booth. 5.2.2 Set Up the Booths • Turn the booth upside down to reveal the legs for the booth. • Assemble the legs as shown on the triangular label on one of the leg braces, being sure to extend the tubes in the feet. • Use two people to turn the booth right-side up. • Open the booth and lock the lid brace. • Deploy the privacy screen as shown on the tag affixed to the screen. 5.2.3 JBC to eSlate Connections The eSlates in the booths are “daisy-chained” together using the provided cables, with the first eSlate in the chain connected to the JBC using the JBC-to-eSlate cable (provided with the JBC). Put the JBC on a table near the first booth, an electrical outlet, and a table for the voter registration book. Connect the JBC to the eSlate in the nearest voting booth with the JBC-to-eSlate cable. Place the accessible voting booth with the DAU eSlate as booth farthest from the JBC, then connect the eSlates to each other. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 26 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 5.2.4 JBC Printer Check the JBC printer paper. 5.2.5 JBC and eSlate Power-Up The JBC and eSlates power up when the power cord is plugged in. Plug the JBC into the wall outlet and allow the system to “boot-up.” • The JBC screen displays instructions and allows user entry of desired selections. • The eSlate screen displays the button/wheel check. 5.2.6 DAU eSlate Tactile Switches Connection In each accessible booth, plug the connector for the tactile input switches into the jack on the right side of the DAU eSlate. 5.2.7 Button/Select Wheel Check Go to each voting booth and exercise the voter input controls and verify correct button/wheel operations on each eSlate by pressing each button on the eSlate to verify that it is selected on the eSlate button check screen. 5.2.8 Enter the Polling Place ID Return to the JBC and locate your Polling Place ID. • Type in the Polling Place ID, verifying each digit displays on the JBC screen. If you make a mistake, press Clear and start over. After the correct ID is entered, press Accept. 5.2.9 Verify the Polling Place Location Verify that the accurate name of the Polling Place is displayed on the Polling Place Location screen. If the correct location is displayed, press Yes. If not, press No and repeat the steps to enter the Polling Place ID. NOTE: Entry of the correct Polling Place ID is required to configure the JBC for the precincts that are allowed to vote in the polling place. 5.2.10 Choose Between Early Voting and Election Day Voting When the JBC display asks if the location is conducting Early Voting, press Yes or No. 5.2.11 Assign the Booths When the Booth Assignment screen displays on the JBC, assign booth numbers to the eSlates: 1. Walk to the booth you want to assign as #1. The screen on the eSlate in the booth should read “Booth Assignment. 2. Press ENTER on the eSlate in that booth. The screen on that eSlate shows: “This is Booth Number: 01” 3. Use the selected signage to indicate Booth #1. Hang the #1 sign on that Booth. 4. Repeat Steps 1 through 3 to assign successive reference numbers to the remainder of the eSlates. When you have assigned a number to the eSlate in every booth, press DONE at the Booth Assignment screen on the JBC. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 27 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I Verify that the number of status lights illuminated on the JBC equates to the number of connected booths. If the booth assignment is correct, press NEXT. 5.2.12 Print the Zero Tape The voting equipment is ready for the election when the Print Zero Tape operation appears on the screen of the JBC. Press Print Zero Tape. Tear off the Zero tape printout and store it in a polling place records envelope. 5.2.13 Complete the Election Form Complete the Oath of Office and Declaration of Intention forms pursuant to Elections Code section 12321. 5.3 Opening the Polls The polls can be opened when the Open Polls choice on the Ready To Open Polls screen appears on the JBC. One minute before the polls are scheduled to open, press Open Polls, then enter the password. The printer prints the Polls Opened report. Tear off the printer tape and store it in a polling place records envelope. Announce that the polls are open. 5.4 Polling Place Procedures A poll worker must attend the JBC at all times while the JBC is in the “polls opened” state to monitor booth status lights on the JBC and to issue Access Codes. A voter should be directed to a booth whose status light on the JBC is GREEN. 5.4.1 Issuing an Access Code to a Voter Each voter needs an Access Code to access one of the eSlates. When a voter has signed in and the election judge has verified the voter is registered to vote within the polling place, the judge uses the JBC to enter the voter’s PRECINCT I.D. The precinct ID may be selected from the screen or manually entered to assign the correct ballot type for the voter. The JBC prints the voter’s Access Code on a slip of paper marked “Access Code” (Access Code ticket). The judge gives the voter their Access Code ticket. Access Code tickets are valid for a set period of time (defined in the BOSS application). 5.4.1.1 Check the Status of An Access Code The status of any Access Code that has been issued can be viewed at the JBC with the Check Code command on the Polls Open screen. 5.4.1.2 Cancel An Access Code An Access Code can be canceled if a voter was issued an Access Code to the wrong ballot style. 1. Press the Other command on the Polls Open screen. 2. Press the Cancel Booth command on the next screen. 3. On the Cancel Booth screen, enter the number of the booth that is armed with the Access Code you want to cancel. 4. Send a poll worker to that booth to press ENTER on the eSlate. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 28 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 5. On JBC, press the Continue command. 6. Press the Polls Open Menu command to return to the Polls Open screen. 5.4.2 Voter Interaction with the VBO The VBO is used to provide the VVPAT (Voter-Verified Paper Audit Trail) printout. When the Summary page appears on the eSlate and the voter presses the CAST BALLOT button on the eSlate, a Verify Ballot screen appears on the eSlate. When the voter selects the Verify Ballot button, the Summary page shown on the eSlate prints on the VBO. While the Summary Page is printing, all buttons on the eSlate are disabled. The voter is expected to read the printout of the Summary Page, then use the eSlate to Accept or Reject the Summary Page contents. If the voter rejects a VBO Summary Page, they can modify their selections on the eSlate. The voter is allowed to repeat the ballot verification and correction process twice, as preset in BOSS. When the voter’s ballot has been cast, the paper in the VBO printer advances to show blank paper through the VBO printer window. 5.4.3 Handling a “Fleeing Voter” The booth indicator light is GREEN when an eSlate in a booth is ready to accept entry of an Access Code. The booth indicator light is RED when an Access Code has been entered in an eSlate in a booth. If a voter leaves the voting booth before they have cast their ballot, the judge attending the JBC will see their booth’s indicator light is still RED, indicating the voter has not cast their ballot. The booth with the ballot that was not cast by the voter before they left the polling place must be cancelled as described in Section 5.4.1.2 Cancel An Access Code in order to prevent another voter from entering that booth while the previous voter’s ballot is still active. 5.5 Special Needs Voters A voter with a special need uses the DAU eSlate voting unit to cast a ballot. The following documents from Hart InterCivic provide instructions to the poll worker for serving voters with disabilities: • eSlate Polling Place System Early Voting Desk Reference #6300-133 6XA EV PD • eSlate Polling Place System Election Day Desk Reference #6300-134 6XA ED PD 5.5.1 Accessible Voting Booth The DAU eSlate voting unit in an accessible voting booth has: • Audio output for “reading” the ballot to the voter in the selected language via headphones. • Remote switch input used for the physically disabled (either tactile input switched or sip and puff device). 5.5.2 Curbside Voting Curbside voting means taking an electronic ballot from the booth to a voter who cannot use the booth. Only the last eSlate on the JBC network can be used curbside. When an eSlate needs to be used curbside for a voter, a poll worker follows these steps: 1. Verify the voter’s eligibility, precinct, language, and need for headphones and/or tactile input switches. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 29 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 2. Print an Access Code for the voter. 3. Enter the voter’s language choice into the last eSlate in the row. 4. Enter the Access Code printed for the voter into that eSlate. 5. When the ballot appears on the eSlate, disconnect the eSlate booth from the JBC network by loosening the thumbscrews on the connector at the rear of the booth. 6. Disconnect the VBO power cord from the booth. 7. Have two poll workers carry the eSlate booth to the voter and instruct the voter how to use the eSlate. 8. When the waving American flag and the “Reconnect to system” message appears on the eSlate, return the eSlate booth to the polling place. 9. Connect the VBO power cord to the booth. 10 Connect the booth cable from the JBC network to the connector on the rear of the last booth. 11. Look for the “Thank you “ page with the waving American flag. 5.6 Provisional Voters 5.6.1 In Precinct 5.6.1.1 eSlate System Provisional Ballots The eSlate System supports the contested voter situation that may arise at a polling place while the polls are open. If a voter’s eligibility to vote cannot be verified, the voter is allowed to vote a ballot provisionally and a determination as to their eligibility is made after some investigation following the close of the polls. To be able to respond appropriately to the this situation, the JBC prints a Voter Provisional Stub which the voter must sign before they are given their Access Code ticket. The Provisional Stub and the documentation required by the jurisdiction are retained by the poll worker. Later, during the official canvass, when the voter’s eligibility to vote is determined, that ballot can be accepted or cancelled within Tally. If it is later determined that the voter voted in the incorrect precinct on the wrong ballot style, Tally automatically accepts the vote choices that the voter was eligible to cast, while rejecting the votes cast in contests for which the voter was not eligible to vote. 5.6.1.2 eScan System Provisional Ballots A provisional voter can use an eScan System’s paper ballot. For a provisional paper ballot, the poll worker must: (cid:131) Fill out the documentation required by the jurisdiction for a provisional paper ballot and give the provisional voter any required documentation. (cid:131) Instruct the voter that they cannot be allowed to scan their paper ballot in the eScan, but must return their ballot in its privacy envelope to the pollworker. (cid:131) File the provisional ballot with its documentation in a secure ballot box. Later, during the official canvass, when the voter’s eligibility to vote is determined, the provisional ballot can prepared for scanning through Ballot Now. 5.6.2 Extended Voting Time If the poll closing is extended beyond the normal closing time, all voters who are allowed to vote during that period must vote a provisional ballot. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 30 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 5.7 Closing the Polls and Vote Reporting 5.7.1 Announcement The following procedure must be completed in public view. • Promptly at the time declared, announce, “The polls are closed.” 5.7.2 Voters Standing In Line Any voter standing in line when it was announced that the polls were closed may cast their vote before the judge presses the Close Polls button on the JBC. 5.7.3 Late Arrivals No one who arrives after the declared poll closing may be issued an Access Code to vote or be allowed to vote. 5.7.4 Closing the Polls After all the voters have finished voting: • Press the CLOSE POLLS button located below the JBC screen. • Enter the Close Polls password. For Early Voting, the polls are suspended and can be re-opened on the next Early Voting day. For Election Day voting, the polls are closed. 5.7.5 Printing Polling Place Reports 5.7.5.1 Early Voting Reports When the polls are suspended, the JBC automatically prints out the reports for the day. The poll worker tears off the reports, completes their reconciliation log form, and files them in the appropriate envelope. The poll worker prints the Suspend Report and leaves that report on the JBC. 5.7.5.2 The Tally Report For Election Day voting, the Polls Closed screen on the JBC includes the capability for printing the Tally Report and the Access Code Report. A copy of the Tally Report shall be printed and posted outside the polling place for public inspection for as long as required by the jurisdiction. To print the Tally Report for posting outside the polling place, select the Print Tally command on the JBC. Tear off the Tally Report and post it outside the polling place. To print the Tally Report for the jurisdiction envelope, select the Print Tally command on the JBC. Tear off the Tally Report and file it in the appropriate envelope. To print the Access Code Report, select the Access Code Report command on the JBC. Tear off the Access Code Report and file it in the appropriate envelope. To print the Tally Report for transport on the eScan, select the Print Tally command on the eScan and do not tear it off. 5.8 Polling Place Setup for eScan System used with a DAU eSlate/JBC for Voter Accessibility The eScan System voting equipment for a polling place includes an eScan device with its MBB and ballot box, as well as a JBC with its MBB and at least one accessible voting booth containing a DAU eSlate. A separate ballot box can be used for securing provisional paper ballots that cannot be scanned in the eScan until the eligibility of the provisional voters is determined during the official canvass procedure. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 31 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I The DAU eSlate/JBC voting equipment for voter accessibility is described in Section 5.5 Special Needs Voters. 5.8.1 Arrange Polling Place Equipment Locate equipment in a way that maximizes traffic flow, yet allows for clear observation of all equipment by pollworkers. Display a copy of materials required by the Elections Code in the polling place. 5.8.2 eScan Printer Check the eScan printer paper. 5.8.3 MBB If the MBB is not already installed, hold the MBB so that the connector end is pointed to the slot and the polling place ID on the MBB is face up, then place the MBB in the slot in the side of the eScan. Close the slot door and affix a Security Seal over the MBB slot. 5.8.4 eScan Power-Up Plug the eScan into the wall outlet and allow the system to “boot-up.” Turn the power switch to ON. • The eScan screen displays instructions and allows user entry of desired selections. 5.8.5 Enter Start-Up Password Enter the start-up password. 5.8.6 Enter the Polling Place ID Enter the Polling Place ID, verifying each digit displays on the eScan screen. After the correct ID is entered, press Accept. 5.8.7 Choose Between Early Voting and Election Day Voting When the eScan display asks if the location is conducting Early Voting or Election Day Voting, press the appropriate button. 5.8.8 Verify the Polling Place Location Verify that the accurate name of the Polling Place is displayed on the Configuration Sequence screen and the election mode (Early Voting or Election Day). If the correct location and mode are displayed, press Yes. If not, press No and repeat the steps to enter the Polling Place ID and election mode. 5.8.9 Print the Zero Tape The voting equipment is ready for the election when the Print Zero Tape operation appears on the screen of the eScan. Press Print Zero Tape. Tear off the Zero tape printout and store it in a polling place records envelope. 5.8.10 Complete the Election Form Complete the Oath of Office and Declaration of Intention forms pursuant to Elections Code section 12321. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 32 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 5.9 Opening the Polls The polls can be opened when the Open Polls choice on the Ready To Open Polls screen appears on the eScan. One minute before the polls are scheduled to open, press Open Polls, then enter the password. The printer prints the Polls Opened report. Tear off the printer tape and store it in a polling place records envelope. Announce that the polls are open. 5.10 Closing the Polls and Vote Reporting 5.10.1 Announcement The following procedure must be completed in public view. • Promptly at the time declared, announce, “The polls are closed.” 5.10.2 Voters Standing In Line Any voter standing in line when it was announced that the polls were closed may cast their vote before the judge presses the Close Polls button on the eScan. 5.10.3 Late Arrivals No one who arrives after the polls closing declared time may be issued an Access Code to vote. 5.10.4 Closing the Polls After all the voters have finished voting: • Press the Poll Worker button located on the back of the eScan. • Enter the password. For Early Voting, the polls are suspended and can be re-opened on the next Early Voting day. For Election Day voting, the polls are closed. 5.10.5 Printing Polling Place Reports 5.10.5.1 Early Voting Reports When the polls are suspended, the eScan automatically prints out the reports for the day. The pollworker tears off the reports, completes their reconciliation log form, and files them in the appropriate envelope. The poll worker prints the Suspend Report and leaves that report on the eScan. 5.10.5.2 The Tally Report For Election Day voting, the Polls Closed screen on the eScan includes the capability for printing the Tally Report and Access Code Report. A copy of the Tally Report shall be printed and posted outside the polling place for public inspection for as long as required by the jurisdiction. To print the Tally Report for posting outside the polling place, select the Print Tally command on the eScan. Tear off the Tally Report and post it outside the polling place. To print the Tally Report for the jurisdiction envelope, select the Print Tally command on the eScan. Tear off the Tally Report and file it in the appropriate envelope. To print the Access Code Report, select the Access Code Report command on the eScan. Tear off the Access Code Report and file it in the appropriate envelope. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 33 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I To print the Tally Report for transport on the eScan, select the Print Tally command on the eScan and do not tear it off. 5.11 Securing Audit Logs and Backup Records Jurisdictional procedures may require that the entire JBC or eScan device be returned to Election Headquarters, or require that the MBB be removed from the JBC or eScan, so that only the MBB is transported to Election Headquarters. 5.11.1 Printed Reports Transport All reports printed from the JBC or eScan (Open Polls Report, Close Polls Report, Suspend Polls Report, Access Code Report), all reconciliation logs, all Provisional Ballot Stubs from eSlate voting, all provisional paper ballots and associated documents from an eScan polling place, and any other jurisdiction documents from the polling place are transported to Election Headquarters. 5.11.2 MBB Transport If the instructions are to remove the MBB from the JBC or eScan at the end of the day, the MBB must never be in the sole custody of one person until the vote results are captured from it. To remove the MBB from the device: • Record the number on the security seal for the MBB. • Remove the Security Seal over the MBB slot on the device. • Take the MBB out of the slot and place in its MBB Transfer Envelope. • Return the MBB to Election Headquarters. 5.11.3 JBC Transport If the instructions require that the entire JBC be transported to Election Headquarters, without removing the MBB, the JBC must never be in the sole custody of one person until the vote results are captured from its MBB. • Unplug the JBC and disconnect it from the eSlate. • Return the JBC to Election Headquarters. 5.11.4 eScan Transport If the instructions require that the entire eScan device be transported to Election Headquarters, without removing the MBB, the eScan must never be in the sole custody of one person until the vote results are captured from its MBB. • Unplug the eScan from power. • Return the eScan to Election Headquarters. • Secure the eScan ballot box and return to Election Headquarters. 5.12 Troubleshooting and Problem Resolution Troubleshooting and problem resolution information is provided in the Hart VS document titled Pollworker’s eSlate Desk Reference, part number 6300-030. 6 Absentee/Mail Ballot Procedures (Central Tabulation) Paper ballots for absentee/mail are printed and processed for CVRs by the Ballot Now application. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 34 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I Ballot Now is designed to support paper-based voting solutions, either as a stand-alone system for smaller entities or to complement the Hart Voting System suite of products. Ballot Now manages a print-on-demand capability to print ballots for testing, sample ballots, and official ballots for delivery to the voter. The same information used to print the ballot is used to define a digital scanning template for processing ballots upon their return. Once the voter returns their marked ballot, Ballot Now uses a high-speed scanner for creating electronic images of the paper ballot, and then applies voting logic to the digital image and extracts the cast vote record. Ballot Now provides functionality to: (cid:131) Apply voting logic to preview and resolve overvoted and undervoted ballots, and write-ins (cid:131) Electronically store election records (cid:131) Manage the process of writing Cast Vote Records (CVRs) into the MBB for transfer to Tally for tabulation (cid:131) Supply a variety of reports about the ballot processing and related activities that can be viewed and printed at any time Ballot Now is to be used only as central processing application and is not to be deployed to remote locations outside of central jurisdiction election headquarters. 6.1 System Startup and Pre-Tabulation Report Procedures Ballot Now receives data from BOSS via the Ballot Now MBB and delivers data to Tally via the Ballot Now MBB. The system receives input from the user and scanned ballots, and provides the user with reports. 6.1.1 Paper Ballot Templates The ballot content and layout for all both electronic and paper ballots for an election are defined and proofed in BOSS. After the ballot information has been input into BOSS: • Ballot content is proofed using the reports produced by BOSS, including review of all ballot styles. • Ballot layouts are viewed or printed with the BOSS preview feature. At this point, changes can easily be made to the ballot data and/or layout. When all changes to the ballot data and/or layout have been made, the text strings and audio prompts are exported out of BOSS to files for delivery to text translation experts and voice recording professionals. The text for each language is translated via a software application that uses UNICODE fonts. The audio is recorded to .WAV files. The translated text files and audio recordings are then imported into BOSS. When ballot content and layout, and language translations and recordings have been verified, the templates for the eSlate System and for paper ballots are selected for generating ballot data for the MBBs. Multiple paper ballot templates are available for selection of paper size, number of columns per page, and language to print on the ballots. When paper ballot templates are selected for generating the ballot styles, BOSS automatically adds a polling place named Ballot Now so that at the time of tabulation in the Tally application, Tally will read MBBs that contain CVRs processed by the Ballot Now application. The Hart VS proprietary data file is written to multiple MBBs. At least one MBB is reserved for use with Ballot Now. 6.1.2 Printing Paper Ballots Detailed instructions for printing ballots from Ballot Now are described in the Hart InterCivic Ballot Now Operations Manual 6100-067 Rev. 32-60B and the Ballot Now Software Training Manual # 6200-003 6XA. Brief steps are presented below. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 35 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I An election database is created in Ballot Now by reading an Election mode MBB from the election and providing the password for the signing key carried on the eCM installed in the Ballot Now PC. 1. The election database is opened in Ballot Now and the following printing options are defined: 2. The Program Options command is selected from the Election menu to open the Program Options window. 3. The Ballot Printing tab is clicked in the Program Options window. 4. The check box for Readable Serial Numbers on Ballot must be de-selected. 5. Other preferences for printing ballots are selected through the Ballot Printing tab: (cid:131) Select Printer – for selecting the printer that can print the ballots on the correct paper size. (cid:131) Print Duplex Ballot – for printing both sides of the paper. (cid:131) Include and Set Up Ballot Stub – for printing a ballot stub on the ballots. 6. The Save button in the Ballot Printing tab of the Program Options window is clicked. 7. The Print Ballots window is opened by selecting the Print Ballots command from the Print menu. 8. Each precinct’s ballot can be previewed by selecting the precinct in the Print Ballots window, the Election ballot type, the language, the political party if the election is a primary election, then clicking the Preview button. A preview of the paper ballot appears in the Ballot Preview window. 9. To print Election ballots for a precinct, the following selections are made in the Print Ballots window: • The precinct is selected • The Election ballot type is selected • The language is selected • The political party is selected if the election is a primary election • The number of copies is selected • The starting serial number is defined 10. The ballots are sent to the printer by clicking the Print button in the Print Ballots window. 6.1.3 Pre-Tabulation Report The following reports should be generated and printed for the record before voted ballots are scanned by Ballot Now: 6.1.3.1 Election Report The Election report lists the election name, status of the Ballot Now database, jurisdiction, election date, MBB serial numbers for Ballot Now MBBs, public counter, Ballot Now private counter, and total number of scan batches in the Ballot Now database. 6.1.3.2 Printed Ballots By Precinct Report The Printed Ballots By Precinct report lists for each printing session, the precinct name and the date, time, user ID, starting serial number, ballot style, language, and number of ballots printed. The report is sorted by precinct name. 6.2 Tabulation Procedures Absentee/mail ballots are scanned in batches by Ballot Now to create a CVR for each ballot. Ballot Now flags ballots with contests that have overvotes, undervotes, and write-ins as needing to be resolved. Blank and damaged ballots are also flagged as needing to be resolved. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 36 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I Ballot Now can be run on a server and multiple clients for resolving voted ballots. Communication between the Ballot Now server and a client is protected by security certificates through SSL. Each network of a Ballot Now server and its clients must be physically separate. When all ballots in all scan batches have been resolved, the CVRs can be written to the Ballot Now MBB and the Ballot Now election database status is set to closed. The Ballot Now MBB is then delivered to Tally where it is read and tabulated for results. 6.3 Post Tabulation Report and Shutdown Procedures Tally reads the CVRs from Ballot Now MBBs as “Absentee” votes and allows reports to be generated that: • Keep Absentee votes separate from Early Voting votes and from Election Day votes. • Combine Absentee and Early Voting votes, and keep Election Day votes separate. • Combine Absentee, Early Voting, and Election Day votes. 6.3.1 Post-Election Reports from Ballot Now The following reports should be generated and printed for retention as part of the election records. Election report — Election name, Ballot Now state (Opened, Closed), jurisdiction, date, MBB serial number, public counter, Ballot Now private counter, and total number of scan batches Election MBBs report — list of MBBs in the Election. Scan Batch Report — for each page of the ballots in a scan batch, lists whether Ballot Now accepted or rejected the page. Deleted Batches report — list of deleted batches. Scan Batch Summary report — summary information for each batch of ballots). Printed Ballots by Precinct report — for each printing session, the precinct name and the date, time, user ID, starting serial number, ballot type, language, and number of ballots printed; sorted by precinct. Scanned Ballots by Precinct report — for each precinct, the scan batch IDs and numbers of scanned ballots that are unresolved, resolved, written to the MBB, and not yet processed by BNIP; sorted by precinct. Scanned Ballots by Batch report — for each scan batch, the scan batch ID, the user ID, date and time associated with the scan batch, and numbers of scanned ballots that are unresolved, resolved, written to the MBB, and not yet processed by BNIP; sorted by scan batch number. Resolve Status Report — for each scan batch, the scan batch ID, the user ID, date and time associated with the scan batch, number of ballots unresolved, resolved, and not yet processed by BNIP; sorted by scan batch. Deleted Ballots report — list of deleted ballots. Certified Write-Ins report — list of certified write-ins entered for all write-in contests. 7 Semi-Official Canvass Tabulation and Reporting 7.1 System Startup and Pre-Tabulation Reports 7.1.1 JBC or eScan Zero Tape A Zero Tape report must printed from a JBC or eScan at a polling place before the polls can be opened. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 37 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 7.1.2 Tally Zero Count Reports The Cumulative Report should be printed from the Tally election database to acquire zero counts before cast vote records from MBBs are read into Tally. The instructions for printing Tally reports are given in the Hart InterCivic Tally Operations Manual 6100-049 Rev. 42-60B and Hart Voting System Support Procedures Training Manual 6300-006 6XA. 7.1.3 Rally Zero Count Reports The MBB Processing Report and Internal Audit Report should be printed from Rally at each Rally station to acquire zero counts before cast vote records from MBBs are read into Rally for transfer to the Tally database. The instructions for printing Rally reports are given in the Hart InterCivic Rally Operations Manual 6100-114 Rev. 22-60A and Tally Software Training Manual 6300-005 6XA. 7.2 Processing Vote Reports Election results reports are generated in Tally. The results from MBBs read into Tally are labeled “Unofficial” until the jurisdiction has determined that: • All MBBs have been read into Tally, including: • MBBs from JBCs • MBBs from eScans • MBBs that may have been read into Rally • MBBs from Ballot Now • All Provisional ballots have been assigned or rejected in Tally. • All write-in votes have been assigned or rejected in Tally. Instructions for using Tally and Rally are described in the following documents from Hart InterCivic: Tally Operations Manual 6100-049 Rev. 42-60B Tally Software Training Manual 6300-005 6XA Rally Operations Manual 6100-114 Rev. 22-60A 7.2.1 Central Tabulation On or before Election Day, the BOSS database for the election is used to initialize the Tally database for tallying the election. When an election worker removes an MBB from a JBC or an eScan, the serial number of the security seal on the MBB door is recorded in the log. The serial numbers of security seals removed from a JBC or an eScan can be cross-checked with the security seal serial numbers log from the warehouse. Acceptable write-in candidate names or aliases are input into Tally. When all the polls have closed, the MBBs from the polling sites and Ballot Now are read into the Tally System or Rally station(s). The MBBs from the Rally station(s) are delivered to Central Tabulation, they are read again into the Tally System. The unique serial number in the MBBs is used to prevent duplicate storage of the information in the MBB. The Tally System tabulates the Cast Vote Records from the MBBs and generates reports that can be viewed on screen and/or printed. The Tally database is closed and archived when the officials determine all information for the election has been stored and resolved in the Tally System. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 38 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 7.2.2 Precinct Tabulation The Tally Reports printed from the JBCs and eScans provide tabulated results from the precincts. These results also reside on the MBBs extracted from the JBCs and eScans and are read into Tally. 7.3 Integration with County Systems and Calvoter Custom reports for precincts can be generated in Tally and exported from Tally in a delimited text file for use by the county and/or state. . 8 Official Canvass and Post-Election Procedures 8.1 Election Observer Panel Each candidate and each side in the case of a ballot measure, shall be allowed not more than two observers for each election results board, and may not touch or handle the transport media. All questions must be directed to the elections official in charge of the election results. 8.2 Canvassing Precinct Returns The Tally Canvass Report provides precinct returns. 8.3 Canvassing Absentee Ballots The Tally Canvass Report provides absentee returns. 8.4 Canvassing Provisional Ballots Votes cast as Provisional ballots are accepted or rejected in the Tally system and reported with normal vote counts in the Tally reports. After the jurisdiction determines the eligibility of each voter who cast a provisional ballot, those ballots eligible for counting are processed to be included in results through Tally’s Provisional Ballots screen. Using the Ballot Code from a provisional ballot’s paperwork, the Tally operator locates the ballot in the list. The operator must then mark the ballot as “Included” and select the precinct that was determined as the precinct the voter was eligible to vote in. Detailed instructions for processing provisional ballots in Tally are provided in the Hart InterCivic Tally Operations Manual 6100-049 Rev. 42-60B and Tally Software Training Manual 6300-005 6XA. 8.5 Canvassing Write-In Votes Tally provides reports of certified and uncertified write-in votes. The Tally operator defines the names of certified write-ins for each contest. On eSlates, contests with write-in names are recorded as text in the Cast Vote Records written to the MBB, and to the eSlate and JBC flash memories. Tally automatically assigns the certified write-ins from the eSlate System’s MBBs to those definitions. On eScans, contests with write-in names are recorded as images in the Cast Vote Records written to the MBB and to the eScan flash memory. The Tally operator uses the Resolve Images functions in Tally’s Write-In Resolution window to view images of write-ins from the paper ballots so that the corresponding certified write- in can be assigned to each image. Tally will automatically assign the certified write-ins as a vote cast for the write-in in the resolved image. Detailed instructions for processing write-in votes in Tally are provided in the Hart InterCivic Tally Operations Manual 6100-049 Rev. 42-60B and Tally Software Training Manual 6300-005 6XA. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 39 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I On paper ballots scanned by Ballot Now, contests with write-in names are assigned or rejected during central count using Tally. The procedure for resolving write-ins in Ballot Now are described in the Hart InterCivic Ballot Now Operations Manual #6100-067 and Ballot Now Software Training Manual 6300-003 6XA. 8.6 1% Manual Recount Procedures 8.6.1 Sample Size In accordance with EC §15360, for the purpose of validating the accuracy of the computer count, within fifteen days after every election, a public manual recount of the ballots cast in at least one percent of the precincts, chosen at random, shall be conducted as to all candidates and ballot measures voted on in each of the precincts. If the random selection of precincts results in an office or ballot measure not being manually recounted, as many additional precincts as necessary shall be selected and manually recounted as to any office or ballot measure not recounted in the original sample. 8.6.2 Count Discrepancy If a discrepancy is discovered between the automated tally and the automatic manual recount tally, the votes will be tabulated again by reading the MBBs into the Tally Election database. 8.7 Handling Ballot Exceptions 8.7.1 Undervotes The eScans are set in BOSS to require the voter’s approval for scanning a blank ballot or a ballot with undervotes. If the voter scans a ballot with undervotes, the ballot is returned to the feeder tray and a message appears on the eScan screen explaining what is wrong with the ballot. The voter can: 1) Remove the ballot from the feeder tray, make changes to the ballot, then re-scan the ballot, or 2) Press the command button to cast the ballot as marked. Undervotes on eSlates are highlighted on the Ballot Summary page of the eSlate screen and the VBO printout of a Ballot Summary page as “No Selection”. The voter can accept to cast a ballot with undervotes. On ballots scanned by Ballot Now, obviously undervoted contests are automatically resolved as undervotes. The procedure for resolving undervoted contests in Ballot Now are described in the Hart InterCivic Ballot Now Operations Manual #6100-067 and Ballot Now Software Training Manual 6300-003 6XA. Undervotes can be included in Tally reports. 8.7.2 Overvotes The eScans are set in BOSS to present a message to the voter to contact a pollworker if their ballot has overvotes and to return the ballot to the feeder tray. The pollworker determines the voter’s intent and takes the appropriate action: 1) To cast the ballot with overvotes, in which case the pollworker presses the Pollworker Button to rescan and accept the ballot, or 2) To spoil the existing ballot and be issued a new ballot, in which case the pollworker takes possession of the overvoted ballot, marks it as spoiled, and files it in the spoiled ballots envelope, then issues a replacement ballot to the voter. 8.8 Post Election Logic and Accuracy Testing Post election logic and accuracy testing of the eSlate System and the eScan System is performed by comparing results obtained from a precinct’s Tally Report printed by the JBC or the eScan during Early Voting Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 40 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I and Election Day voting with the results in the Tally Canvass Report for the same precinct for Early Voting and Election Day voting. Instructions for performing the logic and accuracy testing for the eSlates and eScans are described in the Hart InterCivic Hart Voting System Support Procedures Training Manual 6300-006 6XA. 8.9 Final Reporting of Official Canvass The data for final reporting of the Official Canvass is derived from Tally. Before the data for the election is considered final in Tally: • All MBBs for the election must have been read into Tally. • All MBB data must have been tabulated by Tally. • All write-in votes must be assigned or rejected. • All provisional ballots must be assigned or rejected. • The Tally election database must be finalized to label reports as “Official.” The Canvass Report can then be generated to serve as the Official Canvass for the election from the Canvass Report item in the Reporting tab. • The Canvass Report can be printed. • The Tally Custom Report Wizard can be used to generate subsets of the Canvass Report. • The Tally Export Wizard can be used to export results to a delimited text file. 8.10 Backup and Retention of Election Material 8.10.1 Archiving At the close of the election, all data from the election is to be archived. Archiving of data is a simple process of copying information to a CD. The Tally application stores the complete record of the election. The BOSS database is used to initiate Tally, and when the MBBs are read into Tally, all CVRs and PVS audit data are stored by Tally. By copying the Tally database to CD you have archived the entire election. Data stored by the Rally stations is also archived. It is recommended to archive the BOSS database separately, as well, so that both ends of the election cycle are distinct datasets. This will aid any subsequent review process that may be required. The data is copied to a CD-R disc (a read-only CD) using standard CD-writing software. Once the write process closes the CD-R disc, no additional information can be written to the disc, and the disc will function as a read-only disc. Cast Vote Record and audit log data from eSlates, JBC, and eScans used in the election is downloaded into a database using the SERVO application. Separate “Events” are created in SERVO for downloading of Absentee, Early, and Election Day CVRs and audit logs. The procedures for creating this backup data for an election in SERVO and for archiving the SERVO database are described in the Hart InterCivic SERVO Operations Manual #6100-102 Rev. 41-60B and the Hart Voting System Support Procedures Training Manual #6300-006 6XA. 8.10.2 Retention Backups made on CDs (read-only compact discs) of the election’s databases from the BOSS, Ballot Now, Tally, Rally, and SERVO applications shall be retained in a secure location. The procedures for backing up databases to CD are described in the Hart InterCivic Hart Voting System Support Procedures Training Manual #6300-006 6XA and in the Operations Manual for each software application. All record logs from pre-election equipment preparation and from polling places shall be retained in a secure location. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 41 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I All reports printed from JBCs and eScans shall be retained in a secure location. Master copies of the Cast Vote Records (the MBBs and paper ballots) and the accumulated results from Tally shall be retained in secure locations designated by the local election official and separate from the location of working copies from the time of completion of pre-election Ballot Inspection and Verification: • For as long after the election as required by law; or • By order of a court or directive of the Secretary of State. After certification of the election results, any changes to the central tabulating software or the ballot results sets shall be completely documented in the central system internal audit log. Ballot control logic source code shall be placed in escrow pursuant to state law. Upon certification of the election results, elections code section 17300 through 17306 and 15307 apply to the handling security and disposition of unused materials. The retention of electronic ballots and related election materials is six months for all elections if no federal elections are involved. The federal election retention period is twenty-two months. Retention periods may be extended in the event of a court challenge. 9 Manual Recount Procedures 9.1 Request for Recount A request for a recount and the conduct of the recount shall be made in accordance with the Elections Code section 15600 and following. 9.2 Observers Each candidate and each side in the case of a ballot measure, shall be allowed not more than two observers for each recount board, and may not touch or handle the transport media. All questions must be directed to the elections official in charge of the recount. 9.3 Hours of Operation Prior to the beginning of the recount, all parties will be notified of the hours of operation. 9.4 Ballot Supervision/Breaks At least two people will attend ballots at all times during the recount, including breaks and lunch periods. Recount boards will be permitted break periods in the morning and afternoon, in addition to a lunch break. They will not stop for a break or for lunch while recounting a precinct. 9.5 Recount from SERVO A recount MBB can be created from the election data backed-up to Events in SERVO. The recount MBB can be created from: • All the CVRs from all the JBCs in an Event. • All the CVRs from all the eSlates in an Event. • All the CVRs from all the eScans in an Event. The recount MBB can then be read by Tally and compared with election results. 9.6 Recount from Verified Paper Audit Trail A precinct-by-precinct recount can be performed using the printed version of CVRs cast on an eSlate. The votes from the printed records can be recorded manually and then compared with election results from Tally. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 42 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 9.7 Recount from Ballots Scanned by eScans A precinct-by-precinct recount can be performed on paper ballots scanned by eScans. The votes on the paper ballots can be recorded manually and then compared with election results from Tally. 9.8 Recount from Ballots Scanned by Ballot Now A precinct-by-precinct recount can be performed on paper ballots scanned by Ballot Now. The votes on the paper ballots can be recorded manually and then compared with election results from Tally. 10 Security 10.1 Physical Security of System and Components 10.1.1 Controlled Access to Election Computers The Election Management computers and servers should be operated in a room that is limited to only authorized personnel. The room should be locked except during working hours. Access to the computers should be logged and monitored. Computers should be locked to a desk, table, or stanchion. The housing of a computer should be locked to prevent access to the inside of the computer. 10.1.2 eCMs (eSlate Crytographic Modules) eCMs written for the election should be kept in a secure location. Use of the eCMs should be logged and monitored. 10.1.3 Security Seals on JBCs, eScans, and VBOs Security Seals on JBC and eScan MBB Compartment are locking devices that have unique serial numbers. The security seals must be installed on the JBC’s and eScan’s MBB compartment after the MBB is installed in the device, the VBO’s paper compartment, the VBO’s security post after it is installed in a booth. A record log should be kept of each security seal installed. 10.1.4 Voting Devices in Transit to the Polling Place Booths, JBCs, eScans, VBOs, and eSlates being transported to a polling place must travel in a secure vehicle. 10.1.5 Voting Devices in the Polling Place Booths, JBCs, eScans, VBOs, and eSlates must be stored in a secured location prior to arrival of the pollworkers. At the end of the voting day, the equipment must be returned to Election Headquarters in the presence of more than one person, or secured in the polling place until it is picked up by jurisdiction personnel. 10.1.6 Voting Devices in the Warehouse Booths, JBCs, eScans, VBOs, and eSlates must be stored in a secured location in the warehouse. 10.2 Logical Security of System and Components 10.2.1 Essential and Non-Essential Services and Ports Hart Voting System software applications are installed by Hart InterCivic personnel. The Election Management computer network is isolated from any other network. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 43 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I During installation, the following services are disabled on the jurisdiction’s Election Management System PCs: • Internet Connection Sharing • Automatic Updates • Fax Service • Messenger • Outlook • NetMeeting Remote Desktop Sharing • Telnet • Wireless Configuration • Autorun The Election Management computer will allow access to: CD-writing software Text editor software System printer 10.2.2 Signing Key for Software and Hardware An eCM (eSlate Cryptographic Module), a physical Spyrus USB security key provided by Hart InterCivic, is required for access to secure functions in the BOSS, Tally, Rally, Ballot Now, and SERVO applications on the jurisdiction’s Election Management System PCs. Components for communication with the eCM are installed on the jurisdiction’s Election Management System PCs when an Election Management System’s application is installed. The eCMs should be closely managed. The number of eCMs being used for an election and their PIN(s) should be logged in a secure location. eCMs should be labeled with the election name or similar information, but NOT with the eCM Key ID or PIN. eCMs should be stored in a secure location, separate from election MBBs. In a given election, the signing key on the eCM is used by the BOSS application to accept the ballot formats for the election. BOSS writes the Election’s signing key to every MBB, along with the Election’s ID. A matching signing key must be present in the eCM(s) used in the Ballot Now, Tally, Rally, and SERVO applications. When the eCM is accessed by the BOSS, Tally, Rally, Ballot Now, or SERVO applications, the operator is required to enter the eCM PIN (a password selected by a jurisdiction administrator before the signing key is generated for an election). The JBCs and eScans are reset in SERVO to use the Election’s signing key stored in the eCM. When a JBC or eScan is used in an election, the signing key on the device must match the signing key on the MBB. The signing key for the election and eCM PIN are written to an eCM using the Hart InterCivic eCM Manager application. 10.2.3 User Level Security The BOSS, Tally, Rally, Ballot Now, and SERVO applications require login and password to start the application. The permission levels for users are defined by the jurisdiction when users are added to each software application. The jurisdiction should delete the administrator logins and passwords used by Hart InterCivic personnel during installation of the applications. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 44 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I Composition of User IDs and passwords are described in the Operations Manual for each Hart VS application: • BOSS - See the Hart InterCivic Ballot Origination Software System Operations Manual 6100-019 Rev. 42-60B. • Ballot Now - See the Hart InterCivic Ballot Now Operations Manual 6100-067 Rev. 32-60B. • Tally - See the Hart InterCivic Tally Operations Manual 6100-049 Rev. 42-60B. • Rally - See the Hart InterCivic Rally Operations Manual 6100-114 Rev. 22-60A. • SERVO - See the Hart InterCivic SERVO Operations Manual 6100-102 Rev. 41-60B. The JBCs and eScans require passwords for the following functions: • Start-up • Open polls • Close polls The eScan also requires a Pollworker password for configuration and accepting rejected ballots. The passwords for JBCs and eScans used in the election must be made available to the pollworkers in a controlled, secure manner. NOTE: The passwords for JBCs are the same for all JBCs used in the election and the passwords for eScans are the same for all eScans used in the election, 10.2.4 Anti-Virus Protection Anti-virus software installation is only installed by Hart InterCivic personnel, but updates to definitions may be performed by the jurisdiction personnel from removeable media, such as a CD, but not from an internet download. 10.2.5 Procedures for Verifying, Checking, and Installing Essential Updates and Changes Installation of software and firmware upgrades is performed only by Hart InterCivic personnel if or when necessary. No software or firmware upgrades may be performed unless the upgrade has been certified by the Secretary of State. 10.2.5.1 Audit Records for the Changes Hart InterCivic supplies a log to the jurisdiction and keeps its own record of what software or firmware has been upgraded, when it was upgraded, who performed the upgrade, and why the upgrade was performed. These logs should be retained for the life of the use of the Hart Voting System. 10.2.5.2 Installation Procedures for Updates Hart InterCivic personnel use standardized procedures for installing updates to Election Management System PCs or eSlate system devices. 10.2.5.3 Acceptance Testing After the Installation Hart InterCivic requires the jurisdiction to formally accept upgrades made to their Election Management System PCs, eSlate System, or eScan System devices. For upgrades to Election Management System PCs and/or Hart VS software, Hart InterCivic personnel will provide a log of software to be upgraded along with a description of changes in the upgraded software and install the upgrades certified by the Secretary of State. The versions of upgrade software will be verified by viewing the application version number in the application’s About window, accessed from the Help menu and formal acceptance of the application software upgrades will consist of dated signatures on the upgrade document by the representative of the jurisdiction and the representative from Hart InterCivic. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 45 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I 10.3 Security Procedures for Central Processing MBB processing and Election Night procedures for Central Processing are described in detail in the Hart Voting System Support Procedures Training Manual 6300-006 6XA. MBBs, eSlates, JBCs, and eScans, paper ballots, and their associated logs from the polling places, and from Rally stations if used, are delivered to Central Processing as described in Section 5.11 Securing Audit Logs and Backup Records. Only Jurisdiction personnel may have custody of any devices, paper ballots, VBO paper rolls, and documentation from the polling places and Rally stations. The MBBs from the Rally station(s) are delivered to Central Tabulation, they are read again into the Tally System. The unique serial number in the MBBs is used to prevent duplicate storage of the information in the MBB. Public access to Central Processing procedures shall be limited to viewing only. A number of Jurisdiction personnel are engaged to remove the MBBs from the JBCs and eScans so they can be read into Tally. To remove the MBB from a JBC or eScan, the serial number from the security seal on the MBB door is recorded and the security seal is removed, then the MBB is removed. Different Jurisdiction personnel are engaged to review the reconciliation logs and Tally Reports from the JBCs and eScans from each polling place. Other Jurisdiction personnel use SERVO to back-up the JBCs, eSlates, and eScans, verifying serial numbers for each. Each group of Jurisdiction personnel is responsible for ensuring the security of the devices and documents they manage during these procedures. Additional Jurisdiction personnel retrieve the VBO units from the booths by recording the serial number from each VBO unit security seal, remove the security seal, and take the VBO unit out of the booth. Additional Jurisdiction personnel remove the verified printout rolls from the VBOs by recording the serial number from each paper roll security seal, removing the security seal, opening the VBO unit and removing the printout roll from the VBO unit. 10.4 Security Procedures for Polling Place The MBB in a JBC or eScan can remain secured in the device for transport to central processing or to a satellite processing location that is using the Rally application. The MBB for a JBC, eScan, or Rally station must never be in the sole custody of one person until the MBB is delivered to Central Processing and vote results are captured from it. The MBBs, eSlates, JBCs, and eScans, booths, paper ballots, and their associated logs from the polling places must never be in the sole custody of one person until delivered to Central Processing. If the MBB is removed from the JBC or eScan device for transport to Central Processing along with paper ballots and associated logs so that the devices and booths can be stored at the polling place until they are picked up by the jurisdiction, the booths and devices must be stored in a secure location at the polling place. 10.5 Audit Trails All components of the Hart Voting System create an audit record anytime they are accessed or information is changed. All audit records can be extracted and printed in hard copy. All audit reports, trail documents, databases, and final reports may be archived in hard copy and/or saved electronically to CD-ROM, as needed. • The BOSS, Tally, Rally, Ballot Now, and SERVO applications create audit logs of actions performed. Tally and Rally audit logs are also printed in real-time to a line printer or to a file. The audit log reports for the software applications are described in their respective Operations Manuals: • BOSS - See the Hart InterCivic Ballot Origination Software System Operations Manual 6100-019 Rev. 42-60B. • Ballot Now - See the Hart InterCivic Ballot Now Operations Manual 6100-067 Rev. 32-60B. • Tally - See the Hart InterCivic Tally Operations Manual 6100-049 Rev. 42-60B. • Rally - See the Hart InterCivic Rally Operations Manual 6100-114 Rev. 22-60A. • SERVO - See the Hart InterCivic SERVO Operations Manual 6100-102 Rev. 41-60B. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 46 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I • The JBC, eSlate, and eScan devices create audit logs that are stored in the device and on the MBB. These audit logs are readable through the Device Audit Log reports in SERVO. 10.5.1 Checklist of Audit Trail Reports • BOSS (cid:131) Audit Trail Report – Generated from the Audit Trail command in the Reports menu. • Ballot Now (cid:131) Election Database Audit Log – Generated from the Audit Log – Election command in the Reports menu. (cid:131) Security Database Audit Log – Generated from the Audit Log – Security command in the Reports menu. • Tally (cid:131) Audit Log – Generated from the Audit Log item in the Reporting tab. • Rally (cid:131) Rally – Internal Audit Report – Generated by clicking the Application Log quick link in the sidebar or by selecting the Reports command in the File menu to open the Report Selection window, then selecting Internal Audit Report. • SERVO (cid:131) Device Audit Log – Generated from the Device Audit command in the Reports menu. (cid:131) SERVO Internal Audit Report – Generated from the SERVO Audit command in the Reports menu. 11 Biennial Hardware Certification and Notification EC § 19220 requires jurisdictions to examine voting systems every two years and certify the results to the Secretary of State. Requirements for examination and testing are further detailed in Certification Procedures, Article 15. 11.1 eSlate System Test Procedure The eSlate System test procedure for voting system examination is a combination of portions of the eSlate System acceptance and functionality test procedure and the eSlate System logic and accuracy test procedure described in Hart Voting System Support Procedures Training Manual 6300-006 6XA. 11.1.1 eSlate System Equipment Test In brief, the steps for examination of JBCs, eSlates, and VBOs are as follows after the CVRs and audit logs from the previous election have been backed up to Events in the SERVO database. • Use SERVO and an eCM to write an Election signing key to the JBCs and to clear the CVRs and audit logs from the JBCs and eSlates. • Set up an election in BOSS and write Test MBBs and Audio cards. • Install batteries in the JBCs, eSlates, and VBOs. • Install paper in the JBCs and VBOs. • Install a Test MBB in each JBC. • Set up each JBC connected to up to 12 eSlates that are connected to VBO units. One eSlate should be a DAU eSlate equipped with an Audio card, headphones, and tactile input switches. • Connect the VBO to power. • Connect the JBC to power. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 47 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I • Log the success/failure of each of the following conditions: (cid:131) Verify that the JBC and the connected eSlates/VBOs power up and that the JBC printer and the VBO printer print the initialization/power-on reports. (cid:131) Verify that the AC and Battery power messages on the JBC screen indicate “OKAY”. (cid:131) Verify that the power supply messages on the eSlate screens indicate “OKAY”. 11.1.2 eSlate System Logic and Accuracy Test In brief, the steps for examination of the logic and accuracy of the eSlate System are as follows. • Print a test deck of ballots from Ballot Now. • Vote test deck paper ballots. • Cast matching votes on the eSlates and monitor the accuracy of the ballot summary page printout on the VBO. • Scan test deck paper ballots in Ballot Now. • Tabulate MBBs in Tally. • Document the logic and accuracy tests. 11.2 eScan System Test Procedure The Scan System test procedure for voting system examination is a combination of portions of the eScan System acceptance and functionality test procedure and the eScan System logic and accuracy test procedure described in Hart Voting System Support Procedures Training Manual 6300-006 6XA. 11.2.1 eScan System Equipment Test In brief, the steps for examination of eScans are as follows after the CVRs and audit logs from the previous election have been backed up to Events in the SERVO database. • Use SERVO and an eCM to write an Election signing key to the eScans and to clear the CVRs and audit logs from the eScans. • Set up an election in BOSS and write Test MBBs and Audio cards. • Install paper in the eScans. • Install a Test MBB in each eScan. • Connect the eScan to power and turn it on. • Log the success/failure of each of the following conditions: (cid:131) Verify that the eScan powers up and the screen displays the power-up messages. (cid:131) Verify that the eScan printer prints the initialization report. • Enter the start-up password and open the polls • Inspect the eScan ballot box and test locking it with the key. • Inspect the eScan emergency ballot tray inside the ballot box. 11.2.2 eScan System Logic and Accuracy Test In brief, the steps for examination of the logic and accuracy of the eScan System are as follows. • Print a test deck of ballots from Ballot Now. • Vote test deck paper ballots. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 48 of 4949f Hart Voting System Use Procedures for California - Hart VS 6.1 Part Number 6000-122 Rev I • Log the success/failure of each of the following conditions: (cid:131) Verify that a blank ballot from the election scans. (cid:131) Verify that a marked ballot from the election scans. (cid:131) Verify that an undervoted ballot from the election scans. (cid:131) Verify that an overvoted ballot from the election scans. • Tabulate MBBs in Tally. • Document the logic and accuracy tests. Hart_Sys6_ProposedProcs_(2006-02-22).docSpec_Procedure_California_eSlate Confidential Page 49 of 4949f