Staff Report

HART SYSTEM 6.2 HART INTERCIVIC SYSTEM 6.2: Ballot Now, version 3.3.11 BOSS, version 4.3.13 Rally, version 2.3.7 Tally, version 4.3.10 SERVO, version 4.2.10 eScan, version 1.3.14 JBC, version 4.2.13 eSlate/DAU, version 4.2.13 VBO, version 1.8.3 eCM Manager, version 1.1.7 Staff Review and Analysis Prepared by: Secretary of State Office of Voting Systems Technology Assessment August 4, 2006 Table of Contents I. SUMMARY OF THE APPLICATION...............................................3 II. SUMMARY OF THE SYSTEM.......................................................3 III. TESTING INFORMATION AND RESULTS ................................9 IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS...............................................................................14 V. PUBLIC COMMENT......................................................................21 VI. RECOMMENDATION ...................................................................22 Appendix A- Hart Intercivic System 6.2 Daily Testing Plan..................25 Appendix B- Incident Summary for Volume Test of Hart eScan & eSlate ............................................................................................................32 Page 2 I. SUMMARY OF THE APPLICATION Procedures, hardware, firmware and software developed by Hart Intercivic for use with the System 6.2 voting system, comprised of the following components: eScan, version 1.3.14; JBC, version 4.2.13; eSlate/DAU, version 4.2.13; VBO, version 1.8.3; eCM Manager, version 1.1.7; Ballot Now software, version 3.3.11; BOSS software, version 4.3.13; Rally software, version 2.3.7; Tally software, version 4.3.10; and SERVO, version 4.2.10. II. SUMMARY OF THE SYSTEM The application for System 6.2 consists of ten components. 1. BOSS (Ballot Origination Software System), v. 4.3.13 Boss is a Windows-based software application that is used to define and configure an election, including districts, precincts, contests, parties, and candidates. Once an election is defined within the application, BOSS is used to define and format the ballot layouts, including rotation, for all ballot styles for use with Ballot Now, eScan and the JBC/eSlate voting equipment. The previous version of BOSS, version 4.2.13, was last certified as part of Hart System 6.1 on March 10, 2006. Changes between the current version and the previously certified version of BOSS include: • Added an interface to turn on and off the ballot key unique ballot identification number on the VBO print-out; • Added translation file support for the eScan system, which programs the eScan to sense the language of the ballot and display messages in the appropriate language; • Added configuration settings to control whether or not to report split precincts separately or as a consolidated precinct on the JBC reports tape; • Updated the card reader interface to work with new commercial off-the-shelf (COTS) PCMCIA card readers. (These readers are used to read and write the MBBs); • Fixed a bug that, in rare cases, caused BOSS to incorrectly export Vietnamese instead of English for the ballot definition; and • Added new features that are not used in California, such as “Fractional Cumulative voting”. Page 3 2. Ballot Now, v. 3.3.11 Using the ballot definition data created by BOSS, the Ballot Now software allows the jurisdiction to print its own ballots, for all ballot styles, on approved ballot stock. Once the voter returns their marked ballot, Ballot Now can use a third-party scanner for capturing electronic images of the paper ballot. Ballot Now then applies voting logic to the digital image and extracts the cast vote record. The Ballot Now logic also provides a jurisdiction with the ability to view ballot images and resolve write-ins, as well as to interpret and resolve improperly marked ballots. The collected vote results can then be written to the Hart systems transport media, the MBB (Mobile Ballot Box), for export to Tally for tabulation. The previous version of Ballot Now, version 3.2.4, was last certified as part of Hart System 6.1 on March 10, 2006. Changes between the current version and the previously certified version of Ballot Now include: • Enhanced ballot scanning processing that will accept ballots in any orientation and, for multiple sheet ballots, any page order within a batch; • Ability to accept orphan ballot sheets with multi-sheet ballots. Previously, Ballot Now would not accept a ballot unless all sheets were present. The application will now accept and tabulate a multi-sheet ballot even though one or more sheets are missing; • Correction of a bug that occurred if the user queued a new batch while a large batch for a different precinct was already printing. (In these instances, the precinct change to the new batch would occur immediately on the first batch currently printing); and • Cosmetic changes to the screen display and new features that are not used in California. 3. eScan, v. 1.3.14 The eScan is a precinct-based optical ballot scanner and tabulator. It accepts ballots of different sizes, ranging from 8 ½” x 11” to 8 ½” x 20”, printed single-sided or double-sided. Ballots can be fed into the eScan with any orientation. Unlike conventional optical scan tabulators, the eScan captures a digital image of the entire ballot both front and back, and then resolves the vote choices from within that image. The eScan will provide warning of over-voted contest on a ballot. Optionally, it can provide warning for under voted ballots as well. The base of the eScan serves as a ballot box, with two compartments. The first contains the ballots scanned through the eScan. The second holds “emergency” ballots deposited through a slot in the box should there be an interruption of power. Ballot images and vote results are saved to an MBB for export to Tally. A previous version of the eScan, version1.2.0, was tested as part of System 6.1, but California certification was declined due to numerous problems found in the volume Page 4 test of that version.. Changes between that version and the version proposed for this system include: • Support for all ten (10) languages supported by the Hart voting system., including all California required languages; • Support for multi-sheet ballots. Now the eScan can handle multi-sheet ballots, whether fed together or separate. It also handles orphan ballots when one or more sheets are missing from a multi-page ballot; • Added capability to consolidate vote results for split precincts on the eScan printout of vote results; • Added ballot counts by party for primary elections on the eScan printout of vote results; • Improved error messages presented to voters that clearly inform voters of a problem and ways to resolve it.; • Improved reliability of the scanner interface to eliminate the system alerts and failures found in the testing of the previous version of the eScan; and • Minor bug fixes, such as resolution of an issue that caused a system error when candidate names were longer than 30 characters without a space 4. eSlate, v. 4.2.13 with DAU (Disability Access Unit) The eSlate is a Direct Record Electronic (DRE) voting device. It features a large LCD screen for display of the ballot. A wheel device allows the voter to scroll through the ballot options on the screen and an “Enter” button is used to make a choice. Additional buttons allow the voter to move forward and backward one page, and to finalize the ballot. The eSlate sits in a custom voting booth that features a built-in privacy screen. The eSlate must be connected to a JBC (Judge’s Booth Controller) to receive ballot instructions and to save voted ballot choices. Multiple eSlates can be daisy-chained together for operation in a polling place. The DAU provides support for voters with disabilities. With headphones attached, the eSlate can provide audio instruction so votes who are blind can privately and independently cast ballots. (It should be noted that the eSlate screen cannot be blanked when voters who are blind use the audio voting mode.) The eSlate also features high-contrast and enlarged font mode for persons with visual acuity disabilities. Optional tactile input switches (“jelly switches”) can be attached for voters with mobility impairments. Finally, the DAU supports an interface for sip-puff devices. The previous version of the eSlate, version 4.1.3, was last certified as part of Hart System 6.1 on March 10, 2006. Changes between the current version and the previously certified version of the eSlate include: Page 5 • Capability to disable automatic adjustment of the internal clock for daylight savings time.; • Enhanced support of curb-side voting so that if the eSlate is unplugged before the access code is input, it can now simply be plugged back in to input the voter access code. (Previously, if the eSlate was disconnected without the access code first being input, one had to take down the whole line of eSlates, reboot and reassign all the eSlates to the JBC. Now if this happens, one can simply plug back in the eSlate, input the access code, and then proceed with curbside voting). • Hardware modifications to reduce the incident rate of errors encountered during the volume test of the previous system. (An aluminum “slider plate” was added to the booth assembly and the VBO power connect was replaced.) 5. VBO (Verifiable Ballot Option), v. 1.8.3 The VBO is Hart’s Accessible, Voter-Verified Paper Audit Trail for the eSlate DRE device. The VBO is a reel-to-reel device that mounts onto the eSlate voting booth beside the eSlate tablet itself. It features a thermal printer that prints to a 4”-wide roll of paper. The VBO can be programmed to print ballot images in various font sizes. In accordance with California requirements, the VBO allows the voter to view, accept or in some cases reject his or her ballot up to two times before automatically finalizing the ballot on the third try. Should a VBO experience a paper jam or otherwise malfunction in a polling place on Election Day, the VBO is designed to be swapped out in its entirety as a sealed unit to preserve the record and secrecy of the vote. The VBO was first certified as part of Hart System 6.1 on March 10, 2006 as version 1.7.5. Changes between the current version and the previously certified version of the VBO include: • Improved (more robust) communication between the eSlate and the VBO, as well as improved “low paper” detection algorithm, to reduce the incidence of VBO printer errors encounted in the last volume test. 6. JBC (Judge’s Booth Controller), v. 4.2.13 The JBC is the heart of the eSlate precinct voting system. The JBC can control up to twelve eSlate voting units, providing instructions to, monitoring activity on and recording vote results captured from the eSlates. The JBC features an LCD screen for instructions and messages to the poll workers, as well as display of the public and private counters for the voting system. Once a voter’s eligibility has been determined, a poll worker uses the keypad on the JBC to select the voter’s precinct and party. The JBC then issues a slip of paper bearing a four-digit numeric code. The voter then inputs this code into any of the connected eSlate devices to activate the correct ballot style for that voter. Prior to opening the polls, the JBC’s self-contained printer prints a zero-tape to demonstrate this system is clear and ready for voting to begin. At the close of the polls, the JBC can print a Page 6 results tape and audit log in that same manner. Finally, vote results from the polling place system are written to a MBB device for export to Tally. The previous version of the JBC, version 4.1.3, was last certified as part of Hart System 6.1 on March 10, 2006. Changes between the current version and the version previously certified include: • Added capability to consolidate vote results for split precincts on the JBC printout of vote results; • Added total ballot counts on the JBC results tape for all elections, as well as ballot counts by party for primary elections; • Removal of a previous limitation that restricted the number of contests that included a write-in option to one hundred within any given precinct; • Added requirement for input of the administrative password before the polls can be closed early on Election Day; and • Features not used in California. 7. Rally, v. 2.3.7 Rally is a Windows-based software application that reads and stores vote results from MBBs before relaying those results to the Tally application via local network or modem as unofficial canvas results. Communication between Rally and Tally is password protected and is further protected by SSL (Secure Sockets Layer) security keys. Rally is typically deployed in a geographically large jurisdiction to allow vote results to initially be gathered and relayed from remote locations to the central jurisdiction office. The previous version of Rally, version 2.2.4, was last certified as part of Hart System 6.1 on March 10, 2006. The only change reported between this version and the previously certified version was the addition of support for “fractional voting” – a feature not used in California. 8. Tally, v. 4.3.10 Tally is a Windows-based software application that reads, stores and tabulates the ballot images from the MBBs. Tally is initialized with the finalized BOSS database that was used to create and configure the election. As votes results are accumulated, Tally can be used to resolve write-in votes and provisional ballots. If a provisional ballot is cast in the wrong precinct on the wrong ballot style, Tally automatically applies the eligible vote selections to the correct ballot, in accordance with California law. Finally, Tally offers a wide range of flexible reports including canvass results, audit trails, polling place status and MBB status. The previous version of Tally, version 4.2.8, was last certified as part of Hart System 6.1 on March 10, 2006. Changes between the current version and the previously certified version of Tally include: New Features: Page 7 • Added support for multi-sheet eScan ballots, including ability to handle orphan ballots when not all sheets or a single ballot are scanned; • Modification of the canvass report to support up to 255 candidates within a single contest; • Ability to export registered voter totals in a comma-delimited format for update or correction, as well as the capability to import them in this format. (Previously, these totals were locked down with the BOSS database early in the election cycle, and they could not be updated after that point as late registrations were processed by a jurisdiction); • Addition of a report on blank ballots by precinct; and • New features not used in California, such as fractional cumulative voting. 9. SERVO (System for Election Records & Verification of Operations), v. 4.2.10 Servo is a Windows-based software application that serves as an election records and recount management system for the Hart voting system. Prior to an election, SERVO resets the eSlates, JBCs and eScans to clear all previously recorded information (except the private counter) in preparation for the upcoming election. SERVO also programs the election’s security keys into the JBCs and eScans. At the conclusion of the election, SERVO records copies of the vote results directly from the JBCs and eScans to provide an additional back-up of the election data, as well as to provide a cross-verification of canvass results for a recount, and to maintain an ongoing equipment history. The previous version of SERVO, version 4.1.6 was certified on March 10, 2006 as part of Hart System 6.1. Changes between the current version and the previously certified version of Servo include: New Features: • Capability to enable or disable the automatic adjustment for daylight savings time in eScans, JBCs and eSlates. • Support for printing the cast-vote-records (CVRs) for multiple sheet eScan ballots. 10. eCM Manager, v. 1.1.7 eCM Manager is a software application that reads and writes a Key ID and password to an eCM (eSlate Cryptographic Module), a physical Spyrus USB security key that is required for access to secure functions in the BOSS, Ballot Now, Rally, Tally and SERVO applications. This system allows jurisdictions to create a unique cryptographic key for each election. The eCM Manager version 1.1.7, was last certified as part of Hart System 6.1 on March 10, 2006, and is included unchanged as part of the proposed System 6.2 Page 8 III. TESTING INFORMATION AND RESULTS 1. Federal Testing We have received a copy of a letter from Wyle Laboratories, dated June 30, 2006, stating that they have examined the hardware modifications to the eSlate voting booths and determined that no additional testing is required of those modification. CIBER Inc. has reported successful completion of federal qualification testing of the HART Intercivic System 6.2 to the Federal 2002 Voting System Standards. We have received a copy of the draft report from that testing, dated June 9, 2006. A final report must be received from CIBER upon report acceptance from NASED or the EAC and prior to consideration for State certification of this system. Federal qualification of the system by NASED is still pending and must be issued before the Secretary of State can consider this system for certification for use in California. 2. State Testing by the Secretary of State and Consultant Testing Overview State examination and functional testing of this system was conducted by Secretary of State staff in conjunction with the State’s technical consultants Mr. Paul Craft and Ms. Kathleen McGregor at the Hart Intercivic office in Lafayette, Colorado from June 26 through June 30, 2006. At the end of testing of the system, it was discovered that the primary election and general election definitions used for the testing had actually been built in the previous version of BOSS, version 6.1, rather than the version that was being tested. Because of this, a re-test was scheduled and performed July 24 through July 26, 2006 at the Secretary of State’s Office in Sacramento, using election definitions from BOSS version 6.2. This additional testing was also conducted by Secretary of State staff and the State’s technical consultants, Mr. Paul Craft and Ms. Kathleen McGregor. The test plans for those examinations are included as an appendix to this document. Volume test of the eScan was conducted on July 11, and of the eSlate on July 13, 2006. Both tests were conducted at the Orange County Registrar of Voters’ facility in Santa Ana, California. The volume tests were also conducted by the State’s technical consultants Craft and McGregor, and by Secretary of State staff. General Testing Results Testing of the Hart Intercivic System 6.2 was completed successfully. During that testing, installation of the trusted software build was verified. Sufficient ballots were processed for the standard state primary and general test elections to verify features of the system, as well as to test the system’s capability to conduct elections in accordance with California law. However, during testing the following issues were noted: Page 9 • Ballot layout is established in BOSS based on one of several pre-established templates that were included as part of the System 6.2 that was tested by the Independent Testing Authority (ITA). There appeared to be several problems with how the system handled long candidate names, particularly names longer than thirty characters. On the VBO audit trail and the eSlate summary screen, names longer than the allowed space were simply truncated to the allowed space, which varied depending on the font size selected. During paper ballot layout and design, long names will be wrapped, and the user has no control over where that line break occurs in the name. Finally, it was discovered on the eSlate that for certain layouts, when in large-font mode, candidates with names longer than thirty characters did not appear on the screen, although the vote target and position would appear. The vendor noted that some of these issues could be corrected by creation of a new ballot layout template by the vendor. Due to the technology employed for these templates within the system, there is some question on whether the templates constitute “system data” or whether they are part of the system code that is examined, tested and qualified by the ITA, in which case, requalification could be required before new or modified ballot layout templates could be used. Certification of this system should stipulate that such new or modified templates cannot be used in California without a determination and written statement from the ITA or the EAC that reexamination and requalification of such modifications are not required. • During Primary L&A testing, dirty scanner read heads caused multiple ballots to have a vertical line in the Ballot Now scanned image that extended through multiple voting targets, causing those contests to be interpreted as over-voted. The problem was resolved by cleaning the scanner heads and then rescanning the ballots. Nevertheless, this could be a concern for jurisdictions that use the Ballot Now “auto-resolve” feature that automatically interprets such markings as over- voted without human review and confirmation, In such instances, large numbers of voters could be automatically disenfranchised. The vendor should be required to address this in the Use Procedures through scanner cleaning and maintenance, as well as ballot processing procedures and procedures for appropriate use of the auto-resolve feature.. • During L&A testing for the test Primary election, there were multiple incidents where the scanner mis-fed multiple ballots simultaneously, processing them as a single ballot. To prevent this, Use Procedures for the system should specify determination of the quantity of ballots within a batch before scanning, and confirmation of that quantity once the batch has been scanned in Ballot Now, before that batch is accepted. • During the testing of the eScan, there were multiple incidents where the eScan spontaneously rebooted itself. The vendor suspected that that particular eScan was defective and swapped it for another eScan unit. There were no further problems with the replacement unit. Page 10 • During Primary testing, tester found that if a ballot was rejected on the eScan, he could double feed ballots after pushing the "accept ballot" override button. He could also feed two ballots in rapid succession during the override. The vendor explained that the system is designed to capture and process the image during the initial scan. When rejected and then overridden, the previously captured image is retained and not rescanned, and the eScan just takes physical custody of the ballot(s). The latter case suggests an risk of the voter accidentally feeding the second sheet of a two sheet ballot during the override of the first sheet. For this reason, Use Procedures must specify that if there is a two-sheet ballot, the jurisdiction must configure the eScan so that only the poll worker can override a rejected ballot. Future versions of the eScan should address this problem so as to prevent simultaneous feeds of multiple ballots. • It was discovered that in a primary election with split-precincts, the results tape printed from the JBC only includes the vote results for the first precinct in the split if the JBC is set to print consolidated results. The votes from all other precincts in the split are omitted from this report. It was verified that the actual votes are correctly stored on the JBC and on the MBB, and are accurately read and imported into Tally. Testers were also able to verify that the JBC results tape was accurate if the consolidate option was disabled. The vendor confirmed this is due to a bug in the program that can only be corrected through modification of the code. Use Procedures for the system must clearly state that the consolidation option for the JBC in a primary election until this bug is corrected in future versions. • As in the previous version, Tally still cannot report vote results directly in the granularity required for the Supplement to the Statement of Vote (SSOV). To properly report those results, jurisdiction must export the raw precinct data and manipulate that data with an alternate tool like Excel. for manual manipulation). Future versions of Tally should correct by allowing the user to export the data in the formats required in California. • BOSS will not allow a ballot measure to have text that spans columns. For large font, this limits the ballot measure to approximately 200 characters. While the list of candidates within a contest can span multiple columns, they cannot span multiple pages. This limitation should be addressed in the system Use Procedures and should be corrected in future versions of the system . Volume Testing Results The Secretary of State staff and the State’s technical consultants Paul Craft and Kathleen McGregor conducted the volume test of the Hart eScan on July 11, 2006, and on the eSlate July 13, 2006, at the Orange County Registrar of Voters’ warehouse. The volume tests were conducted in accordance with the Secretary of State’s standard protocol for volume testing. (This protocol may be obtained from the Secretary of State website at: http://www.ss.ca.gov/elections/elections_vs.htm) Approximately 10 temporary contract workers were hired by the Secretary of State to perform the testing for the eScan and approximately thirty-five temporary contract Page 11 workers were hired by the Secretary of State to perform the testing on the eSlate. All testing was directly observed by Secretary of State staff. Finally, the overall testing environment was recorded continuously on videotape and pictures were taken of displayed errors for documentation. All errors were documented as to whether they were attributed to the equipment or to human performance. At the discretion of the test director, specific errors were documented with either photographs and/or videotape. Generally, successive errors of the same type were not documented in such detail once their initial instances had been captured. eScan Volume Test A total of fifty machines were tested with a minimum of four hundred ballots running through each machine. Every machine was tested from booting up to shut down, along with all necessary reports printed prior to opening polls and after closing polls. In the process of this test, thirteen errors were logged. Of these thirteen errors, four were ballots that were initially rejected because they failed to scan properly. In such instances, the eScan displays a message alerting the voter that the ballot was not properly scanned and that it needs to be removed and scanned again. In each case, the ballots were removed and rescanned without incident. This is a normal function of the machine when a ballot fails to scan properly. On one occasion, the paper ran out when the machine was printing the closing report. The machine displayed a normal out of paper error message. However once a new roll was installed, the machine failed to reset the error message. The error was cleared by recycling the power. Once the machine was re-booted, it successfully reprinted the report. In one instance, a machine received a ballot jam error. Prior to clearing the ballot, the tester fed another ballot, which caused the first ballot to clear and fall through into the ballot box. Since the machine had not completed processing the first ballot, the second ballot was not scanned or counted. The first fatal error occurred at the beginning of the test when an eScan failed to boot up. Two unsuccessful attempts were made to boot the machine before it was pulled from the test. Three eScans each experience two ballot jams. In each instance, the only way to clear these errors was to recycle the machine and open the ballot box to clear these jams. In a normal election, because a machine should not be rebooted, nor the ballot box opened, the machine would have been pulled from service. At the conclusion of the test, the vote results were printed and verified for each eScan. In all but one instance, the results were completely accurate. As noted above, in the incident where the tester cleared a ballot jam accidentally by inserting the next ballot, the second ballot was not scanned. This was confirmed by a reconciliation of the vote results from that eScan. This scenario is not likely to occur on Election Day because voters do not typically have a stack of ballots they are feeding through the eScan in rapid succession. Page 12 Out of the fifty (50) machines tested, we would have pulled four machines from service on Election Day. It should be noted that if a machine is pulled from service during an Election, the eSlate ballot box contains a manual bypass slot to collect ballots that aren’t scanned. These ballots can be easily tabulated electronically after the close of the polls. eSlate Volume Test A total of one hundred machines were tested with at least 110 ballots processed per machine. Each machine was tested from booting up, all the way through turning off the machine after closing reports are completed. Throughout the volume test process, nine incidents were logged. Eight out of the nine incidents were dealing with the VBO printer that is attached to the eSlate machine. The one other incident was due to invalid access code errors that can likely be credited to a human error as an artifact of the test process. In the incident with the invalid access codes, a series of five (5) access codes were generated ahead of time in preparation for the test. Once the tester received the codes, she attempted to enter them on the eSlate machine and received an invalid access code error message on each one. The incident was recorded and new access codes were provided to the tester, who continued voting without a problem. Although the cause of this was not conclusively determined, it is suspected that the access codes had simply timed out. Access codes expire after a certain period of time that is determined by the jurisdiction in defining the election. In one incident, the machine displayed a error message that the printer was not available on the first ballot. It was determined that the power cable that for the VBO had not been properly seated. Once the power cable was secured in place, the machine was able to process the ballot without further incidents. Two of the machines tested generated an “out of paper” error (error number VBO102). In accordance with the normal polling place procedures, the VBO was swapped out, allowing the tester to resume casting votes. Both of these VBOs were opened and examined. In both incidents, it was determined that the VBO still had almost half a roll of blank paper and that the error message was a false error. In a real election, the VBO’s are sealed and may not be opened by a poll worker. They would be simply swapped and the eSlate machine placed back in service to continue processing ballots. On one of the eSlate machines, the tester claimed that the printer was dragging and printing at variable speeds. The incident was recorded and the printing performance was observed through several ballots, during which it was determined to be working normally. Voting resumed without further incidents. One final eSlate machine received a Printer Jam error on four different occasions. In each incidence, the VBO was swapped out, and the tester resumed voting ballots. After the fourth incident, it was determined there was a problem with the actual eSlate and it was pulled from the test. Out of 100 machines tested, only one eSlate was removed from service during the test. It should also be noted that while many of the cryptic error messages that were noted in the previous version of the eScan system, the eSlates still displayed several such Page 13 messages that are not easily understandable by the voter. In the short term, jurisdictions using this system should keep a pre-printed list of the error messages, their interpretation and the recommended resolution at each polling place for a voter to review should such an error be encountered. The vendor should be required to replace these error code messages with clear, plain-text, understandable error messages in future versions of this system. IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS A review of the appropriate Elections Code sections was conducted. §15360. During the official canvass of every election in which a voting system is used, the official conducting the election shall conduct a public manual tally of the ballots tabulated by those devices cast in 1 percent of the precincts chosen at random by the elections official. If 1 percent of the precincts should be less than one whole precinct, the tally shall be conducted in one precinct chosen at random by the elections official. In addition to the 1 percent count, the elections official shall, for each race not included in the initial group of precincts, count one additional precinct. The manual tally shall apply only to the race not previously counted. The system supports this requirement. §19300 permit the voter to vote for all the candidates of one party or in part for the candidates of one party and in part for the candidates of one or more other parties. The system meets this requirement. §19301. A voting machine shall provide in the general election for grouping under the name of the office to be voted on, all the candidates for the office with the designation of the parties, if any, by which they were respectively nominated. The designation may be by usual or reasonable abbreviation of party names. The system meets this requirement. §19302. The labels on voting machines and the way in which candidates’ names are grouped shall conform as nearly as possible to the form of ballot provided for in elections where voting machines are not used. The system meets this requirement. Page 14 §19303. If the voting machine is so constructed that a voter can cast a vote in part for presidential electors of one party and in part for those of one or more other parties or those not nominated by any party, it may also be provided with: (a) one device for each party for voting for all the presidential electors of that party by one operation, (b) a ballot label therefore containing only the words “presidential electors” preceded by the name of the party and followed by the names of its candidates for the offices of President and Vice President, and (c) a registering device therefore which shall register the vote cast for the electors when thus voted collectively. If a voting machine is so constructed that a voter can cast a vote in part for delegates to a national party convention of one party and in part for those of one or more other parties or those not nominated by any party, it may be provided with one device for each party for voting by one operation for each group of candidates to national conventions that may be voted for as a group according to the law governing presidential primaries. No straight party voting device shall be used except for delegates to a national convention or for presidential electors. The system complies with these requirements. §19304. A write-in ballot shall be cast in its appropriate place on the machine, or it shall be void and not counted. The system complies with these requirements. §19320. Before preparing a voting machine for any general election, the elections official shall mail written notice to the chairperson of the county central committee of at least two of the principal political parties, stating the time and place where machines will be prepared. At the specified time, one representative of each of the political parties shall be afforded an opportunity to see that the machines are in proper condition for use in the election. The party representatives shall be sworn to perform faithfully their duties but shall not interfere with the officials or assume any of their duties. When a machine has been so examined by the representatives, it shall be sealed with a numbered metal seal. The representatives shall certify to the number of the machines, whether all of the counters are set at zero (000), and the number registered on the protective counter and on the seal. The system supports this requirement. §19321. The elections official shall affix ballot labels to the machines to correspond with the sample ballot for the election. He or she shall employ competent persons to assist him or her in affixing the labels and in putting Page 15 the machines in order. Each machine shall be tested to ascertain whether it is operating properly. The system supports this requirement. §19322. When a voting machine has been properly prepared for an election, it shall be locked against voting and sealed. After that initial preparation, a member of the precinct board or some duly authorized person, other than the one preparing the machines, shall inspect each machine and submit a written report. The report shall note the following: (1) Whether all of the registering counters are set at zero (000), (2) whether the machine is arranged in all respects in good order for the election, (3) whether the machine is locked, (4) the number on the protective counter, (5) the number on the seal. The keys shall be delivered to the election board together with a copy of the written report, made on the proper blanks, stating that the machine is in every way properly prepared for the election. The system supports this requirement. §19340. Any member of a precinct board who has not previously attended a training class in the use of the voting machines and the duties of a board member shall be required to do so, unless appointed to fill an emergency vacancy. The system does not affect this requirement. §19341. The precinct board shall consist of one inspector and two judges who shall be appointed and compensated pursuant to the general election laws. One additional inspector or judge shall be appointed for each additional voting machine used in the polling place. The system does not affect this requirement. §19360. Before unsealing the envelope containing the keys and opening the doors concealing the counters the precinct board shall determine that the number on the seal on the machine and the number registered on the protective counter correspond to the numbers on the envelope. Each member of the precinct board shall then carefully examine the counters to see that each registers zero (000). If the machine is provided with embossing, printing, or photography devices that record the readings of the counters the board shall, instead of opening the counter compartment, cause a “before election proof sheet” to be produced and determined by it that all counters register zero (000). If any discrepancy is found in the numbers registered on the counters or the “before election proof sheet” the precinct board shall make, sign, and post a written statement attesting to this fact. In filling out the statement of return Page 16 of votes cast, the precinct board shall subtract any number shown on the counter from the number shown on the counter at the close of the polls. The system supports this this requirement. §19361. The keys to the voting machines shall be delivered to the precinct board no later than 12 hours before the opening of the polls. They shall be in an envelope upon which is written the designation and location of the election precinct, the number of the voting machine, the number on the seal, and the number registered on the protective counter. The precinct board member receiving the key shall sign a receipt. The envelope shall not be opened until at least two members of the precinct board are present to determine that the envelope has not been opened. At the close of the polls the keys shall be placed in the envelope supplied by the official and the number of the machine, the number written on the envelope. The system does not affect this requirement. §19362. The exterior of the voting machine and every part of the polling place shall be in plain view of the election precinct board and the poll watchers. Each machine shall be at least four feet from the poll clerk’s table. The system does not affect this requirement. §19363. Voters shall not remain in or occupy the booths or compartments longer than is necessary to mark their ballots, which shall not exceed five minutes. However, where no other voter would be inconvenienced, a longer period shall be allowed. The system does not affect this requirement. §19370. As soon as the polls are closed, the precinct board, in the presence of the watchers and all others lawfully present, shall immediately lock the voting machine against voting and open the counting compartments, giving full view of all counter numbers. A board member shall in the order of the offices as their titles are arranged on the machine, read and distinctly announce the name or designating number and letter on each counter for each candidate’s name and the result as shown by the counter numbers. He or she shall also in the same manner announce the vote on each measure. If the machine is provided with a recording device, in lieu of opening the counter compartment the precinct board shall proceed to operate the mechanism to produce the statement of return of votes cast record in a minimum of three copies, remove the irregular ballot, if any, record on the statement of return of votes cast record. The irregular ballot shall, be Page 17 attached to the statement of result record of votes cast for the machine and become a part thereof. One copy of the statement of return of votes cast for each machine shall be posted upon the outside wall of the precinct for all to see. The statement of return of votes cast for each machine for the precinct shall constitute the precinct statement of result of votes cast. The system supports this requirement. §19371. Before adjourning, the precinct board shall seal the operating lever with the seal provided and lock the machine so that the voting and counting mechanism may not be operated. It shall remain locked and sealed against operation until the time for filing a contest of election has expired, which shall not exceed a period of 30 days following the declaration of the result of the election by the body canvassing the returns. Does not apply. §19380. During the reading of the result of votes cast, any candidate or watcher who may desire to be present shall be admitted to the polling place. The proclamation of the result of the votes cast shall be distinctly announced by the precinct board who shall read the name of each candidate, or the designating number and letter of his or her counter, and the vote registered on the counter. The board shall also read the vote cast for and against each measure submitted. The board shall not count votes cast for write-in candidates, but shall have these counted by the elections official. During the proclamation, many opportunities shall be given to any person lawfully present to compare the result so announced with the counter dials of the machine, and any necessary corrections shall immediately be made by the precinct board, after which the doors of the voting machine shall be closed and locked. If the machine is provided with a recording device, the alternate procedures in Section 19370 may be used. The system meets this requirement. §19381. In each election district where voting machines are used, statements of the results of the vote cast shall be printed to conform with the type of voting machine used. The designating number and letter on the counter for each candidate shall be printed next to the candidate’s name on the statements of result of the vote cast. Two such statements shall be used in each election district. The system meets this requirement. §19382. The statement of the result of votes cast, which shall be certified by the precinct board, shall contain: Page 18 (a) The total number of votes cast. (b) The number of votes cast for each candidate and measure as shown on the counter. (c) The number of votes for persons not nominated. (d) Printed directions to the precinct board for their guidance before the polls are opened and when the polls are closed. (e) A certificate, which shall be signed by the election officers before the polls are opened, showing: (1) The delivery of the keys in a sealed envelope. (2) The number on the seal. (3) The number registered on the protective counter. (4) Whether all of the counters are set at zero (000). (5) Whether the public counter is set at zero (000). (6) Whether the ballot labels are properly placed in the machine. (f) A certificate that shall be filled out after the polls have been closed, showing: (1) That the machine has been locked against voting and sealed. (2) The number of voters as shown on the public counter. (3) The number on the seal. (4) The number registered on the protective counter. (5) That the voting machine is closed and locked. The system meets this requirement. §19383. A member of the precinct board shall enter the vote, as registered, on the statements of result of votes cast, in the same order on the space that has the same name or designating number and letter, after which another member shall verify the figures by calling them off in the same manner from the counters of the machine. The counter compartment of the voting machine shall remain open until the official returns and all other reports have been fully completed and verified by the precinct board. If the machine is provided with a recording device, the alternate procedures in Section 19370 may be used. The system meets this requirement. §19384. The precinct board shall, before it adjourns, post conspicuously on the outside of the polling place a copy of the result of the votes cast at the polling place. The copy of the result shall be signed by the members of the precinct board. If the machine is provided with a recording device, the statement of result of vote’s cast produced by operating its mechanism may be considered the “result of the votes cast” at the polling place. Page 19 The system meets this requirement. §19385. The precinct board shall immediately transmit unsealed to the elections official a copy of the result of the votes cast at the polling place, the copy shall be signed by the members of the precinct board, and shall be open to public inspection. The system meets this requirement. §19386. Before proceeding to canvass the returns of an election at which voting machines have been used to register the votes cast, the board authorized to canvass returns shall open the counter compartment and compare the records of votes cast for the several candidates voted for and for and against the several measures voted upon shown on each machine with those recorded on the statement of results of votes cast prepared from that machine by the precinct board. Any errors found on the statement shall be corrected by crossing out the recorded incorrect number, and recording the correct number nearby. The system meets this requirement. The Voting Rights Act of 1965, as amended (42 U.S.C. 1973), requires all elections in certain covered jurisdictions to provide registration and voting materials and oral assistance in the language of a qualified language minority group in addition to English. Currently in California, there are six VRA languages (Spanish, Chinese, Japanese, Vietnamese, Korean and Tagalog) as prescribed under the law. The system fully meets this requirement. Ballot Now can print paper ballots in any of the required languages. Further, the eScan can read ballots printed in any of the required languages and display error messages to the voter in that language. The eSlate can display the ballot in any of the required languages. Finally, the eSlate can be programmed to provide audio instruction through the DAU in any of the required languages. The National Voter Registration Act of 1993 (42 U.S.C. 1973gg and 11 CFR 8) allows for the casting of provisional ballots through Fail-Safe Voting procedures. The system meets this requirement. The JBC and the eSlates support casting a provisional ballot electronically for later resolution. The Voting Accessibility for the Elderly and Handicapped Act of 1984 (42 U.S.C. 1973ee through 1973ee-6) requires each political subdivision conducting elections within each state to assure that all polling places for federal elections are accessible to elderly and handicapped voters, except in the case of an emergency as determined by the state’s chief election officer or unless the state’s chief election officer: (1) determines, by surveying all Page 20 potential polling places, that no such place in the area is accessible or can be made temporarily accessible, and (2) assures that any handicapped voter assigned to an inaccessible polling place will, upon advance request under established state procedures, either be assigned to an accessible polling place or be provided an alternative means of casting a ballot on election day. As noted above, the eSlate with DAU provides the following accessibility support for voters with disabilities: • audio ballot instructions for blind voters • high contrast display and enlarged fonts for voters with visual acuity problems • Large buttons for voters with mobility issues for interaction with voting device. • sip-puff interface and tactile switches for voters with mobility issues Finally, the entire eSlate voting booth can be temporarily disconnected and moved to the voter for curbside voting. The Retention of Voting Documentation (42 U.S.C. 1974 through 1974e) statute applies in all jurisdictions and to all elections in which a federal candidate is on a ballot. It requires elections officials to preserve for 22 months all records and papers which came into their possession relating to an application, registration, payment of a poll tax, or other act requisite to voting. Note: The US Department of Justice considers this law to cover all voter registration records, all poll lists and similar documents reflecting the identity of voters casting ballots at the polls, all applications for absentee ballots, all envelopes in which absentee ballots are returned for tabulation, all documents containing oaths of voters, all documents relating to challenges to voters or absentee ballots, all tally sheets and canvass reports, all records reflecting the appointment of persons entitled to act as poll officials or poll watchers, and all computer programs used to tabulate votes electronically. In addition, it is the Department of Justice’s view that the phrase “other act requisite to voting” requires the retention of the ballots themselves, at least in those jurisdictions where a voter’s electoral preference is manifested by marking a piece of paper or by punching holes in a computer card. The system meets this requirement. V. PUBLIC COMMENT On July 21, 2006, an stakeholder demonstration of this system was held at the Secretary of State headquarters for invited representatives of the accessibility community, as well as county elections officials and members of the VSTAAB, to observe and review this system with Secretary of State and vendor staff. Participants included: • three representatives of the accessibility community, • two representatives of the VSTAAB, and Page 21 • various members of the Secretary of State staff. Participants in this event were asked to submit written comments on the system. All such comment received by the close of the public comment period will be presented to the Secretary of State. VI. RECOMMENDATION Staff recommends certification of the of the Hart Intercivic System 6.2 comprised of the following: eScan, version 1.3.14; JBC, version 4.2.13; eSlate/DAU, version 4.2.13; VBO, version 1.8.3; eCM Manager, version 1.1.7; Ballot Now software, version 3.3.11; BOSS software, version 4.3.13; Rally software, version 2.3.7; Tally software, version 4.3.10; and SERVO, version 4.2.10 with the following conditions: 1. No additional software developed by the Vendor other than that specifically listed in this certification shall be installed on any computer running any component of the Hart System 6.2 voting system. 2. No substitution or modification of the voting systems shall be made with respect to any component of the voting systems, including the Procedures, until the Secretary of State has been notified in writing and has determined that the proposed change or modification does not impair the accuracy and efficiency of the voting systems sufficient to require a re-examination and approval. 3. The Secretary of State reserves the right, with reasonable notice to Vendor and to the counties using any of the voting systems, to modify the Procedures used with any of the voting systems and to impose additional requirements with respect to the use of any of the systems if the Secretary of State determines that such modifications or additions are necessary to enhance the accuracy, reliability or security of any of the voting systems. Such modifications or additions shall be deemed to be incorporated herein as if set forth in full. 4. Any county using any voting system shall, prior to such use, file with the California Secretary of State a copy of its Election Observer Panel plan. 5. The vendor agrees in writing to provide, and shall provide, to the Secretary of State, or to the Secretary of State’s designee, within 30 (thirty) days of the Secretary of State’s demand for such, a working version of the voting system, including all hardware, firmware and software of the voting system, as well as the source code for any software or firmware contained in the voting system, including any commercial off the shelf software or firmware that is available and disclosable by the vendor, provided that the Secretary of State first commits to the vendor in writing to maintain the confidentiality of the contents of such voting system or source code so as to protect the proprietary interests of the vendor in such voting system or source code. The terms of the commitment to maintain confidentiality shall be determined solely by the Page 22 Secretary of State, after consultation with the vendor. The voting system shall not be installed in any California jurisdiction until the vendor has signed such an agreement. Any reasonable costs associated with the review of the source code for any software or firmware contained in the voting system shall be born by the vendor; 6. A final version of the Use Procedures for the system is submitted to and approved by the Secretary of State. These Use Procedures must address all the issues raised in this report. 7. The county elections official must submit to the Secretary of State a plan for voter and poll worker education no later than 30 days prior to the election in which the system will be used. Training shall be conducted for all personnel, including poll workers, on the appropriate elements, including security procedures, that are detailed in the Secretary of State approved Use Procedures for this system. 8. The Secretary of State reserves the right to monitor activities before, during and after the election at any precinct or registrar of voters’ office, and may, at his or her discretion, conduct a random parallel monitoring test of voting equipment. 9. Pursuant to this (application, agreement, contract, etc.) and by order of the Secretary of State, voting systems certified for use in California shall comply with all applicable state and federal statutes, regulations, rules and requirements, including, but not limited to, those voting system requirements set forth in the California Elections Code and the Help America Vote Act of 2002, and those requirements incorporated by reference in the Help America Vote Act of 2002, that are in effect as of the date of this (application, agreement, contract, etc). Further, voting systems shall also comply with all applicable state and federal voting system guidelines, standards, regulations and requirements that derive authority from or are promulgated pursuant to and in furtherance of the California Elections Code or the Help America Vote Act of 2002 or other applicable state or federal law when appropriate, that are in effect as of the date of this (application, agreement, contract, etc), including but not limited to, the 2002 Voting System Standards/Guidelines, developed by the Federal Election Commission and adopted by the Election Assistance Commission (EAC) and EAC Advisory 2005-004, dated July 20, 2005. This does not include future final court interpretations of existing state or federal law not in effect as of the date of this (application, agreement, contract, etc.). 10. Voting system manufacturers and/or their agents shall assume full responsibility for any representation that a voting system complies with all applicable state and federal requirements as referenced above. In the event such representation is determined to be false or misleading, voting system manufacturers or their agents shall be responsible for the cost of any upgrade, retrofit or replacement, of any voting system or its component parts, found to be necessary for certification or to otherwise be in compliance. 11. Any voting system purchased with funds allocated by the Secretary of State’s Office shall meet all applicable state and federal standards, regulations and requirements, including, but not limited to, those voting system requirements as Page 23 set forth in the California Elections Code and the Help America Vote Act of 2002 and those requirements incorporated by reference in the Help America Vote Act of 2002 that are in effect as of the date of this (application, agreement, contract, etc), including but not limited to, the 2002 Voting System Standards/Guidelines, developed by the Federal Election Commission and adopted by the Election Assistance Commission (EAC) and EAC Advisory 2005-004, dated July 20, 2005. 12. The vendor must establish a California County User Group and hold at least one annual meeting where all California users and Secretary of State staff are invited to attend and review the system and ensure voter accessibility. 13. In addition to depositing the source code in an approved escrow facility, the vendor must deposit a copy of the system source code and binary executables with the Secretary of State. The Secretary of State reserves the right to perform a full independent review of the source code. 14. The vendor must provide printing specifications for paper ballots to the Secretary of State. The Secretary of State will certify printers to print ballots for this system based upon their demonstrated ability to do so. The vendor may not require exclusivity in ballot printing and must cooperate fully in certification testing of ballots produced by other ballot printers. Page 24 Appendix A- Hart Intercivic System 6.2 Daily Testing Plan Exam Plan Monday (June 26) through Tuesday (June 27) 1. Document testing platform (all equipment used in testing) 2. Review system modifications since last examination (Change Log) 3. Verified installation of software a. Verify virgin servers b. Installation of software from trusted builds c. Capture and document baseline 4. Verify test decks conform to State specifications 5. Review of system documentation (compare operating instructions and other documentation against actual system) 6. Prepare system for test primary election. Wednesday (June 28) 7. Conduct test primary election a. Diagnostic setup (with Use Procedures) i. BOSS ii. Ballot Now iii. eScan iv. PVS (JBC/eScan) b. Logic & Accuracy test of system i. Ballot Now ii. EScan iii. PVS (JBC/eScan) c. “Open Polls” according to Use Procedures i. Generate zero reports for Ballot Now, eScan & JBC d. Cast Votes i. Ballot Now (portion of test deck + manually marked ballots) 1. Resolve ballots ii. EScan (remainder of test deck) iii. PVS (JBC/eSlate) 1. Pattern voting, 3 ballots per ballot style (precinct/party combination) 2. Audio voting e. “Close Polls” according to Use Procedures i. Generate results reports from Ballot Now, eScan & JBC f. Consolidate and Report i. Import from Ballot Now Page 25 ii. Rally to Tally (eScan and JBC) iii. Canvass reconciliation 1. Provisional Ballots 2. Write-Ins iv. Generate final reports 1. SOVC 2. Summary 3. Precincts 4. Use reports 5. Audit reports g. Servo – recovery and clear Thursday (June 29) 8. Conduct test general election a. Logic & Accuracy test using verified test deck i. Ballot Now ii. eScan b. Modify test deck i. Fold ballots ii. Print ballots without ballot ID numbers and without barcodes that include an embedded ballot ID number. iii. Mark additional ballots (no more than 20 per ballot style) c. Open polls according to procedures (incl zero reports) i. Ballot Now (configure to start scanning ballots) ii. eScan iii. JBC d. Cast Votes i. Absentee (Ballot Now) ii. Precinct optical scan (eScan) iii. eSlate 1. pattern vote 2. test language capabilities for 3 specified languages: English, Spanish and Chinese 3. test audio mode a. verify logic 4. test and verify alternative accessibility functionality test provisional ballots e. Close polls according to procedures i. Generate poll reports 5. eScan 6. JBC f. Consolidate i. Rally to Tally using closed IP network and by direct MBB transfer ii. Reconcile write-ins using Ballot Now and Tally Page 26 iii. Reconcile provisional ballots using Tally iv. Exercise Vote Total Adjustment feature in Tally. v. Print final reports & verify 7. SOVC (Hart canvass report) 8. Summary (Hart cumulative report) 9. Precincts (Hart precinct report) 10. Use Reports (Hart turnout report, MBB Status report, Polling Place Status, Precinct Election Day Status, Precinct Election Day Status with MBB Ids, and Precinct Turnout) 11. Audit logs from all system components 12. Additional reports: Ballot Status, Reassigned Provisional Ballots, Write-Ins Certified/Accepted and Write-Ins Rejected/Unresolved g. Recovery – Servo (backup, create recount cards and reset equipment) Friday (June 30) 9. Special Election (Recall) test b. Mark ballots (non-standard markings) c. Open polls (zero tapes) d. Cast votes i. Ballot Now ii. eScan e. Close Polls i. Generate poll reports using eScan f. Consolidate & print reports i. Verify totals between Hart equipment and manual count of Test Recall Election ballots ii. Verify consistency of ballot reads across platforms by comparing vote totals between Ballot Now and eScan 10. Final data capture – all test election data backed up on CD 11. Debrief with vendor ReTest Plan July 24 – 27 12. Verified installation of software a. Verify virgin servers b. Installation of software from trusted builds Page 27 c. Capture and document baseline 13. Verify test decks conform to State specifications 14. Document testing platform (all equipment used in testing), including identification pictures 15. Prepare system for test primary election. a. Burn MBBs with old & new card readers b. Using Servo, initialize eScans & eSlates for election. c. Finalize BOSS 16. Conduct Primary Test Election a. Logic & Accuracy test of system (eScan & Ballot Now only) i. Print ‘no scanned ballots’ report from Ballot Now and a zero- tape from eScan ii. Run ballots according to the schedule below Config (Pct assignment) Voting activity Ballot Now Test deck: precincts 1, 2-1, 2-2 eScan Test deck: precincts 3, 4, 5 iii. Resolve ballots in Ballot Now iv. Print results from eScan v. Upload all results to Tally, compile and generate reports of results by machine and consolidated report of all ballots. vi. Proof & verify all reports b. “Open Polls” according to Use Procedures i. Generate zero reports for eScan & JBC. Generate “No Scanned Ballots” report for Ballot Now. Page 28 c. Cast Votes i. System Configuration Unit Simulates Pct Assignment Voting activity Ballot Now Absentee All Test Deck: Pcts 1, 4, 5 EScan Precinct Voting All Test Deck: Pcts 2-1, 2-2, 3 + hand-marked ballots JBC/eSlates Precinct Voting All Pattern voting ii. Ballot Now (portion of test deck) 1. Feed ballots in all orientations 2. Folded ballots 3. Resolve ballots iii. EScan (remainder of test deck + hand-marked ballots) 1. Feed ballots in all orientations iv. PVS (JBC/eSlate) 1. Pattern voting, 3 ballots per ballot style (precinct/party combination) d. “Close Polls” according to Use Procedures i. Generate results reports from Ballot Now, eScan & JBC 1. Verify JBC results tape includes ballot counts by party & precinct, as well as total ballots cast. 2. Verify eScan results tap includes ballot counts by party & precinct e. Consolidate and Report i. Test voter registration count correction 1. Export registration counts 2. Modify 3. Re-import ii. Import from Ballot Now 1. Read MBB using new card reader iii. Rally to Tally (eScan and JBC) 1. Read MBB using new card reader iv. Canvass reconciliation 1. Write-Ins v. Generate final reports & verify 1. SOVC 2. Summary 3. Blank Ballot report 4. Precincts 5. User reports (archive samples of various reports as files.) 6. Audit reports 7. Verify correct voter registration counts f. Servo – recovery and clear i. Read cards using old and new card readers 17. Conduct test general election Page 29 a. Configuration Unit Simulates Pct Assignment Voting activity Ballot Now Absentee All Test Deck: Pcts 1, 2-1, 2-2, 5 EScan Precinct Voting All Test Deck: Pcts 2-1, 2-2, 3, 4 + hand-marked ballots JBC/eSlates Precinct Voting All Pattern voting b. Logic & Accuracy test using verified test deck iii. Ballot Now iv. eScan c. Modify test deck i. Mark additional ballots (no more than 20 per language – Spanish & Chinese) d. Open polls according to procedures (incl zero reports) i. Ballot Now (configure to start scanning ballots) ii. eScan iii. JBC e. Cast Votes i. Absentee (Ballot Now) 1. Verify the main form/screen displays the election name & UNC pathname of the datafile. ii. Precinct optical scan (eScan) 1. Verify messages displayed in appropriate language per ballot 2. Attempt jam conditions (like ballot pull back) and verify messages include clear simple text iii. eSlate 1. pattern vote 2. test language capabilities for 3 specified languages: English, Spanish and Chinese 3. test audio mode a. verify logic 4. test and verify alternative accessibility functionality test a. Jelly switches b. Sip/puff 5. provisional ballots 6. Test curbside voting a. Test/verify graceful recovery if eSlate is disconnected for curbside voting before the access code is input f. Close polls according to procedures i. Generate poll reports 7. eScan a. Verify results tape includes total ballots cast by precinct and grand total 8. JBC Page 30 a. Verify results tape includes total ballots cast by precinct and grand total g. Consolidate i. Rally to Tally using closed IP network and by direct MBB transfer ii. Reconcile write-ins using Ballot Now and Tally iii. Reconcile provisional ballots using Tally iv. Exercise Vote Total Adjustment feature in Tally. v. Print final reports & verify 9. SOVC (Hart canvass report) 10. Summary (Hart cumulative report) 11. Blank Ballot report 12. Precincts (Hart precinct report) 13. Use Reports (Hart turnout report, MBB Status report, Polling Place Status, Precinct Election Day Status, Precinct Election Day Status with MBB Ids, and Precinct Turnout) 14. Audit logs from all system components 15. Additional reports: Ballot Status, Reassigned Provisional Ballots, Write-Ins Certified/Accepted and Write-Ins Rejected/Unresolved h. Recovery – Servo (backup, create recount cards and reset equipment) 18. Final data capture – all test election data backed up on CD Page 31 Appendix B- Incident Summary for Volume Test of Hart eScan & eSlate eScan Volume Test _____________________________________________________________________________________________________________________________________________________ SECRETARY OF STATE REPORT FOR HART CERTIFICATION OF SYSTEM 6.2 JULY 25, 2006 #tnedicnI emiT # enihcaM # tollaB tropeR tnedicnI sotohP oediV Critical (Vote Record Error Lost) rorrE enihcaM rorrE namuH rorre raelc ot rewoP elcyceR egasseM nacs-eR :nacs ot deliaf tollaB raelc ot xob tollab nepo :maj tollaB tollab gninepo tuohtiw raelc :maj tollaB xob 1 8:21 2 1 X X "Bootup of machine failed" two attempts were made 1 2 9:13 21 33 X X X Ballot failed to scan – Message “Ballot failed to scan – Remove the 1 1 ballot and try scanning it again” 3 9:18 21 106 X Ballot did not scan properly 1 1 4 9:37 31 198 X Ballot did not scan properly 1 1 5 9:38 36 193 X Ballot did not scan properly 1 1 6 10:14 16 401 X X X Closing of Polls, paper ran out. Printer error could not clear 1 1 7 10:40 3 7 X 2nd ballot was fed before first dropped 1 1 1 8 11:42 38 0 X X X Ballot Jam on first ballot, no error message displayed 1 1 1 9 1:47 38 252 X Ballot Jam – No error Message Displayed 1 1 1 10 2:13 48 65 X X X Ballot Jam past scanning heads. Would not drop 1 1 11 2:50 48 214 X X Same as #10 1 1 1 12 4:45 50 329 X X Same as #11 1 1 1 13 4:56 50 386 X X X Same as #12 1 1 1 TOTALS 1 13 1 6 4 0 6 Critical (Vote Record Lost) • In one instance (incident #7), the actual voted ballot was lost without counting. The second ballot was fed while the system was still processing the first ballot. Voter must wait until the “Ready to scan ballot” message appears before feeding the next ballot. Very critical with multiple page ballots. Recycle Power to clear error • In six (6) instances, the machine needed to have the power recycled in order to clear the error. Ballot faild to scan: with re-scan message “Ballot Failed to scan – Remove the ballot and try scanning it again” • In four (4) instances, the ballot was not scanned properly and the machine rejected it. The machine displayed the message above. Ballot was pulled free and rescanned without further incident. This is a normal function for this machine. Ballot jam: open ballot box to clear • None of the ballot jams required the ballot box to be opened in order to clear error. Ballot jam: clear without opening ballot box • In these six (6) instance, the ballot had already cleared the scanning heads and was hanging past the last rollers used for feed ballot through. The ballots would clear after the power was recycled. Human errors • In one (1) instance (incident # 7), the error could have been avoided by waiting to the message “Ready to scan ballot”. You may notice that both machine and human error are credited to this. The machine should not accept a secondary ballot whether it is fed early or not. The human error is credited because tester did not wait for the machine to complete the process of the first ballot. This is a concern when multiple page ballots for an election are required. Not a concern for one (1) page ballots. _____________________________________________________________________________________________________________________________________________________ SECRETARY OF STATE REPORT FOR HART CERTIFICATION OF SYSTEM 6.2 JULY 25, 2006 eSlate Volume Test _____________________________________________________________________________________________________________________________________________________ SECRETARY OF STATE REPORT FOR HART CERTIFICATION OF SYSTEM 6.2 JULY 25, 2006 #tnedicnI emiT # enihcaM # tollaB tropeR tnedicnI sotohP oediV Critical (Vote Unit taken Record Machine Human out of Error Lost) Error Error service noitcnuF lamroN 201-OBVE :rorre retnirP 401-OBVE :rorre retnirP tuo deppawS OBV 1 9:37 47 3 X Printer Unavailable Contact Poll Worker “Rejected Ballot” 1 1 Printer check, power cord was out of position. 2 1:57 84 ? X Printer Unavailable - EVBO-102 (false out of paper) 1 1 1 3 2:10 34 3 X Invalid Access Code on 5 Ballots – Voter claims not to have 1 voted. 4 1:35 15 ? X Printer Unavailable - EVBO-102 Paper was low 1 1 1 1 5 3:05 71 18 X X X Contact Poll Worker – Printer Unavailable – EVBO – 104 1 1 1 6 3:45 71 30 X X Contact Poll Worker – Printer Unavailable – EVBO – 104 1 1 1 Paper Jammed 7 3:55 71 35 X X Contact Poll Worker – Printer Unavailable – EVBO – 104 1 1 1 1 Pink Slack on paper was visible 8 4:06 71 35 X Contact Poll Worker – Printer Unavailable – EVBO – 104 1 1 1 9 5:45 33 87 X X Printer seemed to print slow 1 TOTALS 0 8 2 1 2 2 4 5 Machines with Errors: Count = 6 (15, 33, 34, 47, 71, 84) Critical (Vote Record Lost) • Not a single error caused the tester to lose their vote. Machine Error • Eight (8) of the nine (9) instance are credited to machine error, however in the case of incident #1. The machine gave a valid error caused by a human error. Human Error • In the first incident, the power cord for the printer was not properly secured which caused the printer to not function. • In the third incident, the access codes were rejected by the machine which is a normal function. It is suspected that these codes were created to far in advance which caused them to expire. Unit Taken Out of Service • Only one machine needed to be taken out of service due to multiple printer errors. This machine had four (4) VBO Printers swapped out prior to being taken out of service. VBO Printer Error: EVBO-102 • In two occasions, the EVBO-102 error occurred . According to HART, this is the out of paper error message. In both incidents, the printer still had plenty of paper. VBO Printer Error: EVBO-104 • Four instances occurred where error EVBO-104 appeared. The message is an indication that the printer is unavailable due to various reasons including a paper jam. All four documented occurrences occurred on the same machine. The VBO was swapped out in all occurrences and the printer function normal for a few ballots. After the fourth occurrence, the machine was removed from service. VBO Swapped Out • The printer was swapped out to clear the error in five (5) instances. This is normal procedure when a printer jams, malfunctions or runs out of paper. Poll workers are not permitted to open and remove the paper audit trail. _____________________________________________________________________________________________________________________________________________________ SECRETARY OF STATE REPORT FOR HART CERTIFICATION OF SYSTEM 6.2 JULY 25, 2006