Hart Verity Voting 3.2 Staff Report

Office of Voting Systems Technology Assessment | 1500 11th Street, 6th Floor Sacramento, CA 95814 | Tel 916.695.1680 | www.sos.ca.gov HART INTERCIVIC INC. VERITY VOTING 3.2 Staff Report Prepared by: Secretary of State’s Office of Voting Systems Technology Assessment 8/09/2023 Table of Contents I. INTRODUCTION............................................................... 3 II. SUMMARY OF THE SYSTEM........................................... 4 III. TESTING INFORMATION AND RESULTS...................... 11 IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS....................................................... 29 V. CONCLUSION…………………………….………………….37 2 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM I. INTRODUCTION 1. Scope This report presents the test results for the certification testing of the Hart InterCivic Inc. (Hart) Verity Voting 3.2 voting system. The purpose of testing is to evaluate the compliance of the voting system with California Voting Systems Standards, and state and federal laws. Testing also uncovers other findings, which do not constitute non- compliance, and those findings are reported to the voting system vendor to address the issues procedurally. The procedures for mitigating any additional findings are made to the documentation, specifically the Verity Voting 3.2 California Use Procedures. 2. Summary of the Application Hart submitted an application for the Verity Voting 3.2 voting system on February 8, 2023. In addition to the software, which includes the executable code and the source code, Hart was required to submit the following: • The Technical Documentation Package (TDP), • All the hardware components to field two complete working versions of the system, including all peripheral devices, one for the Functional Test Phase and one for the Security Test Phase, • Ten Verity TouchWriter ballot marking machines, and all the peripherals that would be in the polling place, • Twenty Verity Scan precinct scanners, and all the peripherals that would be in the polling place, • Six Verity Reader machines, and all the peripherals that would be in the polling place, and • The Verity Voting 3.2 California Use Procedures. The voting system is comprised of the following major software components: • Verity Scan: Software version 3.2, • Verity TouchWriter: Software version 3.2, • Verity Reader: Software version 3.2, • Verity Print: Software version 3.2, • Verity Device Microcontroller: Software version 17, • Verity Data: Software version 3.2, • Verity Build: Software version 3.2, • Verity Central: Software version 3.2, • Verity Count: Software version 3.2, • Verity Election Management: Software version 3.2, • Verity Desktop: Software version 3.2, and • Verity User Manager: Software version 3.2. 3 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM 3. Contracting Upon receipt of a complete application, the Secretary of State released a Request for Proposal (RFP) for assistance with the Functional, Accessibility, Volume, and Security Review, which is comprised of Security/Telecommunications and Source Code (Software Review) Testing. Through the formal California contracting process, the Secretary of State awarded a contract to SLI Compliance (SLI), a division of Gaming Laboratories International, LLC, of Wheatridge, Colorado. II. SUMMARY OF THE SYSTEM The Verity Voting 3.2 system is a paper ballot based voting system, utilizing standardized Verity paper ballots throughout the system. It consists of two closed networks. One network connects the development environment (Data/Build), and one network connects the tabulation and scanning (Central and Count) environment. Both networks are closed and are not connected to any external network. There is no ability for the system to use wireless or Bluetooth connections. This separation creates an airgap between the development environment and the tabulation environment, and between the entire system and any external networks. If jurisdictional protections are implemented, it is not currently possible for the system to be compromised from the outside. The vDrives that are returned from jurisdictions after voting and need to be reintroduced to the system are cleaned/reformatted using a Power Digital USB drive duplicating machine to reformat the drives. Development Environment Tabulation Environment Data/Build I Server Data/Build Client n Central Server Central Client Count t e r n a l A i r g a p Printers Scanners External Airgap The network protocol is TCP/IP, utilizing static IP addressing. Name resolution is accomplished by a static HOSTS file. All computer-based systems utilize the Windows 4 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM 10 Long-Term Servicing Channel (LTSC) Operating System. The LTSC edition of Windows 10 provides deployment options for special-purpose devices and environments that will not be modified long term. These devices typically perform a single important task and all applications and services not necessary for the voting system have been removed, thereby minimizing the attack surface. The Verity 3.2 ballot utilizes timing marks called landmarks. Eight landmarks are located at all four corners of the ballot, front and back. In addition, it utilizes redundant bar codes on the front and back of the ballot used for election administration. There is no bar code or QR code used for tabulation. Ballots are tallied from the marked bubbles on the ballot. The redundant barcodes on a Verity ballot are used for election maintenance. The bar code contains Precinct, Party, Ballot Type, and Election ID. Verity ballots are tabulated from the marked bubbles on the ballot and bar codes are not used for any tabulating functions. The Verity 3.2 system is not backwards compatible and cannot be used to load an election from any other previous system (Verity 3.1 or Verity 3.1.1) and print reports. Verity 3.2 facilitates additional language support. By default, Verity 3.2 includes 19 languages: • English • Spanish • Bengali • Punjabi • Chinese • Vietnamese • Cantonese • Khmer • Japanese • Tagalog • Hawaiian • Hindi • Korean • Ilocano • Hmong • Thai • Lao • Haitian Creole • Gujarati Verity supports adding new languages to devices and workstations via the “Language Pack” functionality if and when additional languages become required for a jurisdiction. Language Packs allow for languages to be added without the need for a Verity software change or version upgrade. The following languages can be added: • Urdu • Farsi • Burmese • Mien • Mongolian • Telugu • Nepali • Tamil • Russian • Arabic • Ukrainian • Syriac • Indonesian Al l scanners utilized for tabulation, as well as all computers are commercial off the shelf (COTS). The polling place devices including Print, Scan, Writer, and Reader are COTS 38BT tablets, built into a proprietary case. After the elections are created (Data/Build), election definitions and data are distributed to polling place devices with a vDrive USB drive which uses a digital signature specific to California to validate data integrity and ensure no changes to data. Devices boot and run from a Compact Flash (CFAST) card, which also utilizes a digital signature. The CFAST cards are locked in the machine and cannot be accessed without a key. All workstations and servers run from redundant, one 5 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM terabyte hard drives in a mirrored (identical copies of each other) configuration (RAID 1), which are encrypted. The Verity 3.2 system consists of the following major components: Verity Election Management System (EMS), Verity Data, Verity Build, Verity Central, Verity Count, Verity Scan, Verity TouchWriter, Verity Print, and Verity Reader. 1. Election Management System The Verity Election Management System set of applications are responsible for all pre- voting and post-voting groups of activities in the process of defining and managing elections. The complete EMS software platform consists of client (end-user) and server (back- end) applications as follows: • Verity Data: Data is used by election officials to enter election data for contests, candidates, proposition text, translations, and audio. Data also provides the user with controls for proofing of data, layout, and performs validation prior to locking the data to ensure its readiness for use in Verity Build, the election definition software. Data utilizes an Oki C831 printer for batch printing of ballots on demand, ballots for proofing, jurisdictional and precinct reporting, etc. • Verity Build: An election definition and device settings component. Build is a required component of the Verity Voting system, used by officials to complete pre-voting tasks for creating and generating an election definition and ballots. Build provides a ballot layout proofing process. The process establishes relationships between election data, jurisdiction, and polling place data for the shared election definition. Build will create the portable media, called vDrives, to provide a method of transferring the shared election definition to Verity Voting machines and other Verity components. The vDrive uses an “airgap,” or non- networked transfer method, to provide more secure exchange of election data. • Verity Central: A central ballot scanning and adjudication component used by officials for paper ballot scanning, contest resolution, and conversion of voter selection marks to electronic Cast Vote Records (CVRs). Once the CVRs are written to vDrive(s) they can be transferred into Verity Count for vote tabulation and reporting of election results. Verity Central records cast vote records only; it does not tabulate. • Verity Count: Used by officials to complete post-voting functionality to tabulate election results and generate reports. Count receives the CVRs from portable media devices (vDrives) used to record CVRs from Hart voting machines or Verity Central workstations. Verity Count can be used by officials to resolve Verity Scan or Verity Central write-in votes for paper ballots that were manually marked. Count can also be used to collect and store all election logs from every 6 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM Verity component/machine used in the election, allowing for complete election audit log reviews. • Verity Election Management: The Election Management application is available only on Verity server workstations. This software enables authorized users to add, import, export, archive, restore, and manage elections. Once an election is added or imported into the Election Management application, the election can be opened and handled per the features available within the Verity software installed on that workstation. • User Management: This software enables authorized users to create and manage user accounts within the Verity system. • Verity Desktop: Allows authorized users to manage a very limited set of operating system functions. Verity Desktop is workstation management software used for: o Setting the system date and time, o Exporting Verity application file hashes to removable USB media, o Accessing the operating system for a limited time. User access to the operating system’s functionality is restricted to software updates and database management, and o Importing printer configuration files. 2. Verity Print Verity Print is a pre-voting ballot production machine for use by election officials and/or poll workers. Verity Print produces unmarked paper ballots. Verity Print is paired with a commercial off-the-shelf Oki B432 printer to allow the user to select and print the desired ballot style based on the precinct and voter registration information. The Verity Print machine is activated so the election official can print one or more blank ballots from one selected precinct at a time. Ballots can be printed on-demand for immediate use, or they can be printed in advance for additional inventory. 3. Verity TouchWriter Verity TouchWriter is a touch-screen Ballot Marking Device (BMD) that prints voter- marked ballots to a commercial off-the-shelf Oki B432 printer. Voters use the electronic touch display interface to privately and independently make their selections on the ballot. Voters can also make selections with Verity Access, an Audio-Tactile interface (ATI) component with three tactile buttons, one audio port (for headphones), and one port for external two-switch machines. When voters finish making their selections, they print the marked ballot. 4. Verity Reader 7 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM Verity Reader is an optional paper ballot review machine suitable for use by all voters, including non-disabled voters and voters with disabilities. Voters insert their marked paper ballot to visually verify how their ballot will be counted when the ballot is cast in the Verity system, and/or hear audio read-back of their ballot choices. For voters with disabilities, Reader offers the same accessibility features as the TouchWriter ballot marking machine. 5. Verity Scan Verity Scan is Verity’s polling place digital scanning/tabulation solution for paper ballots. Scan is paired with a purpose-built ballot box to ensure accurate, secure, and private ballot scanning and vote casting. When opening the polls, authorized users activate the Verity Scan machine to prepare it to receive marked paper ballots. Scan indicates when it is appropriate to insert ballots, and when ballots have been successfully cast. Verity Scan records Cast Vote Records (CVR) and audit log data in redundant, secure storage locations, including the Verity vDrive. The vDrive storage is portable flash memory and allows the CVRs to be transferred to the Verity Count tabulation and reporting system. 6. Verity Access Verity Access is an interface module that is connected to Verity TouchWriter and Verity Reader. The module has three tactile buttons, one audio port, and one port for external tactile buttons or sip-n-puff devices. Jacks for headphones and adaptive devices are located on the top edge of the machine, and the machine has grip surfaces on either side. 7. Verity AutoBallot Verity AutoBallot is an optional barcode scanner kit for Verity Print and Verity TouchWriter that allows air-gapped integration between an electronic pollbook check-in process and the task of selecting the proper ballot style for the voting system. Particularly when Verity Print or Verity TouchWriter is configured with dozens or hundreds of ballot styles in Vote Centers, Verity AutoBallot simplifies and automates the ballot style selection process by allowing poll workers to scan a barcode output from an electronic poll book and activate the correct ballot style with the click of a button, thereby reducing human error. Once the ballot style has been input with the barcode scanner, the poll worker confirms the ballot style on the Verity machine display and prints an unmarked ballot (Verity Print) or activates an accessible electronic voting session (Verity TouchWriter). 8. Verity vDrive 8 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM Verity vDrive is a custom USB drive specific to Verity. The vDrives are required by the Verity Voting system and are used as a portable election media device for transferring ballots (as Cast Vote Records) across the air gap between components. The vDrives also provide signed election definitions to transfer election setup data from Verity Data/Build to Verity Scan, Verity TouchWriter, Verity Reader, and Verity Print. The vDrives are created in Build for a specific election. The media can be written over through Build for subsequent usage in a new or current election. When saved with election data, it can only be used in that specific election until reformatted and created with data for a new election. The vDrives are made to be auditable, but not editable. If a bad actor were to find one and make a change to a file on the drive, the signature validation would fail, and they would no longer work within the Verity system. The content is validated using the Verity Key. The Key device partners with the vDrive to provide two factor authentication. Both vDrive and Key are created through Verity Build for a specific election. The Key and vDrive must always match the same election. 9. Verity Key Verity Key is electronic media that is created by Verity Build for a specific election. Key is a required Verity component. Key is the electronic media that provides user authentication and configures election security throughout the Verity voting system. 9 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM Hart Verity Voting 3.2 Block Diagram 10 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM Hart Verity Voting 3.2 Tested Configurations Data/Build Standalone Data/Build Server Data/Build Client IntoPrint SP1360 or Brother HL6400 Central Client Central Server Central Standalone Canon Scanner Canon Scanners DR-G2140 DR-G1130 DR-G2110 Count Standalone Count Server Count Client Verity Verity Print Oki B432 TouchWriter Brother HL6400 III. TESTING INFORMATION AND RESULTS 1. Background California certification testing of the Verity Voting system began on April 15, 2023. The testing began with the Source Code Review, followed by Functional Testing, and finally Volume and Accessibility while the Security/Telecommunications Review was accomplished at SLI in parallel with the SOS testing. 11 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM 2. Functional Test Data The Functional Test of the Hart Verity Voting 3.2 system was conducted by SLI and the Office of Voting Systems Technology Assessment staff at the Secretary of State’s Office located at 1500 11th Street, Sacramento, California from May 1, 2023, through May 16, 2023. The Functional Testing began by compiling the trusted build of the application installers from source code. Next, the complete systems were installed. The computer workstation components of the EMS consisted of seven Hewlett Packard Z4G4 computers, and one Hewlett Packard Z240 computer: Central Server, Central Client, Data Build Standalone, Count Standalone, Count Server, Count Client, Data Build Server, and Data Build Client. The tablet machines tested (Scan, Print, Reader, and TouchWriter) are all tablet computers running in custom cases designed for polling place applications. The system is modularized so that all the polling place machines are running one of two versions of the same hardware. Following the TDP procedures, Functional Testing started by building the operating system. All computers run the Windows 10 LTSC operating system. This version of Windows is a scaled down operating system without any unneeded applications or utilities included. Two versions of the operating system were built, a 32-bit version for the tablets that Scan, Print, TouchWriter, and Reader are built on, and a 64-bit version for Data/Build, Count, and Central. Following the California Use Procedures, the testing continued with the installation of the operating system, commercial-off-the-shelf software, voting system software, and then continued through the security hardening process. Next, the workstations and servers were encrypted utilizing BitLocker. HASH values were generated at the conclusion of the installation. These HASH values use a mathematical algorithm to create a digital fingerprint that can be used to validate that the voting system software programs running on a jurisdiction’s voting system are unmodified and identical to the programs that were tested and approved. Upon completion of the installation of the system, it was run through an acceptance and readiness test to determine that each piece of equipment was functioning properly and that all networking and permissions were configured correctly. Functional Testing of the system included six election types: a Presidential Primary in English and Spanish; a Presidential General in English, Korean, Chinese, and Vietnamese; a Special Recall in English, Khmer, Japanese, and Hindi; a Gubernatorial Primary Election in English and Spanish; a Gubernatorial General election in English and Spanish; and a Special Local election created from scratch in English. Test ballots were evaluated for the following criteria: • All test elections except the Test Recall verified that the ballots were Ballot DISCLOSE Act compliant. A 22” four card Verity 3.2 ballot will fit approximately eighteen Ballot DISCLOSE Act compliant propositions. 12 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM • Per California Elections Code (EC) section 13002, ballots should be printed with a watermark and tint from the approved list for California. • Pursuant to the requirements of California Elections Code section 13203, ballots should be clearly labeled as TEST BALLOTS instead of OFFICIAL BALLOT. • Ballots should contain Instructions to voters per California Elections Code sections 13204 and 13205 but may also include instructions at the bottom of the ballot per section 13231. • Candidates should be listed per California Elections Code section 13103. • Candidate’s political party should be listed per California Elections Code section 13105. • Per California Elections Code section 13107, each candidate is to have an occupation listed under the candidate's name. For economy of testing, the following 'occupation' was used for all candidates: Occupation Prints Here - la ocupacion demuestra aqui. The mock elections were conducted as if the system had just been purchased by a county. The vote center/precinct machines were setup for either early voting or Election Day voting. Per California Code of Regulations section 20263, ballots were produced on demand and as needed with Data/Build using an IntoPrint SP1360 or Brother HL6400 printer. Verity Print and the Oki B432 printer would be used for ballots on demand at a polling place or vote center, however the Print device was tested in separate testing for Ballot on Demand certification. Data/Build printing to the IntoPrint SP1360 or Brother HL6400 would be for a central office to print batch ballots on demand. The Verity TouchWriter ballot marking device was utilized for accessible voting sessions, and the Verity Reader machines were used to validate the ballots marked on the Verity TouchWriters. Accessible sessions were initiated on Verity TouchWriter. Ballots were scanned on Verity Scan or Central machines. Polls were opened, and repeatedly suspended and re-enabled on the Scan machines setup for early voting. At the close of polls, the vDrives from the Scan machines were used to transfer the voting results onto Central and then were brought into Count to tabulate and generate all reports. The system can be configured to out-stack or flag ballots with a number of exception conditions like a write-in, under-votes, over-votes or marginal marks. These ballots are adjudicated using the resolve screen on the Central or Count machines. The resolve screen will allow an adjudication board of election officials to provide a hand to eye examination of the out-stacked ballots to determine correct voter intent. After all ballots were tabulated, the Cumulative Report was printed, and all other reports were generated. Additionally, the Secretary of State Statement of Vote (SOV) and Supplemental Statement of Votes (SSOV) reports were generated. Cast Vote Record reports and ballot images were exported. Comma separated text files can be generated 13 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM by Verity 3.2 for California election night reporting (ENR). The CA ENR template was imported to Verity 3.2 and the data points were mapped between the template and the election. Note that the above description was followed for all test elections, however, each election was also used to test specific items, such as ballot layout rules and laws, battery backup capacity, scanner read-head tests to determine the consistency and accuracy of different types of marks using different marking machines simulating actual voters who vote by mail, language tests to determine if the system can populate all fonts used in California correctly and accurately, as well as the capability of the system to operate in a vote center environment that may constitute many more voters both for early voting and on election day. Special Recall Election: The Special Recall Election was tested in English, Khmer, Japanese, and Hindi. Ballots were pre-printed with a bi-lingual ballot in English and Khmer. The system will not utilize a tri-lingual ballot. The election consisted of one precinct and one contest. The contest included a maximum of 48 candidates with one write-in in a gubernatorial contest. The election was printed on 22-inch ballots, which are the longest ballot size possible for the system. The standalone configurations for Data/Build and Count were used in this election. The ballots were machine pre-printed in all four languages. The recall election was used to simulate a smaller jurisdiction, utilizing the standalone configurations of the system. The Data/Build standalone machines were used to generate the vDrives with election information to distribute the election to Scan, Print, TouchWriter, and Reader. The Scan machine was setup for Election Day voting. Central Client/Server was used to consolidate, and Count Standalone was used to generate reports. Two ballots in each language were pulled from the pre-printed ballots and remade on TouchWriter. TouchWriter printed the ballots on blank ballot paper. The ballots were then verified on Reader and scanned on Scan. The accessible options were verified on TouchWriter. The remaining ballots were scanned on the Standalone Central. Ballots were fed in every orientation. A vDrive was tested by attempting to copy a file to it from the Standalone Central machine and the system would not utilize the vDrive for non-election functions. A vDrive must have the current election installed on it, as well as a matching Verity Key to be used by the system. The Verity system will reject any ordinary USB drive. The polls were closed, and the results were exported to Central. All reports were generated and saved. Ballot images were exported and saved. All counts matched the expected results, and the system operated as expected. Presidential General Election: The Presidential General Election was tested in English, Korean, Chinese, and Vietnamese. All devices and interfaces were programmed to support the entire election in all four languages. The election included 10 precincts, 13 contests, and 5 propositions, with one or two write-ins depending on 14 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM the contest. The candidates were rotated per California Elections Code section 13111. Order of offices on the ballot was per California Elections Code section 13109. Per California Elections Code section 13105, each partisan candidate had the party affiliation listed to the right of their name. This election was printed on 11-inch ballot stock, which is the smallest ballot size possible and included multiple cards. The startup, and maintenance procedures for the polling place machines were evaluated to make sure the procedures were correct. The test deck was pre-printed and pre-marked. Two Scan machines were configured for Election Day and to accept under-votes and reject over-votes which allowed for voter review. When a ballot is rejected for review, the voter can choose to both remove the ballot and edit it, or to cast the ballot as-is. Ballot rejection for voter review on the Scan machines is election wide and cannot be set by precinct. It was noted at this time that multiple card ballots increment the sheet counter on Scan for each additional card, but the ballot counter remains at one, and the lifetime counter remains at one also. The double-sided ballots incremented the ballot and sheet counters, and the single sided ballots only incremented the ballot counter. Ballots were separated by card A and card B. All card A’s were scanned and then all card B’s. The system tabulated correctly with the correct results. Ballots were aggregated to Count Standalone, and write-ins were adjudicated using Count Standalone. The first tabulation resulted in a difference of one vote for Measure A and one vote in Proposition 30. A full hand count of the ballots was done. The hand count matched the tabulation indicating a human error in the expected results spreadsheet which was incorrect. The system operated as expected. Presidential Primary Election: Presidential Primary in English and Spanish, including one bi-lingual ballot style consisting of English and Spanish. The election included 2 precincts. It included 4 contests and 15 choices. All devices and interfaces were programmed to support the entire election in English and Spanish. Test deck ballots were printed on demand on the Data/Build machine and the IntoPrint SP1360 on 14-inch ballot stock, which is the medium size possible for the system and double sided. The vDrives were generated to transfer the election definition to one TouchWriter machine, and two Scan machines. One Scan machine was configured for early voting, and one Scan machine was configured for precinct/Election Day voting. Once the precinct scanners are setup, they will not accept anything that is not signed for this election. Twenty ballots were scanned through each Scan machine, and the rest of the test deck was scanned in equal numbers through each Central scanner. Ballots in English and Spanish were scanned on both the early and Election Day Scan machine without 15 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM problem. Ballots were fed in all four orientations. The landing lights, in conjunction with the audible tone, make it very apparent that the ballot has been read, and the machine is ready for another ballot. The Scan machines processed the 14-inch ballots at a steady rate of six to eight per minute. The instructions were clear to understand, and the write-in functionality was used with no difficulty. Voting for a write-in did not require cycling through the entire alphabet but allowed for easy back and forth using the on- screen keyboard. The Scan machine setup for early voting was repeatedly suspended, powered off and back on again, and re-enabled without problem. The results were transferred to the Count machine using the vDrive. Polls were closed, and results aggregated to Count. The counts matched the expected results, and the system operated as expected. Gubernatorial Primary: Gubernatorial Primary including single language ballots in both English and Spanish and one bi-lingual ballot style consisting of English and Spanish. The election included ten precincts. It included 5 contests and 27 choices. All devices and interfaces were programmed to support the entire election in English and Spanish. To simulate a smaller jurisdiction, the Data/Build Standalone setup was used to print test deck ballots on demand on the IntoPrint SP1360 on 14-inch ballot stock, which is the medium size possible for the system and double sided. The vDrives were generated to transfer the election definition to one TouchWriter machine, and two Scan machines. One Scan machine was configured for early voting, and one Scan machine was configured for precinct/Election Day voting. Once precinct devices are setup, they will not accept any vDrive that is not configured for this election. Ten ballots from each party were pulled from the deck and duplicated on TouchWriter and replaced in the deck. The originals were spoiled. TouchWriter was evaluated for a fleeing voter, and a voter who took longer than normal to vote. The voter who fled was corrected by the poll worker who spoiled the session and restarted another session. The longer than normal voter was able to finish voting as expected. It was verified that cast vote records and ballot images can be exported from the system prior to accomplishing a risk limiting audit. Each ballot consists of two .PNG images and are named <HASH>_front and <HASH>_back. The images from 14-inch ballots can be expected to take approximately 275 megabytes per 1000 ballots, or 26 gigabytes per 100,000 ballots. Polls were closed, and all votes aggregated to Count. All counts matched expected results, and the system operated as expected. All reports and logs were generated and saved as artifacts. 16 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM Gubernatorial General: Gubernatorial General in English and Spanish, including one bi-lingual ballot style consisting of English and Spanish. The election included ten precincts. It included 5 contests and 27 choices. All devices and interfaces were programmed to support the entire election in English and Spanish. To simulate a larger jurisdiction, the Data/Build Server/Client setup was used to print test deck ballots on demand on the IntoPrint SP1360 on 17-inch ballot stock, which is the medium size possible for the system and double sided. The Hart Data/Build Server Client setup was used to generate the vDrives to transfer the election definition to two Scan machines. One Scan machine was configured for early voting, and one Scan machine was configured for precinct/Election Day voting. Once the precinct scanners are setup, they will not accept anything that is not signed for this election. On or after Election Day, the option to suspend polls disappears and you can only close the polls. Once voting has been suspended on Scan, the machine has to be powered off and back on, and then polls opened again. Twenty ballots were scanned through each Scan machine, and the rest of the test deck was scanned using the Server/Client Central scanner. Ballots in English and Spanish were scanned on both the early and Election Day Scan machine without problem. Ballots were fed in all four orientations. Two ballots and then three ballots together were fed into the Scan machines, and the Scan machine correctly rejected the ballots. To simulate a polling place power loss, the Scan machine was unplugged and ran on battery power for 30 minutes while scanning 10 ballots without problem. The Scan machine displayed a clear message that the “Device does not have wall power”. The new 38BT tablets utilized by polling place devices trickle charge the battery. While the machine is plugged into a wall outlet, the battery stays charged. The battery can also be removed from the machine and charged using a battery charger. Polls were closed, and all votes aggregated to Count. All counts matched expected results, and the system operated as expected. All reports and logs were generated and saved as artifacts. Special Local: A Special Local election in English. To simulate a smaller jurisdiction, the Data/Build Standalone setup was used to create the election from scratch and then print the test deck ballots on demand on the Oki B432 on 11-inch ballot stock, which is the smallest size possible for the system. The election included 2 precincts. It included 1 contest and 6 choices, and 1 proposition. All devices and interfaces were programmed to support the entire election in English. Ballots were hand marked and hand counted to build an expected results spreadsheet. Ballots were scanned on the Standalone Central machine in all four orientations. The results were aggregated to Count and then tabulated. 17 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM Polls were closed, and all votes aggregated to Count. All counts matched expected results, and the system operated as expected. All reports and logs were generated and saved as artifacts. Ranked Choice Tabulator Module Hart submitted a ranked choice voting tabulator module (RCTab). The RCTab module is a stand-alone tabulator for RCV elections. Verity 3.2 would export the results which would be imported into the RCTab module and tabulated. Hart subsequently withdrew this module from testing. Hart Verity 3.2 Print Ballot On Demand Testing During the testing of the Hart Verity 3.2 voting system testing, two of the Hart Verity 3.2 Print systems were tested to the California Ballot On Demand Systems Standards per Title 2., Division 7., Chapter 4., Article 7. of the California Code of Regulations. The two Hart Verity 3.2 Print systems were tested with an Oki B432 printer and Brother HL-L6400DW printer. The Hart Verity 3.2 voting system had two additional printers that were brought into the lab for testing; an OKI C831 and IntoPrint SPI360, but these printers are utilized from the county workstation/voting system, not the ballot on demand component. During testing, the following ballot sizes and styles were printed on the Hart Verity 3.2 Print system with the Oki B432 and Brother HL-L6400DW printers. • Verity 8.5” x 11” ballots on the Brother HL printer: used the Presidential General Election (100 ballots) • Verity 8.5” x 14” ballots on the OKI B432 printer: used the Presidential Primary Election (100 ballots) • Verity 8.5” x 17” ballots on the Brother HL printer: used the Gubernatorial General Election (50 ballots) o Tested the Verity Printer Scanner feature for both precincts loaded on the election/system • Verity 8.5” x 17” ballots on the OKI C831 printer: used the Gubernatorial General Election (10 ballots) • Verity 8.5” x 20” ballots on the OKI B432 printer: used the Gubernatorial General Election (25 ballots) • Verity 8.5” x 22” ballots on the Brother HL printer: used the RCV Election (25 ballots) Additionally, during testing, the OKI C831 was used with the 3.2 Data/Build Standalone Station to print Verity 11” x 17” ballots from the Gubernatorial General Election (25 ballots). The voting system lead and consultants used the IntoPrint with the 3.2 Data/Build Standalone workstation to print ballots for the voting system test. 18 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM Note that both the OKI B432 and Brother printers can print ballots ranging from 11”-20”. The OKI C831 printer can only print up to 17” ballots. No issues or errors occurred during the testing of the Hart Verity 3.2 Print ballot on demand system. 4. Volume Test The Secretary of State conducts a Volume Test on all voting machines under test with which the voters will directly interact. The Volume Test took place in Yolo County on June 6 and 7. The Volume Test used the General Election as the basis for the election definition files. The Verity Scan precinct tabulators and the Verity TouchWriter ballot marking machines presented for the Verity Voting 3.2 test are components that have been previously tested in California. The Volume Test consisted of 26 Scan/Reader machines and 10 TouchWriter machines. Trusted build HASHes were used to validate every machine. HASHes were taken from every machine and compared to the trusted build HASHes to validate every machine using BeyondCompare, a third-party text comparison program. All HASHes matched. The Secretary of State used a total of 20 voters, ranging in age, skill, and voting experience, to vote ballots on the machines. All machines were labeled in numerical order of #1 through #36. TouchWriter and Reader machines were labeled in numerical order of #1 through #16 for proper identification. Hart provided 20 test decks, each with 400 ballots for testing. The Scan machines were repeatedly fed test decks throughout the two days and a total of 2000 ballots were scanned by each machine (forty thousand total) to simulate the voters a precinct or vote center would have on Election Day. As the test was being conducted, all incidents were documented. At the start of testing Verity Reader Device #15 (R2155027805) would report an error that “One or more landmarks could not be located.” Restarting the Verity Reader device allowed the scanning of two more ballots before the same issue was reported. Reloading the election definition did not correct the issue. Verity Reader Device #15 was removed from testing. TouchWriter #7 and it’s printer were unplugged from wall power and used solely on battery power beginning at 9:40am. Twenty-seven ballots were voted on the machine. At 1:15pm it still had full power left in the battery. During the Volume Test the machines threw five different warnings: Table 1: Volume Test Warnings Warning Number of Number of devices Mitigation occurrences 19 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM Verity Reader 1 1 Device was Device #15 removed from test. (R2155027805) See above. One or more 21 7 Removed ballot barcodes cannot be and reinserted found The ballot may be 3 3 Removed ballot the wrong length and reinserted Your choices may 2 2 Removed ballot not be properly and reinserted marked Ballot Jammed 1 1 Removed ballot and reinserted After Reader #15 was removed, all four warnings were mitigated in every case by pulling the ballot from the machine and re-inserting it. This was attributed to be the result of inserting the ballot too quickly, or not inserting the ballot straight into the machine. Most of the warnings were experienced the first time the voters fed a test deck through the machine. By the fifth time feeding a deck through, there were almost no warnings. The voters had gotten better at how fast they could feed ballots. The TouchWriter ballot marking machines were tested next. One thousand and ninety- nine ballots were marked and created on TouchWriter machines. Table 2: Number of Ballots Marked Touchwriter #1 109 Touchwriter #2 114 Touchwriter #3 111 Touchwriter #4 109 Touchwriter #5 106 Touchwriter #6 110 Touchwriter #7 114 Touchwriter #8 105 Touchwriter #9 108 Touchwriter #10 113 Eight hundred ballots were verified on each Reader. No incidents were reported on the TouchWriter or Reader machines. Of the one thousand and ninety-nine ballots generated on the TouchWriter machines, there were no ballot marks outside of the bubble, and all marks were as expected. Of the four thousand ballots verified on the Reader machines, there were no problems experienced and the machines worked as expected. The landing lights stopped working on Scan #17. Scan #17 still beeped when it was ready for another ballot and the machine worked fine but the lights stopped. These 20 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM lights are on a dedicated connection, and it was surmised by the Hart tech that the connection had come loose in shipping. During testing TouchWriter #3 and TouchWriter #1 ran out of toner. The toner was replaced. This COTS toner was easily replaced. The Volume Test for the Scan precinct tabulator and the ballot marking functionality of the TouchWriter, and the verification functionality of the Reader devices were deemed successful. 5. Accessibility Test The Accessibility Test used the Presidential General Election as the basis for the election definition files. Accessibility Testing took place at the Sacramento Secretary of State’s testing lab on May 17th and 18th, 2023. The Secretary of State partnered with volunteers from the voters with disabilities communities to complete the heuristic evaluation of the accessibility features of the TouchWriter and Reader components, as well as to provide findings in this report. The Accessibility Test consisted of a TouchWriter, Reader, and Scan components. The machines were setup in voting stations, giving enough space in between to allow privacy. The voting station contained one TouchWriter component, one Reader component, one table, two chairs and a laptop or clipboard for note taking by Secretary of State staff. The voters all used a common Scan component to simulate casting their ballot. Voters who were voting an Accessible Voting Session (AVS) had the ability to use any of the following components: the Audio Tactile Interface (ATI), lap pad, adaptive/paddle switches, headphones, or sip and puff device. The TouchWriter component has the capability to support voters with the following disabilities: • Cognitive - ballot display via paper and large LCD screen; • Perceptual and Partial Vision - ability to change screen color scheme, contrast, and font size; • Low or No Vision - audio, tactile interface; • Dexterity - integrated ballot marking machine that does not require the voter to manipulate the ballot, low force buttons for voter interface; • Mobility –California Voting System Standards required reaches and wheelchair access, TouchWriter product requires voter to mark the ballot on the TouchWriter component, then go from the ballot marker to the Reader to verify, and then to the Scan component to cast their vote; • Hearing - audio interface, same as for low/no vision; and • Speech - no speech is required to operate the voting system. The Secretary of State tested the voting system for usability and accessibility with six volunteer voters from the general population with the various disabilities mentioned 21 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM above. These volunteer voters were asked to vote at least one ballot on the TouchWriter component. The Secretary of State also had the assistance of one SLI staff members who documented the test process and experience for each volunteer voter The voters were trained on the system and how to use the accessible features. The Secretary of State conducted an exit survey with the voters who participated in the Accessibility Test regarding their voting experience utilizing the TouchWriter and Reader machines. Participants had the following comments: Volunteer 1: The scroll wheel was hard to use due to their limited mobility preventing them from making complete turns with the wheel and that the response on screen to the scroll wheel was too fast. They felt from previous experiences that the jelly-switches were more difficult to use this time around. Being able to move the screen closer would be helpful for those with limited reach. Additionally, being able to vote outside from a car would be helpful. Volunteer 2: The system was simple to use; however, they did not like using the scroll wheel to get to the “next” button (as in next contest); they would like it if it would automatically go to the “next” button rather than having to scroll to it. Volunteer 3: The instructions did not give all the information they should have and that it should be clearer that a counterclockwise scroll is used to get out of the menu. The normal speech speed was too slow, but the fast speed was too fast, there should be increments between the speech speeds. They found the help button and read out needed more information and additional helpful information. In addition, volunteer 3 related the following: • The move wheel scrolling in a circular fashion was confusing and they would prefer a mouse scroll wheel. • There should be an independent physical “next” button to move to the next contest rather than using the wheel to select the on-screen next button, along with an independent “back” button to go back to previous contests. • A mechanical (refreshable) braille display for reading the contests. • Devices should have more information about propositions at the vote centers. • The ability to focus on bits of a paragraph, such as repeating a sentence, pausing, or rewinding to help break up information for easier understanding. • The Verity Scan did not contain an audible indicator that the ballot was accepted or rejected, though this may have just been disabled during testing. • There should be more high contrasts options, such as black background with yellow contrast. 22 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM Volunteer 4: The Verity Reader usage was confusing and unnecessary and that all devices need padding for resting one’s arm when using the device. The volunteer did like the low range of pitch of the speech and how easy it was to understand. They also felt the scroll wheel made write-ins a much easier process. Volunteer 5: They would like the speech speed to be an incremental increase/decrease rather than slow, normal, and fast. They liked how comfortable the headphones were and liked using the scroll wheel. Volunteer 6: They really liked using this system and felt that it was great to use. They would like to have a phonetic alphabet for clearer understanding of the letters used, for example selecting V and having it say victor to help distinguish it from B. They liked using the scroll wheel. The combined results were as follows: Table 3: Accessible Survey Verity Voting 3.2 Post Test Survey Agree Agree Disagree Disagree N/A or No Strongly Somewhat Somewhat Strongly Opinion The voting method was 6 private. I feel I can use this system to vote 3 3 independently. I am confident that my vote was recorded 6 accurately. The voting instructions were clear and 3 2 1 complete. The voting method was 1 2 3 easy to use. I could read the display 1 5 easily. I could understand the 5 1 speech output. The assistive device(s) were easy to reach and 4 1 1 use. I found the system 2 2 2 confusing to use. The timeframe it took to vote was what I 3 3 expected. 23 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM From a privacy point of view, all volunteers seemed to feel that their privacy was kept intact, and none expressed any issue or concern. 6. Security & Telecommunications Review The Security & Telecommunications Review took place at SLI between May 1, 2023, and May 26, 2023. During the Open-Ended Vulnerability Testing (OEVT) portion of the testing it was noted that proper secure utilization of the voting system solution is reliant upon properly trained personnel, as well as following all processes and procedures set forth by the voting vendor to ensure properly configured and secured equipment for use in a live election environment. SLI reported the following findings for the TDP sections: Table 4: TDP Findings CVSS Requirement Finding Mitigation Risk 2.1.1 - Security Results: Review of the Technical Data Package N/A None (TDP) validated that the requirement was satisfactorily covered. 6.2 - Design, Results: Review of the Technical Data Package N/A None Construction, and (TDP) validated that the requirement was Maintenance satisfactorily covered. Requirements 7.2.2 - Access Control Results: Review of the Technical Data Package N/A None Identification (TDP) validated that the requirement was satisfactorily covered. 7.3.1 - Polling Place Results: Review of the Technical Data Package N/A None Security (TDP) validated that the requirement was satisfactorily covered. 7.3.2 - Central Count Results: Review of the Technical Data Package N/A None Location Security (TDP) validated that the requirement was satisfactorily covered. 7.4.1 - Software and Results: Review of the Technical Data Package N/A None Firmware Installation (TDP) validated that the requirement was satisfactorily covered. 7.4.2 - Protection Results: Review of the Technical Data Package N/A None against Malicious (TDP) validated that the requirement was Software satisfactorily covered. 7.4.3 - Software Results: Review of the Technical Data Package N/A None Distribution and Setup (TDP) validated that the requirement was Validation satisfactorily covered. 24 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM 7.4.4 - Software Results: Review of the Technical Data Package N/A None Distribution (TDP) validated that the requirement was satisfactorily covered. 7.4.5 - Software Results: Review of the Technical Data Package N/A None Reference Information (TDP) validated that the requirement was satisfactorily covered. 7.4.6 - Software Setup Results: Review of the Technical Data Package N/A None Validation (TDP) validated that the requirement was satisfactorily covered. 7.8.1 - Access Control Results: Review of the Technical Data Package N/A None (TDP) validated that the requirement was satisfactorily covered. SLI reported the following findings for the Functional Security sections: Table 5: Functional Security Findings Vulnerability Description Mitigation Risk 2.1.1 - Security Results: Testing validated that N/A None the requirement was satisfactorily covered 5.4.3 - In- Testing showed that the Verity Physical security controls, Low process Audit Polling place devices do not such as locks and tamper Records provide electronic monitoring of evident seals are used for physical security, except this. indicating that the tablet is unlocked and removed from the case. 7.2.1 - General Results: Review of the This is a low severity risk Low Access Control requirement validated that the due to the mitigating security requirement was satisfactorily controls concerning the covered. desktop environment, namely Hart’s restriction of During the system examination, it desktop access code was observed that the Verity provision to a per-request workstation desktop environment nature facilitated by Hart user account was missing a user personnel. account security control. 7.2.2 - Access Results: Testing validated that N/A None Control the requirement was satisfactorily Identification covered 7.2.3 - Access Results: Review of the This is a low severity risk Low Control requirement validated that the due to the mitigating security Authentication controls concerning the desktop environment, 25 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM requirement was satisfactorily namely Hart’s restriction of covered. desktop access code provision to a per-request Testing results identified a nature facilitated by Hart missing user account security personnel. control on the Verity workstation desktop environment. 7.2.4 - Access Results: Testing validated that N/A None Control the requirement was satisfactorily Authorization covered 7.3 - Physical Results: Testing validated that It is recommended that the Low Security the requirement was satisfactorily jurisdictions have a Measures covered. procedure in place to efficiently manage and Security seals, locks, and monitor security seals and security screws can be locking devices. The severity circumvented. of this finding is low due to the required time and tools to circumvent physical security. The issue is addressed within the Use Procedures documentation, in polling place planning/polling place layout. 7.3.1 - Polling Results: Review of the This is a low severity risk Low Place Security requirement validated that the due to the mitigating security requirement was satisfactorily controls concerning the covered. desktop environment, namely Hart’s restriction of The ballot printer’s administrative desktop access code menu has default credentials; this provision to a per-request is considered a potential low nature facilitated by Hart severity vulnerability. personnel. 7.3.2 - Central Results: Testing validated that N/A None Count Location the requirement was satisfactorily Security covered 7.4.1 - Software Results: Testing validated that N/A None and Firmware the requirement was satisfactorily Installation covered. 7.4.2 - Results: Testing validated that N/A None Protection the requirement was satisfactorily against covered Malicious Software 26 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM 7.4.3 - Software Results: Testing validated that N/A None Distribution and the requirement was satisfactorily Setup covered Validation 7.4.4 - Software Results: Testing determined that N/A None Distribution and the requirement was satisfactorily Setup covered. Validation 7.4.5 - Software Results: Testing validated that N/A None Reference the requirement was satisfactorily Information covered 7.4.6 - Software Results: Testing validated that N/A None Setup the requirement was satisfactorily Validation covered 7.6.1 - Results: Testing validated that N/A None Maintaining the requirement was satisfactorily Data Integrity covered 7.6.2 - Election Results: Testing validated that N/A None Returns the requirement was satisfactorily covered 7.8.1 - Access Results: Testing validated that N/A None Control the requirement was satisfactorily covered 7.8.2 - Data Results: Testing validated that N/A None Interception the requirement was satisfactorily and Disruption covered SLI reported the findings for the following Telecommunications and Data Transmission sections: Table 6: Telecommunications and Data Transmission Findings Vulnerability Findings Mitigation Risk 6.1.2 - Data Results: Testing demonstrated that the N/A None Transmission requirement was satisfactorily covered in the tested configuration. 6.2.1 - Results: Testing validated that the requirement N/A None Confirmation was satisfactorily covered. SLI reported the findings for the following Open Ended Vulnerability Testing (OEVT) section: 27 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM Results: Review of the OEVT testing context requirements confirmed that the test effort tested all appropriate voting system devices and applications and effectively evaluated threats to the voting system in simulated production environments. Table 7: The OEVT findings Vulnerability Findings Mitigation Risk 7.5.1 - OEVT Results: Review of the OEVT scope N/A None Scope and and priorities requirements confirmed Priorities that the test effort was appropriately designed and performed to effectively test the security of voting system components. 7.5.2 - OEVT Results: Review of the OEVT N/A None Resources and resources and level of effort Level of Effort requirements confirmed that the test team was appropriately equipped to evaluate the Hart InterCivic Verity Voting 3.2 voting system’s security. 7.5.3 - Context Results: Review of the OEVT testing N/A None of OEVT context requirements confirmed that Testing the test effort tested all appropriate voting system devices and applications and effectively evaluated threats to the voting system in simulated production environments. 7.5.5 - OEVT Results: Review of the Performed N/A None Reporting functional security and OEVT testing Requirements confirmed sufficient adherence to OEVT reporting requirements. 7. Software Review SLI conducted the Software Review between April 1 and April 10, 2023. The review was conducted by SLI. SLI evaluated the security and integrity of the voting system by identifying any security vulnerabilities that could be exploited to: • Alter vote recording, • Alter vote results, • Alter critical data (such as audit logs), or • Conduct a “denial of service” attack on the voting system. No source code requirements were found to be an issue within the Verity 3.2 source code base reviewed; as a result, no discrepancies were written against the code base. 28 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM No vulnerabilities were found to be an issue within the Verity 3.2 source code base reviewed; as a result, no findings were written against the code base. IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS A. Elections Code Requirements Six sections of the California Elections Code, Sections 19101, 19203, 19204, 19204.5, 19205, and 19270, describe in detail the requirements any voting system must meet in order to be approved for use in California elections. These sections are described in detail and analyzed for compliance below. 1) §19101 (b) (1): The machine or device and its software shall be suitable for the purpose for which it is intended. The system meets this requirement. 2) §19101 (b) (2): The system shall preserve the secrecy of the ballot. The system meets this requirement. 3) §19101 (b) (3): The system shall be safe from fraud or manipulation. The system meets this requirement. 4) §19101 (b) (4): The system shall be accessible to voters with disabilities pursuant to section 19242 and applicable federal laws. The system meets this requirement. 5) §19101 (b) (5): The system shall be accessible to voters who require assistance in a language other than English if the language is one in which a ballot or ballot materials are required to be made available to voters pursuant to Section 14201 and applicable federal laws. The system meets this requirement. 6) §19203: The system shall use ballot paper that is of sufficient quality that it maintains its integrity and readability throughout the retention period specified in sections 1700 through 17306. The system meets this requirement. 29 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM 7) §19204: The system shall not include procedures that allow a voter to produce, and leave the polling place with, a copy or facsimile of the ballot cast by that voter at that polling place. The system meets this requirement. 8) §19205 (a): No part of the voting system shall be connected to the internet at any time. The system meets this requirement. 9) §19205 (b): No part of the voting system shall electronically receive or transmit election data through an exterior communication network, including the public telephone system, if the communication originates from or terminates at a polling place, satellite location, or counting center. The system meets this requirement. 10) §19205 (c): No part of the voting system shall receive or transmit wireless communications or wireless data transfers. The system meets this requirement. 11) §19270 (a): The Secretary of State shall not certify or conditionally approve a direct recording electronic voting system unless the system includes an accessible voter verified paper audit trail. The system meets this requirement. B. Elections Code Review 1) §303: “Ballot label” means that portion of the ballot containing the names of the candidates or a statement of a measure. For statewide measures, the ballot label shall contain a condensed version of the ballot title and summary, including the fiscal impact summary prepared pursuant to Section 9087 of this code and Section 88003 of the Government Code, that is no more than 75 words, followed by a listing of the names of supporters and opponents in the ballot arguments printed in the state voter information guide as described in Section 9051. The system meets this requirement. 2) §305.5(b): A paper cast vote record is a ballot only if the paper cast vote record is generated on a voting device or machine that complies with ballot layout 30 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM requirements and is tabulated by a separate device from the device that created the paper cast vote record. The system meets this requirement. 3) §9050(a): After the Secretary of State determines that a measure will appear on the ballot at the next statewide election, the Secretary of State shall promptly transmit a copy of the measure to the Attorney General. The Attorney General shall provide and return to the Secretary of State a ballot title and summary and the condensed ballot title and summary prepared pursuant to Section 303 for each measure submitted to the voters of the whole state by a date sufficient to meet the state voter information guide public display deadlines. The system meets this requirement. 4) §9051(a)(2): The ballot title and summary shall include a summary of the Legislative Analyst’s estimate of the net state and local government fiscal impact prepared pursuant to Section 9087 of this code and Section 88003 of the Government Code. The system meets this requirement. 5) §9051(b): The condensed ballot title and summary shall not contain more than 75 words and shall be a condensed version of the ballot title and summary including the financial impact summary prepared pursuant to Section 9087 of this code and Section 88003 of the Government Code. The system meets this requirement. 6) §9051(c)(1): The ballot label shall include the condensed ballot title and summary described in subdivision (b), followed by the following: (A) After the text “Supporters:”, a listing of nonprofit organizations, businesses, or individuals taken from the signers or the text of the argument in favor of the ballot measure printed in the state voter information guide. The list of supporters shall not exceed 125 characters in length. Each supporter shall be separated by a semicolon. A nonprofit organization, business, or individual shall not be listed unless they support the ballot measure. (B) After the text “Opponents:”, a listing of nonprofit organizations, businesses, or individuals taken from the signers or the text of the argument against the ballot measure printed in the state voter information guide. The list of opponents shall not exceed 125 characters in length. Each opponent shall be separated by a semicolon. A nonprofit organization, business, or individual shall not be listed unless they oppose the ballot measure. 31 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM The system meets this requirement. 7) §15360: During the official canvass of every election in which a voting system is used, the official conducting the election shall conduct a public manual tally of the ballots tabulated by those devices cast in one percent of the precincts chosen at random by the elections official. If one percent of the precincts should be less than one whole precinct, the tally shall be conducted in one precinct chosen at random by the elections official. In addition to the one percent count, the elections official shall, for each race not included in the initial group of precincts, count one additional precinct. The manual tally shall apply only to the race not previously counted. The system supports this requirement. 8) §19300: A voting machine shall, except at a direct primary election or any election at which a candidate for voter-nominated office is to appear on the ballot, permit the voter to vote for all the candidates of one party or in part for the candidates of one party and in part for the candidates of one or more other parties. The system meets this requirement. 9) §19301: A voting machine shall provide in the general election for grouping under the name of the office to be voted on, all the candidates for the office with the designation of the parties, if any, by which they were respectively nominated. The designation may be by usual or reasonable abbreviation of party names. The system meets this requirement. 10) §19302: The labels on voting machines and the way in which candidates’ names are grouped shall conform as nearly as possible to the form of ballot provided for in elections where voting machines are not used. The system meets this requirement. 11) §19303: If the voting machine is so constructed that a voter can cast a vote in part for presidential electors of one party and in part for those of one or more other parties or those not nominated by any party, it may also be provided with: (a) one device for each party for voting for all the presidential electors of that party by one operation, (b) a ballot label therefore containing only the words “presidential electors” preceded by the name of the party and followed by the names of its candidates for the offices of President and Vice President, and (c) a registering device therefore which shall register the vote cast for the electors when thus voted collectively. 32 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM If a voting machine is so constructed that a voter can cast a vote in part for delegates to a national party convention of one party and in part for those of one or more other parties or those not nominated by any party, it may be provided with one device for each party for voting by one operation for each group of candidates to national conventions that may be voted for as a group according to the law governing presidential primaries. No straight party voting device shall be used except for delegates to a national convention or for presidential electors. The system meets this requirement. 12) §19304: A write-in ballot shall be cast in its appropriate place on the machine, or it shall be void and not counted. The system supports this requirement. 13) §19320: Before preparing a voting machine for any general election, the elections official shall mail written notice to the chairperson of the county central committee of at least two of the principal political parties, stating the time and place where machines will be prepared. At the specified time, one representative of each of the political parties shall be afforded an opportunity to see that the machines are in proper condition for use in the election. The party representatives shall be sworn to perform faithfully their duties but shall not interfere with the officials or assume any of their duties. When a machine has been so examined by the representatives, it shall be sealed with a numbered metal seal. The representatives shall certify to the number of the machines, whether all of the counters are set at zero (000), and the number registered on the protective counter and on the seal. The system supports this requirement. 14) §19321: The elections official shall affix ballot labels to the machines to correspond with the sample ballot for the election. He or she shall employ competent persons to assist him or her in affixing the labels and in putting the machines in order. Each machine shall be tested to ascertain whether it is operating properly. The system supports this requirement. 15) §19322: When a voting machine has been properly prepared for an election, it shall be locked against voting and sealed. After that initial preparation, a member of the precinct board or some duly authorized person, other than the one preparing the machines, shall inspect each machine and submit a written report. The report shall note the following: (1) Whether all of the registering counters are set at zero (000), (2) whether the machine is arranged in all respects in good order for the election, (3) whether the machine is locked, (4) the number on the protective counter, (5) the number on the seal. The keys shall be delivered to the 33 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM election board together with a copy of the written report, made on the proper blanks, stating that the machine is in every way properly prepared for the election. The system supports this requirement. 16) §19360: Before unsealing the envelope containing the keys and opening the doors concealing the counters the precinct board shall determine that the number on the seal on the machine and the number registered on the protective counter correspond to the numbers on the envelope. Each member of the precinct board shall then carefully examine the counters to see that each registers zero (000). If the machine is provided with embossing, printing, or photography devices that record the readings of the counters the board shall, instead of opening the counter compartment, cause a “before election proof sheet” to be produced and determined by it that all counters register zero (000). If any discrepancy is found in the numbers registered on the counters or the “before election proof sheet” the precinct board shall make, sign, and post a written statement attesting to this fact. In filling out the statement of return of votes cast, the precinct board shall subtract any number shown on the counter from the number shown on the counter at the close of the polls. The system supports this requirement. 17) §19361: The keys to the voting machines shall be delivered to the precinct board no later than twelve hours before the opening of the polls. They shall be in an envelope upon which is written the designation and location of the election precinct, the number of the voting machine, the number on the seal, and the number registered on the protective counter. The precinct board member receiving the key shall sign a receipt. The envelope shall not be opened until at least two members of the precinct board are present to determine that the envelope has not been opened. At the close of the polls the keys shall be placed in the envelope supplied by the official and the number of the machine, the number written on the envelope. The system supports this requirement. 18) §19362: The exterior of the voting machine and every part of the polling place shall be in plain view of the election precinct board and the poll watchers. Each machine shall be at least four feet from the poll clerk’s table. The system supports this requirement. C. California Code of Regulations 34 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM 1) CCR § 20236(a) The ballot shall be able to be tabulated with the following accuracy and reject criteria as it relates to the acceptance by each component of the voting system for which certification is being sought: • The accuracy error rate shall be zero; and • The ballot rejection rate shall not exceed two percent per ballot style per voting system for which the ballot printer is seeking certification. The system supports this requirement. 2) CCR § 20236(b) The ballots produced shall be tested by being scanned in all orientations applicable to each voting system component for which certification is being sought. The system supports this requirement. 3) CCR § 20236(c) If the ballot on demand system is seeking certification to be used in conjunction with an election management system and/or for printing batches, ballot cards shall be generated utilizing the applicable components. (If applicable) The system supports this requirement. 4) CCR § 20236(d) The ballot on demand system shall be able to accept the ballot style and ballot type data produced by the voting system for which certification is being sought. The system supports this requirement. 5) CCR § 20236(e) The ballot on demand system shall have restrictions allowing and disallowing users to access the ballot data based on the setting and configuration parameters placed on the system. The system supports this requirement. 6) CCR § 20236(f) Any electronic communication to or from the ballot on demand system shall be tested for accuracy and security. The system supports this requirement. 7) CCR § 20236(g) Any component, whether internal or external to the ballot on demand system, that communicates directly to the ballot on demand system to generate the voter's ballot style and ballot type information may be tested as part of the ballot on demand system. This includes, but is not limited, to voter registration systems, election management systems, electronic poll books. The system supports this requirement. 35 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM 8) CCR § 20236(h) Any component, whether internal or external to the ballot on demand system, that duplicates and/or remakes a ballot, inclusive of the ballot marks, but does not save or export any ballot content data for tabulation may be tested as part of the ballot on demand system. (If applicable) The system supports this requirement. 9) CCR § 20236(i) Any component, whether internal or external to the ballot on demand system, that duplicates and/or remakes a ballot, inclusive of the ballot marks, and saves or exports any ballot content data for tabulation may be tested as part of the voting system. (If applicate) The system supports this requirement. 10) CCR § 20236(j) The system shall be able to produce a report of the following information: 11) Quantity of ballot cards produced. 12) Quantity of ballot cards produced by style. 13) Quantity of ballot cards produced accurately. 14) Quantity of ballot cards misprinted and the associated ballot style and ballot type for the misprinted ballot card. 15) Quantity of ballot cards produced by user. 16) Audit log for activity by user, including but not limited to the deletion, modification, and addition of ballot definition files on the system. The system supports this requirement. D. Review of Federal Statutes or Regulations. 1) The Voting Rights Act (VRA) of 1965, as amended (42 U.S.C. 1973), requires all elections in certain covered jurisdictions to provide registration and voting materials and oral assistance in the language of a qualified language minority group in addition to English. Currently in California, there are eleven VRA languages (English, Spanish, Cambodian, Chinese, Hindi, Japanese, Khmer, Korean, Tagalog, Thai, and Vietnamese) as prescribed under the law. The system meets this requirement. The system’s paper ballots can be printed in these languages, as well as others. 2) The National Voter Registration Act of 1993 (42 U.S.C. 1973gg and 11 CFR 8) allows for the casting of provisional ballots through Fail-Safe Voting procedures. The system meets this requirement. Provisional ballots can be cast with this system. 36 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM 3) The Voting Accessibility for the Elderly and Handicapped Act of 1984 (42 U.S.C. 1973ee through 1973ee-6) requires each political subdivision conducting elections within each state to assure that all polling places for federal elections are accessible to elderly and handicapped voters, except in the case of an emergency as determined by the state’s chief election officer or unless the state’s chief election officer: (1) determines, by surveying all potential polling places, that no such place in the area is accessible or can be made temporarily accessible, and (2) assures that any handicapped voter assigned to an inaccessible polling place will, upon advance request under established state procedures, either be assigned to an accessible polling place or be provided an alternative means of casting a ballot on election day. This system supports this requirement. 4) The Retention of Voting Documentation (42 U.S.C. 1974 through 1974e) statute applies in all jurisdictions and to all elections in which a federal candidate is on a ballot. It requires elections officials to preserve for twenty-two months all records and papers which came into their possession relating to an application, registration, payment of a poll tax, or other act requisite to voting. Note: The US Department of Justice considers this law to cover all voter registration records, all poll lists and similar documents reflecting the identity of voters casting ballots at the polls, all applications for absentee ballots, all envelopes in which absentee ballots are returned for tabulation, all documents containing oaths of voters, all documents relating to challenges to voters or absentee ballots, all tally sheets and canvass reports, all records reflecting the appointment of persons entitled to act as poll officials or poll watchers, and all computer programs used to tabulate votes electronically. In addition, it is the Department of Justice’s view that the phrase “other act requisite to voting” requires the retention of the ballots themselves, at least in those jurisdictions where a voter’s electoral preference is manifested by marking a piece of paper or by punching holes in a computer card. The system meets this requirement. All votes in this system are recorded on paper ballots that can be retained. E. Help America Vote Act (HAVA) Requirements The Help America Vote Act (HAVA) §301(a) mandates several requirements for voting systems, including: 1) The ability to verify the vote choices on the ballot before that ballot is cast and counted, 2) Notification to the voter of over-votes on a ballot, 37 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM 3) Auditability with a permanent paper record of votes cast, d) Accessibility for individuals with disabilities, including nonvisual accessibility for the blind and visually impaired, in a manner that provides the same opportunity for access and participation (including privacy and independence) This system supports these requirements in the following manner: i. The paper ballots themselves lend themselves to visual inspection and verification. ii. The Verity TouchWriter provides its users with a ballot review screen prior to printing the ballot. Further, any voted ballot can be inserted into Verity Reader for review and verification. iii. The Verity TouchWriter will prevent over-voting a contest. iv. Because all ballots in this system are paper based, there is a fully auditable and permanent record of the election. v. Deployment of the Verity TouchWriter and Verity Reader in a precinct provides accessibility for persons with disabilities at the polling place. V. CONCLUSION The Hart Verity Voting 3.2 voting system, in the configurations tested and documented by the Verity Voting 3.2 Installation and Use Procedures, meets applicable California Voting System Standards, California Code of Regulations, California Elections Code, and HAVA requirements. 38 | P age SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.2 VOTING SYSTEM