Hart Verity Voting 3.1 Staff Report

A P LEX ADILLA |SECRETARY OF STATE | STATE OF CALIFORNIA OFFICE OF VOTING SYSTEMS TECHNOLOGY ASSESSMENT 1500 11th Street | Sacramento, CA 95814 | Tel 916.695-1680 | Fax 916.653.4620 | www.sos.ca.gov HART INTERCIVIC INC. VERITY VOTING 3.1 Components Verity Scan: Software version 3.1 Verity TouchWriter: Software version 3.1 Verity Reader: Software version 3.1 Verity Print: Software version 3.1 Verity Device Microcontroller: Software version 17 Verity Data: Software version 3.1 Verity Build: Software version 3.1 Verity Central: Software version 3.1 Verity Count: Software version 3.1 Verity Election Management: Software version 3.1 Verity Desktop: Software version 3.1 Verity User Manager: Software version 3.1 Power Digital USB Drive Duplicating Machine Oki C831 Printer Oki B432 Printer Staff Report Prepared by: Secretary of State’s Office of Voting Systems Technology Assessment November 20, 2019 Table of Contents I. INTRODUCTION............................................................... 3 II. SUMMARY OF THE SYSTEM........................................... 4 III. TESTING INFORMATION AND RESULTS...................... 8 IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS....................................................... 26 V. CONCLUSION…………………………….………………….33 2 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM I. INTRODUCTION 1. Scope This report presents the test results for the certification testing of the Hart InterCivic Inc. (Hart) Verity Voting (Verity) 3.1 voting system. The purpose of testing is to evaluate the compliance of the voting system with California Voting Systems Standards, and State & Federal laws. Testing also uncovers other findings, which do not constitute non- compliance, and those findings are reported to the voting system vendor to address the issues procedurally. The procedures for mitigating any additional findings are made to the documentation, specifically the Verity Voting 3.1 California Use Procedures. 2. Summary of the Application Hart submitted an application for the Verity Voting 3.1 voting system on May 15, 2019. In addition to the software, which includes the executable code and the source code, Hart was required to submit the following: The Technical Documentation Package (TDP), All the hardware components to field two complete working versions of the system, including all peripheral devices, one for the Functional Test Phase and one for the Security Test Phase, Ten Verity TouchWriter ballot marking machines, and all the peripherals that would be in the polling place, Twenty Verity Scan precinct scanners, and all the peripherals that would be in the polling place, and The Verity Voting 3.1 California Use Procedures. The voting system is comprised of the following major software components: Verity Scan: Software version 3.1, Verity TouchWriter: Software version 3.1, Verity Reader: Software version 3.1, Verity Print: Software version 3.1, Verity Device Microcontroller: Software version 17, Verity Data: Software version 3.1, Verity Build: Software version 3.1, Verity Central: Software version 3.1, Verity Count: Software version 3.1, Verity Election Management: Software version 3.1, Verity Desktop: Software version 3.1, and Verity User Manager: Software version 3.1. 3 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM 3. Contracting Upon receipt of a complete application, the Secretary of State released a Request for Proposal (RFP) for assistance with the Functional, Accessibility, Volume, and Security Review, which is comprised of Security/Telecommunications and Source Code (Software Review) Testing. Through the formal California contracting process, the Secretary of State awarded a contract to SLI of Wheatridge Colorado. II. SUMMARY OF THE SYSTEM The Verity Voting 3.1 system is a paper-based voting system, utilizing standardized Verity ballots throughout the system. One network connects the development environment, and one network connects the tabulation and scanning environment. The network protocol is TCP/IP, utilizing static IP addressing. Name resolution is accomplished by a static HOSTS file. All computer based systems utilize the Windows Embedded Standard 7 with Service Pack 1 Operating System is a custom built version, with all applications and services not necessary for the voting system removed, thereby reducing the attack surface. Windows 7 is scheduled for end of life at Microsoft in January of 2020. Verity 3.1 utilizes redundant bar codes on the ballot for election overhead, however tabulation is done utilizing the voter marked bubbles on the ballots. All scanners utilized for tabulation, as well as all computers are COTS. The proprietary polling place devices including Print, Scan, Writer, and Reader are COTS tablets, built into a proprietary case. Election definitions and data are distributed to polling place devices with a vDrive USB drive which is signed. Proprietary devices boot and run from a Compact Flash (CFAST) card, which is also signed. All workstations and servers run from redundant, one terabyte hard drives in a mirrored configuration (RAID 1), which are encrypted using BitLocker. All workstations boot to kiosk mode. In kiosk mode, the desktop is locked and only a few options are available. All post installation HASHes are provided to jurisdictions so that all components of the system can be validated at any time. The Verity 3.1 system consists of the following major components: Verity Election Management System (EMS), Verity Data, Verity Build, Verity Central, Verity Count, Verity Scan, Verity TouchWriter, Verity Print, and Verity Reader. 1. Election Management System The Verity Election Management System set of applications are responsible for all pre- voting and post-voting groups of activities in the process of defining and managing elections. 4 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM The complete EMS software platform consists of client (end-user) and server (back- end) applications as follows: Verity Data: Data is used by election officials to enter election data for contests, candidates, proposition text, translations, and audio. Data also provides the user with controls for proofing of data, layout, and performs validation prior to locking the data to ensure its readiness for use in Verity Build, the election definition software. Data/Build utilizes an Oki C831 printer for batch printing of ballots on demand, ballots for proofing, jurisdictional and precinct reporting, etc. Verity Build: An election definition and device settings component. Build is a required component of the Verity Voting system, used by officials to complete pre-voting tasks for creating and generating an election definition and ballots. Build provides a ballot layout proofing process. The process establishes relationships between election data, jurisdiction, and polling place data for the shared election definition. Build will create the portable media, called vDrives, to provide a method of transferring the shared election definition to Verity Voting machines and other Verity components. vDrive uses an “air-gap,” or non- networked transfer method, to provide more secure exchange of election data. Verity Central: A central ballot scanning and adjudication component used by officials for paper ballot scanning, contest resolution, and conversion of voter selection marks to electronic Cast Vote Records (CVRs). Once the CVRs are written to vDrive(s) they can be transferred into Verity Count for vote tabulation and reporting of election results. Verity Central records cast vote records only; it does not tabulate. Verity Count: Used by officials to complete post-voting functionality to tabulate election results and generate reports. Count receives the CVRs from portable media devices (vDrives) used to record CVRs from Hart voting machines or Verity Central workstations. Verity Count can be used by officials to resolve Verity Scan or Verity Central write-in votes for paper ballots that were manually marked. Count can also be used to collect and store all election logs from every Verity component/machine used in the election, allowing for complete election audit log reviews. Verity Election Management: The Election Management application is available only on Verity server workstations. This software enables authorized users to add, import, export, archive, restore, and manage elections. Once an election is added or imported into the Election Management application, the election can be opened and handled per the features available within the Verity software installed on that workstation. User Management: This software enables authorized users to create and manage user accounts within the Verity system. 5 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM Verity Desktop: Allows authorized users to manage a very limited set of operating system functions. Verity Desktop is workstation management software used for: o Setting the system date and time, o Exporting Verity application file hashes to removable USB media, o Accessing the operating system for a limited time (less than 24 hours per access code). User access to the operating system’s functionality is restricted to software updates and database management, and o Importing printer configuration files. 2. Verity Print Verity Print is a pre-voting ballot production machine for use by election officials and/or poll workers. Verity Print produces unmarked paper ballots. Verity Print is paired with a commercial off-the-shelf Oki B432 printer to allow the user to select and print the desired ballot style based on the precinct and voter registration information. The Verity Print machine is activated so the election official can print one or more blank ballots from one selected precinct at a time. Ballots can be printed on-demand for immediate use, or they can be printed in advance for additional inventory. 3. Verity TouchWriter Verity TouchWriter is a touch-screen Ballot Marking Device (BMD) that prints voter- marked ballots to a commercial off-the-shelf Oki B432 printer. Voters use the electronic touch display interface to privately and independently make their selections on the ballot. Voters can also make selections with Verity Access, an Audio-Tactile interface (ATI) component with three tactile buttons, one audio port (for headphones), and one port for external two-switch machines. When voters finish making their selections, they print the marked ballot. 4. Verity Reader Verity Reader is an optional paper ballot review machine suitable for use by all voters, including non-disabled voters and voters with disabilities. Voters insert their marked paper ballot to visually verify how their ballot will be counted when the ballot is cast in the Verity system, and/or hear audio read-back of their ballot choices. For voters with disabilities, Reader offers the same accessibility features as the TouchWriter ballot marking machine. 6 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM 5. Verity Scan Verity Scan is Verity’s digital scanning solution for paper ballots. Scan is paired with a purpose-built ballot box to ensure accurate, secure, and private ballot scanning and vote casting. When opening the polls, authorized users activate the Verity Scan machine to prepare it to receive marked paper ballots. Scan indicates when it is appropriate to insert ballots, and when ballots have been successfully cast. Verity Scan records Cast Vote Records (CVR) and audit log data in redundant, secure storage locations, including the Verity vDrive. vDrive storage is portable flash memory and allows the CVRs to be transferred to the Verity Count tabulation and reporting system. 6. Verity Access Verity Access is an interface module that is connected to Verity TouchWriter and Verity Reader. The module has three tactile buttons, one audio port, and one port for external tactile buttons or sip-n-puff devices. Jacks for headphones and adaptive devices are located on the top edge of the machine, and the machine has grip surfaces on either side. 7. Verity AutoBallot Verity AutoBallot is an optional barcode scanner kit for Verity Print and Verity TouchWriter that allows air-gapped integration between an electronic pollbook check-in process and the task of selecting the proper ballot style for the voting system. Particularly when Verity Print or Verity TouchWriter is configured with dozens or hundreds of ballot styles in Vote Centers, Verity AutoBallot simplifies and automates the ballot style selection process by allowing poll workers to scan a barcode output from an electronic poll book, and activate the correct ballot style with the click of a button, thereby reducing human error. Once the ballot style has been input with the barcode scanner, the poll worker confirms the ballot style on the Verity machine display and prints an unmarked ballot (Verity Print), or activates an accessible electronic voting session (Verity TouchWriter). 8. Verity vDrive Verity vDrive is a required Verity Voting component, used as a portable media device generated by Verity Build. vDrive allows election definitions to be moved from Verity Build to Verity Scan, Verity TouchWriter, Verity Reader, and Verity Print. vDrive supports the transfer of Cast Vote Records in Verity Scan and Verity Central. 7 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM 9. Verity Key Verity Key is electronic media that is created by Verity Build for a specific election. Key is a required Verity component. Key is the electronic media that provides user authentication and configures election security throughout the Verity voting system. Hart Verity Voting 3.1 Block Diagram 8 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM Hart Verity Voting 3.1 Tested Configurations III. TESTING INFORMATION AND RESULTS 1. Background California certification testing of the Verity Voting system began on October 3, 2019, and ran through November 1, 2019. The testing began with the Source Code Review, followed by Functional Testing, and finally Volume and Accessibility while the Security/Telecommunications Review was accomplished at SLI in parallel with the SOS testing. 9 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM 2. Functional Test Data The Functional Test of the Hart Verity Voting 3.1 system was conducted by Office of Voting Systems Technology Assessment Staff at the Secretary of State’s Office located at 1500 11thStreet, Sacramento, California from October 7, 2019, through October 24, 2019. The Functional Testing began by compiling the trusted build of the application installers from source code. Next, the complete systems were installed. The eight computerized components of the EMS tested were all Hewlett Packard Z240 computers: Central Server, Central Client, Data Build Standalone, Count Standalone, Count Server, Count Client, Data Build Server, and Data Build Client. The proprietary tablet machines tested (Scan, Print, Reader, and TouchWriter) are all tablet computers running in custom cases designed for polling place applications. The system is modularized so that all the polling place machines are running one of two versions of the same hardware. Following the TDP procedures, Functional Testing started by building the operating system. Hart is licensed by Microsoft to build their own versions of the Windows 7 Embedded Standard Operating System. The version built is a scaled down operating system without any unneeded applications or utilities included. Hart does not have access to the Microsoft Source Code, and there is no proprietary Hart code in the operating system. This reduces the attack surface of the operating system to only those components needed to operate the voting system. Two versions of the OS were built, a 32 bit version for the tablets that Scan, Print, TouchWriter, and Reader are built on, and a 64 bit version for Data, Build, Count, and Central. Following the California Use Procedures, the testing continued with the installation of the operating system, commercial-off-the-shelf software, voting system software, and then continued through the security hardening process. Next, the workstations and servers were encrypted utilizing BitLocker. Finally, the completed systems were HASHed for future validation. Upon completion of the installation of the system, it was run through an acceptance and readiness test to determine that each piece of equipment was functioning properly and that all networking and permissions were configured correctly. The acceptance test was accomplished by batch printing 30 ballots from Data/Build to the Oki C831 printer. These ballots were run through the voting system to determine that everything worked. A second complete set of the system was built at this time for the SLI Security team to utilize for the Security/Telecommunications portion of testing. The Verity system utilizes a Power Digital USB drive duplicating machine to meet California’s air-gap requirement for a “cleaner” machine to clean vDrives that return to the development environment. Functional Testing of the system included six main election types, a Presidential Primary in English and Spanish, a Presidential General in English, Korean, Chinese, and Vietnamese, a Special Recall in English, Khmer, Japanese, and Hindi, a Single Seat Ranked Choice Voting (RCV) in English, Ilocano, Tagalog, and Thai, a Vote Center Election in English, and a simple pick two of three election in English built from scratch. 10 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM Test ballots were evaluated for the following criteria: Per California Elections Code (EC) section 13002, ballots should be printed with a watermark and tint from the approved list for California. Pursuant to the requirements of California Elections Code section 13203, ballots should be clearly labeled as TEST BALLOTS instead of OFFICIAL BALLOT. Ballots should contain Instructions to Voters per California Elections Code section 13204 and 13205, but may also include instructions at the bottom of the ballot per section 13231. Candidates should be listed per California Elections Code section 13103. Candidate’s political party should be listed per California Elections Code section 13105. Per California Elections Code section 13107, each candidate is to have an occupation listed under the candidate's name. For economy of testing, the following 'occupation' will be used for all candidates: Occupation Prints Here - la ocupacion demuestra aqui. The mock elections were conducted as if the system had just been purchased by a county. The vote center/precinct machines were setup for either early voting or Election Day voting. Per California Code of Regulations section 20263, ballots were produced on demand and as needed with Verity Print utilizing an Oki B432 printer, and Data/Build using an Oki C831 printer. Verity Print and the Oki B432 printer would be used for ballots on demand at a polling place or vote center, and Data/Build printing to the Oki C831 would be for a central office to print batch ballots on demand. The Oki C831 printer will not print 20 inch ballots, however the Oki B432 will print all sizes. The Verity TouchWriter ballot marking device was utilized for accessible voting sessions, and the Verity Reader machines were used to validate the ballots marked on the Verity TouchWriters. Accessible sessions were initiated on Verity TouchWriter utilizing either manual input or the Verity AutoBallot barcode scanning machine. Ballots were scanned on Verity Scan machines, and validated by scanning a second time on Verity Central. Polls were opened, and repeatedly suspended and re-enabled on the Scan machines setup for early voting. At the close of polls, the vDrives from the Scan machines were loaded onto Central to scan again, and then were brought into Count to tabulate and generate all reports. Ballots containing an exception condition, a write-in, under-votes, or over-votes were resolved using the resolve screen on the Central or Count machines. The resolve screen will allow an election official to import qualified write-ins, and review unqualified write-ins to verify voter intent. After all ballots were tabulated, the Cumulative Report was printed, and all other reports were generated. Additionally, the Secretary of State Statement of Vote (SOV) and Supplemental Statement of Votes (SSOV) reports were generated. Comma separated text files were generated to simulate election night auto-reporting, however, as the templates for the test elections were not available, these files were not validated. Note that the above description was followed for all test elections, however, each election was also used to test specific items, such as ballot layout rules and laws, battery backup capacity, scanner read-head 11 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM tests to determine the consistency and accuracy of different types of marks using different marking machines simulating actual voters who vote by mail, language tests to determine if the system can populate all fonts used in California correctly and accurately, as well as the capability of the system to operate in a vote center environment that may constitute many more voters both for early voting and on election day. Special Recall Election: The Special Recall Election was tested in English, Khmer, Japanese, and Hindi. The election consisted of one precinct and one contest. The contest included 135 choices with one write-in in a gubernatorial contest. The election was printed on 20 inch ballots, which are the longest ballot size possible for the system. The Standalone configurations for Data/Build and Count were used in this election. The ballots were machine pre-printed in all four languages. The recall election was used to simulate a smaller jurisdiction, utilizing the standalone configurations of the system. The Data/Build standalone machines were used to generate a vDrive with election information, and the vDrive duplicator was used to duplicate additional vDrives to distribute the election to Scan, Print, TouchWriter, and Reader. Central Client/Server was used to consolidate, and Count Standalone was used to generate reports. Two ballots in each language were pulled from the pre-printed ballots, and remade on TouchWriter. TouchWriter printed the ballots on semi blank ballots that were pre-printed with only tint and watermark. The ballots were then verified on Reader, and scanned on Scan. At this time, the accessible options for contrast and text size were verified on TouchWriter. The remaining ballots were scanned approximately one third each on the three central scanners. Ballots were fed in every orientation. The Scan machine was setup for Election Day voting. Three ballots were fed together, and the machine correctly identified the problem and would not pick them up. The machine also correctly identified when two ballots were fed together. The Verity ballot utilizes redundant bar codes on the front and back of the ballot for timing, and it was discovered that an unclear print or discrepancy on the bar code could cause problems with timing, and the ballot will not scan. Using a Sharpie black marker, a ballot was marked with additional lines at the bar code, effectively extending the bar code by four lines, and Scan would not read the ballot. The polls were closed, the results were exported to Central using a signed export, and the cast vote records were tabulated again. All reports were generated, and all logs from all machines saved. All counts matched the expected results, and the system operated as expected. Test deck two was generated using Verity Print to print five ballots in each language on the Oki B432 printer, and Data/Build was used to print five ballots in each language on the Oki C831. Verity Print throughput was six ballots per minute for 20 inch ballots. These ballots were hand marked and expected results spreadsheet built. After the Recall Election was completed, the polls were closed, zeroed, and opened again, and these printed ballots were scanned. One ballot was blank, and one was totally over- voted. Counts matched the expected results. 12 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM Vote Center Election: The Vote Center Election test deck one included approximately five contests, 10 choices, and one proposition depending on the precinct, and 3000 precincts, which is the maximum for the system. Ballots were printed for every twelfth precinct in English on 11 inch ballot stock and 25% of the ballots were machine tri- folded, stored for a week, and then unfolded by hand to simulate vote by mail ballots. As a system test of label capacity, one candidate was created as candidate Last Name starting with the character “L” and extending with twenty nine digits as indicated below. The First Name started with the character “F” and extending with nineteen digits as indicated below. For printed ballots, the following was used for the candidate name: "F12345678901234567890 L123456789012345678901234567890". Ten ballots were then pulled from one of the test decks, and replaced by ballots which were printed on Print, marked on TouchWriter the same as the ballots pulled from the test deck, and verified on Reader. These 10 ballots were then added back to the test deck and scanned with the deck. The accessible functions of TouchWriter were exercised at this time. The audio, text size, ability of TouchWriter to back up through all previous screens, and all options were exercised, and the generated/marked ballots were verified with Reader. If a voter personalizes a session in TouchWriter by for instance choosing large print, the ballot automatically shows up as large print on Reader. Whatever language the ballot is printed in also shows up in Reader correctly. All accessible options functioned as expected. One Scan machine was configured for Election Day voting, and one Scan machine was configured for early voting as in a vote center. One complete test deck was fed through the two Scan machines, approximately half through each machine. Ballots were fed in every orientation. The Scan machine setup for early voting was repeatedly suspended, powered off and back on again, and re-enabled without problem. It was discovered that on or after Election Day, the option to suspend polls disappears and you can only close the polls. Once voting has been suspended on Scan, the machine has to be powered off and back on, and then polls opened again. One complete test deck was then scanned on each of the three Central scanners. The client/server configuration for Data/Build, Central, and Count was used to scan and tabulate this election. Polls were closed, and all votes aggregated to Count. All counts matched expected results, and the system operated as expected. All reports and logs were generated and saved as artifacts. It was verified that cast vote records and ballot images can be exported from the system prior to accomplishing a risk limiting audit. Each ballot consists of two .PNG images, and are named <HASH>_front and <HASH>_back. The images from 11 inch ballots can be expected to take 250 megabytes per 1000 ballots, or 25 gigabytes per 100,000 ballots. The TouchWriter/Oki B432 printer connection was tested at this time. TouchWriter was booted with the printer unplugged, and an error message popped to contact the poll worker. The printer was then connected, and TouchWriter correctly connected to the printer and was ready for voting. The printer was also plugged in, but turned on after TouchWriter was booted, and TouchWriter correctly connected. 13 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM Test deck two was used to exercise Print by printing 100 ballots, consisting of every thirtieth precinct, which were hand marked, an expected results spreadsheet built, and then scanned in a second test deck after polls had been closed and aggregated for the original election. All ballots printed and scanned as expected. Polls were closed and all counts matched expected results. All reports and logs were saved as artifacts. During test deck two, AutoBallot was tested utilizing a list of barcodes to simulate barcodes generated from an electronic pollbook. AutoBallot utilizes a barcode to initiate an accessible session on TouchWriter or print an on demand ballot on Print. Verity barcodes contain precinct, party, ballot ID, election ID, language, sheet, and page number. Twelve barcodes were scanned at random, and 12 ballots printed on Print throughout the entire list to simulate voters arriving at the vote center and requesting a replacement ballot for a spoiled one. AutoBallot initiated Print ballots printed for the correct precinct. Barcodes can be scanned either straight up or upside down, and at up to a 45 degree angle with no problem. The bar code reader will not function sideways. Twelve barcodes were scanned at random from the list to initiate a session on TouchWriter to simulate a voter with disabilities who arrived at a vote center to vote. AutoBallot initiated TouchWriter sessions functioned as expected. Test deck three consisted of six ballots that were printed utilizing Print and used to test marginal marks. The ballots were marked with colors, highlighters, pencils, pens, Sharpies, small dots, lines through the bubbles, circles around the bubbles, and X’s. Adjudication was set to out-stack all conditions. These ballots were then labeled and scanned in the same orientation in each scanner to compare how the scanners recognized the marginal marks. It was discovered that blue Sharpie highlighter was counted as a vote on Scan, but counted as an under-vote on all three central scanners. Red Sharpie pen was counted as a vote on all three central scanners, but was not counted as a vote on the Scan machine. Hart recommends that jurisdictions first review vote by mail ballots when they receive them. Secondly, adjudication on Central should be set to filter or out-stack blank ballots and under-votes to catch ballots with these types of marginal marks. All devices operated as expected for a vote center environment whereby every device should know about every precinct and voter. Ranked Choice Voting (RCV) Election: The RCV Election was tested in English, Ilocano, Tagalog, and Thai. A fictitious single seat RCV election with one ballot style with one contest containing six candidates and a write-in. The supplied test deck one ballots were machine marked, but because of an error in the deck, test deck one ballots were re-printed on Build and the Oki C831 printer. The Ranked Choice Voting setting in Data enables the system to build RCV format ballots. The standalone configurations of Data/Build and Count were utilized for this election. vDrives were configured and used to setup one TouchWriter, one Reader, and two precinct Scan machines, one for Election Day voting and one for early or vote center voting. The system will not tabulate past the first ranking in an RCV election, but 14 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM exports the cast vote records in an XML format. It was discovered that the pre-printed test deck one ballots were version seven of the election, and the supplied election definition was version four, and therefore the ballots would not work. Two hundred and fifty two ballots were printed utilizing Build and the Oki C831 printer. Ballots were scanned 50 each in the Scan machines, and 50 in each central scanner. Polls were closed, results from the Scan precinct scanners were aggregated to Count, and all reports and logs were saved as artifacts. Test deck two was created by printing three ballots in each of Tagalog, Ilocano, Thai, and English, as well as bilingual ballots in English/Tagalog, English/Ilocano, and English/Thai ballots on Print utilizing the Oki B432 printer. The test deck was hand marked with the following conditions: Duplicated Candidate - A consecutive sequence of rankings for the same candidate. The system saw this as an over-vote. No vote was cast. Inconsistent Ordering - A candidate is ranked both above and below another candidate. The system saw this as an over-vote. No vote was cast. Skipped Ranking - A higher ranked choice is missing while a lower ranked choice has been made. The system saw this as an under-vote. No vote was cast. Over-voted Ranking - A ranking exists that has more than one candidate marked. The system saw this as an over-vote. No vote was cast. Un-voted Contest - No candidates were ranked. The system saw this as an under-vote. No vote was cast. Unused Ranking - Additional rankings at the end are left empty by the voter. The system ignored the unused rankings. The polls were opened, and zero reports for all machines were printed and verified. Ballots were scanned on Central and the first round of voting was verified. Verity Voting 3.1 does not perform RCV tabulation. Rather, it tabulates the number of votes for each candidate in each ranking and produces a “cast vote record” in an XML file for each ballot. This file shows the ranking assigned to each candidate and can be used either to tabulate the vote manually or to process the cast vote record through applications outside of the system. Count will export cast vote records in an XML file for this purpose. Ballot images can be exported as .PNG files. Polls were closed and all reports generated and saved. Test deck three was generated by marking and printing two ballots in each language on TouchWriter. The contests and candidates displayed correctly on TouchWriter, and the ballots scanned as expected. This system, in combination with the software used to tabulate the XML export would require substantial further testing and approval before this system is used for an RCV Election. 15 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM Presidential Primary Election: Presidential Primary in English and Spanish, including one bi-lingual ballot style consisting of English and Spanish. The election included 10 precincts and eight party splits per precinct. It included 20 contests and 65 choices. All devices and interfaces were programmed to support the entire election in English and Spanish. Test deck one ballots were machine printed and pre-marked on 14 inch ballot stock, which is the medium size possible for the system and double sided. Five ballots in English, five ballots in Spanish, and five bi-lingual ballots were pulled from the test deck, duplicated on TouchWriter, and verified on Reader. These duplicated ballots were then added back to the test deck and the originals were spoiled. The Hart vDrive duplicator was used to generate vDrives to transfer the election definition to one Print machine, one TouchWriter machine, and two Scan machines. One Scan machine was configured for early voting, and one Scan machine was configured for precinct/Election Day voting. Once the precinct scanners are setup, they will not accept anything that is not signed for this election. Fifty ballots were scanned through each Scan machine, leaving 160 ballots in a test deck which were scanned in equal numbers through each Central scanner. Ballots in English and Spanish were scanned on both the early and Election Day Scan machine without problem. Ballots were fed in all four orientations. The landing lights, in conjunction with the audible tone, make it very apparent that the ballot has been read, and the machine is ready for another ballot. The Scan machines processed the 14 inch ballots at a steady rate of six to eight per minute. Ballots were fed two at a time, and the machine correctly identified the problem. The instructions were clear to understand, and the write-in functionality was used with no difficulty. Voting for a write-in did not require cycling through the entire alphabet, but allowed for easy back and forth using the on screen keyboard. The Scan results were transferred to the Count machine by signed export. Then one complete test deck was scanned through each Central scanner. Polls were closed, and results aggregated to Count. The counts matched the expected results, and the system operated as expected. Test deck two was created by printing 130 14 inch ballots from Build to the Oki C831 printer. These ballots were hand marked, expected results built, and scanned on Central. Hart was contacted to get an “exit to desktop” code, in order to exit and get the Verity Ballots Printed Report, the Verity Audit Log, the Windows Audit Log from Build, and the printer logs from the Oki C831 printer which were all saved as artifacts to determine the batch printing capability of the Build/ Oki C831 configuration. It was determined that this configuration meets the batch printing requirements for California. The counts matched the expected results, qualified write-ins were adjudicated, and all reports and logs were saved as artifacts. For test deck three, Print was utilized to print 25 Spanish, 25 English, and 25 Spanish/English ballots, utilizing 14 inch ballot stock. These ballots were marked by hand with two write-ins. Polls were opened and zero tapes printed. Ballots were 16 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM scanned, and polls were closed. A qualified write-in was created in the resolve screen, and both qualified and unqualified write-ins were resolved. Counts matched expected results, and all reports and logs were generated and saved. Presidential General Election: The Presidential General Election was tested in English, Korean, Chinese, and Vietnamese. Verity 3.1 will accommodate bi-lingual ballots, but not tri-lingual. All devices and interfaces were programmed to support the entire election in all four languages. The election included 10 precincts, 18 contests, and 45 options, with two write-ins. The candidates were rotated per California Elections Code section 13111. Order of offices on the ballot was per California Elections Code section 13109. Per California Elections Code section 13105, each partisan candidate had the party affiliation listed to the right of their name. This election was printed on 11 inch ballot stock, which is the smallest ballot size possible and included multiple cards. At this time, the startup, and maintenance procedures for the polling place machines were evaluated to make sure the procedures were correct. Test deck one was pre-printed and pre-marked. Two Scan machines were configured for Election Day and early voting, and to reject under-votes and over-votes which allowed for voter review. When a ballot is rejected for review, the voter can choose to both remove the ballot and edit it, or to cast the ballot as-is. Ballot rejection for voter review on the Scan machines is election wide and cannot be set by precinct. It was noted at this time that multiple card ballots increment the sheet counter on Scan for each additional card, but the ballot counter remains at one, and the lifetime counter remains at one also. The double sided ballots incremented the ballot and sheet counters and the single sided ballots only incremented the ballot counter. Ten ballots in each language were pulled from the deck, duplicated on TouchWriter, verified on Reader, and replaced in the deck. The originals were spoiled. TouchWriter was evaluated for a fleeing voter, and a voter who took longer than normal to vote. The voter who fled was corrected by the poll worker who spoiled the session and restarted another session. The longer than normal voter was able to finish voting as expected. The ten duplicated ballots, and 25 regular ballots were scanned on each Scan machine, and one entire copy of the test deck, as well as the leftovers from the deck scanned through the Scan machines were scanned on each Central scanner. All counts matched the expected results and the system operated as expected. Test deck two was created by printing 150 11 inch ballots on Build and the Oki C831 printer. The client server configuration was used to process these ballots. It was determined that neither Print nor Build will print ballots with tint and watermark, these have to be pre-printed on the ballots which are used. These ballots were hand marked, an expected results spreadsheet built, and scanned in equal number on all scanners. Results matched and the system operated as expected. 17 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM For test deck three, Print was used to print 25 ballots each in English, Korean, Chinese and Vietnamese. Ballots were scanned on all scanners in equal numbers. The Scan machines were configured for early voting and Election Day, polls were opened, and the 11 inch ballots were scanned at approximately one every three seconds. The Scan machine was unplugged and ran on battery power for two and a half hours while scanning 57 ballots without problem. However, it was noted that once the battery is used up, it must be removed from the Scan machine and charged using a battery charger. During this test, the Oki B432 printer ran out of toner, and the toner was replaced. As expected for a COTS printer, it was straight forward and uneventful. Ballots were aggregated to Count, all counts matched the expected results and the system functioned as expected. Pick Two of Three Election: The Pick Two of Three Election in English was built from scratch utilizing the client server configuration of Build. This election was printed from Build to the Oki C831 printer on 14 inch ballots. The ballots were pre-printed with tint and watermark, and 100 ballots were printed on this stock. The ballots were hand marked with either a blue ballpoint pen or a black Sharpie. An expected results spreadsheet was built, polls were opened, and the ballots scanned on Central. Polls were closed, results were aggregated to Count, and all reports and logs were saved. The counts matched the expected results, and all ballots scanned as expected. During Functional Testing, the Secretary of State was notified by Hart that they required an operating system setting change in the tablet based devices. This change was accomplished, new CFAST cards created, and regression testing completed. Test results showed that the voting system performed in a manner consistent with California Elections Code and all test cases were executed successfully and accurately. The testing did uncover several issues in the Verity Voting 3.1 California Use Procedures. All were clarity issues and each of the issues discovered was resolved by editing the Verity Voting 3.1 California Use Procedures. 4. Volume Test The Secretary of State conducts a Volume Test on all voting machines under test with which the voters will directly interact. The Volume Test took place in Austin Texas from October 28 through October 31, 2019. The Volume Tests used the General Election as the basis for the election definition files. The Verity Scan precinct tabulators and the Verity TouchWriter ballot marking machines presented for the Verity Voting 3.1 test are components that have been previously tested in California. Per the California Volume Test Protocol, machines with the same hardware but new firmware are required to test fewer machines. The Volume Test consisted of a total of 20 Scan machines, 10 TouchWriter machines, and 10 Reader machines. The Secretary of State used a total of 14 voters, ranging in age, skill, and voting experience, to vote ballots on the machines. All machines were labeled in numerical order of #1 through #20. TouchWriter and 18 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM Reader machines were labeled in numerical order of #1 through #10 for proper identification. Hart provided 20 test decks, each with 400 ballots for the Scan machines. The Scan machines were tested first, and a total of 400 ballots were scanned by each machine to simulate the voters a precinct or vote center would have on Election Day. As the test was being conducted, all incidents were documented. The zero tapes created when the polls were opened were kept on the machines, and along with the results after the polls were closed, were saved as artifacts. Hart provided the machines with Verity Voting 3.1 firmware already on them. HASHes were taken from every machine, and the post installation HASHes were used to validate every machine using BeyondCompare, a third party text comparison program. All HASHes matched and testing continued. During the Volume Test, the Scan machines threw two different errors. A “The device had a jam. The sheet did not pass through” error, and a “The device could not locate one or more target boxes on the ballot” error. The jam error was encountered 30 times on nine machines. The boxes error was encountered 67 times on 15 machines. For both errors, in every case, the error was mitigated by pulling the ballot from the machine, and re-inserting it. Several of the voters suggested this was actually a result of inserting the ballot too quickly, or not inserting the ballot straight into the machine. Finally, there was one error in which a printer ran out of toner. The TouchWriter machines did not encounter any errors. The TouchWriter ballot marking machines were tested next. Fifty ballots were marked and created on each TouchWriter machine, and then verified on a Reader, for a total of 500 ballots created and verified. No incidents were reported on the TouchWriter or Reader machines. Out of the 500 ballots generated on the TouchWriter machines, there were no ballot marks outside of the square, and all marks were as expected. After the test concluded, the Secretary of State verified the results of vote totals on the Scan machines by using a Count machine. The verification resulted in a 100% accuracy rate. Based on the fact that the TouchWriter performed with a 100% accuracy rate and the incidents and poll worker intervention rates were well below the 2% ballot rejection rate allowed by the California Voting System Standards, the Volume Test for the Scan precinct tabulator, the ballot marking functionality of the TouchWriter, and the verification functionality of the Reader device was deemed successful. Of the workers involved in the volume test, two were blind. After voting their ballots, they were given the accessibility survey to find out their impression of the machines. 5. Accessibility Test The Accessibility Test used the Presidential General Election as the basis for the election definition files. Accessibility Testing took place at the Sacramento Secretary of 19 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM State’s testing lab October 23, 2019, and in Austin Texas on October 30, 2019. The Secretary of State partnered with volunteers from the voters with disabilities communities to complete the heuristic evaluation of the accessibility features of the TouchWriter and Reader components, as well as to provide findings in this report. The Accessibility Test consisted of a TouchWriter, Reader, and Scan components. The machines were setup in voting stations, giving enough space in between to allow privacy. The voting station contained one TouchWriter component, one Reader component, one table, two chairs and a laptop or clipboard for note taking by Secretary of State Staff. The voters all used a common Scan component to simulate casting their ballot. Voters who were voting an Accessible Voting Session (AVS) had the ability to use any of the following components: the Audio Tactile Interface (ATI), lap pad, adaptive/paddle switches, headphones, or sip and puff device. The TouchWriter component has the capability to support voters with the following disabilities: Cognitive - ballot display via paper and large LCD screen; Perceptual and Partial Vision - ability to change screen color scheme, contrast, and font size; Low or No Vision - audio, tactile interface; Dexterity - integrated ballot marking machine that does not require the voter to manipulate the ballot, low force buttons for voter interface; Mobility –California Voting System Standards required reaches and wheelchair access, TouchWriter product requires voter to mark the ballot on the TouchWriter component, then go from the ballot marker to the Reader to verify, and then to the Scan component to cast their vote; Hearing - audio interface, same as for low/no vision; and Speech - no speech is required to operate the voting system. The Secretary of State tested the voting system for usability and accessibility with five volunteer voters from the general population with the various disabilities mentioned above. These volunteer voters were asked to vote at least one ballot each on the TouchWriter component. The Secretary of State also had the assistance of two SLI staff members who documented the test process and experience for each volunteer voter, and two Hart representatives, who acted as poll workers. The voters were trained by Hart personnel on the system and how to use the accessible features. The Secretary of State conducted an exit survey with the voters who participated in the Accessibility Test regarding their voting experience utilizing the TouchWriter and Reader machines. The majority of participants found that the voting system would allow them to vote privately and independently, that the voting instructions were clear and complete, the display was easy to read, the speech output was understandable, the 20 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM assistive machines were easy to reach and use, the system was not confusing to use, and that the time it took to vote was within their expected timeframe. The results are as follows: Verity Voting 3.1 Post Test Survey Agree Agree Disagree Disagree N/A or No Strongly Somewhat Somewhat Strongly Opinion The voting method was 3 1 1 private. I feel I can use this system 4 1 to vote independently. I am confident that my vote 4 1 was recorded accurately. The voting instructions were 5 clear and complete. The voting method was easy 4 1 to use. I could read the display 3 1 1 easily. I could understand the 4 1 speech output. The assistive device(s) were 4 1 easy to reach and use. I found the system confusing 1 2 2 to use. The timeframe it took to vote 4 1 was what I expected. The consensus of the volunteers was that they felt the technologies implemented for accessibility and usability improved the experience for voters that are most in need of them. From a privacy point of view, all volunteers seemed to feel that their privacy was kept intact and none expressed any issue or concern. 6. Security & Telecommunications Review The Security & Telecommunications Review took place at SLI between October 14, 2019, and November 4, 2019. During the Open-Ended Vulnerability Testing (OEVT) portion of the testing, issues were noted related to access control for desktop devices, passwords, ballot printer configuration and standalone desktop configurations. It should be noted that these issues do not directly affect the overall function of the voting system and could potentially be alleviated with manual processes and procedures. In many cases, the issues discovered were not related to public-facing voting system components and required elevated systems permissions for access or manipulation. It should also be noted that proper secure utilization of the voting system solution is reliant upon properly trained personnel, as well as following all processes and procedures set forth by the voting vendor to ensure properly configured and secured equipment for use in a live election environment. 21 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM SLI discovered seven low severity vulnerabilities: Verity polling place devices do not provide electronic monitoring of physical security (Table 1), The administrator password for the Desktop Environment is able to be changed (Table 2), The Windows desktop operating system administrative user had a blank password (Table 3), Security seals, locks, and security screws can be circumvented (Table 4), For all systems, all ports are enabled on the system (Table 5), The ballot printers all have default on board administrator credentials enabled (Table 6), and The ballot printer’s administrative menu has default credentials (Table 7). Table 1: Verity polling place devices do not provide electronic monitoring of physical security. Category Component SLI Comments Vendor Mitigation Verity polling place The exception is The vendor has Chapter 10 of the Use devices do not that the polling tamper evident Procedures provides provide electronic place device seals and lock/key security procedures monitoring of physical tablets require combinations to describing physical security, security. the case tablet prevent access controls, methods to locking unauthorized detect evidence of mechanism to be tampering, this tampering, and polling place engaged before vulnerability just and central office security. the device will indicates that there properly function. is no electronic monitoring of compartment access. Table 2: The ability to change the administrator password for the Desktop Environment. Category Component SLI Comments Vendor Mitigation The administrator Desktop COTS Mitigations would By California Use password for the computers. include setting the Procedures, physical Desktop password on the access to the workstations Environment is able system during are restricted to to be changed. deployment, authorized personnel. potentially looking The jurisdiction employs at the Verity shell vetting processes to launch timing. ensure that only trusted Controlling physical personnel are granted access to the server access if and only when by the jurisdiction needed. As noted, the 22 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM the low severity is attacker was not able to because of the use this situation to controlled access to circumvent access the desktop controls. machine, general public access is restricted, leaving only vendor / or insider threat vectors. Table 3: The Windows desktop operating system administrative user had a blank password. Category Component SLI Comments Vendor Mitigation The Windows All COTS Mitigations would By California Use desktop operating desktop include setting the Procedures, physical system administrative computers. password on the access to the workstations user had a blank system during are restricted to authorized password. deployment, personnel. The jurisdiction Potentially looking at employs vetting processes the Verity shell to ensure that only trusted launch timing. personnel are granted Controlling physical access if and only when access to the server needed. As noted, the by the jurisdiction attacker was not able to the low / medium use this situation to Severity is because circumvent access of the controlled controls. access to the desktop machine, general public access is restricted, leaving only Vendor / or insider threat vectors. Table 4: Security seals, locks, and security screws can be circumvented. Category Component SLI Comments Vendor Mitigation Security seals, locks, The vendor has Chapter 10 of the Use and security screws tamper evident seals Procedures provides can be circumvented. and lock/key security procedures combinations to describing physical prevent unauthorized security, access controls, tampering. methods to detect evidence of tampering, and polling 23 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM place and central office security. Table 5: For all systems, all ports are enabled on the system. Category Component SLI Comments Vendor Mitigation For all systems, all ports The ability to plug By California Use are enabled on the system. devices into the Procedures, physical device ports access to the workstations requires specially are restricted to made USB plugs or authorized personnel. are physically The jurisdiction employs secured behind vetting processes to locking ensure that only trusted compartments. personnel are granted Desktop equipment access if and only when has sufficient needed. As noted, the physical security attacker was not able to measures; however, exfiltrate or modify any all ports are data on the target system. available and enabled. Table 6: The Ballot printers all have default on board admin credentials enabled. Category Component SLI Comments Vendor Mitigation The Ballot printers all have Oki C831 and Change the Hart will create internal default on board admin Oki B432 default admin process to add a non- credentials enabled. printers. credentials on default admin password the printers. to the Oki C831 prior to shipment. Table 7: The ballot printer’s administrative menu has default credentials. Category Component SLI Comments Vendor Mitigation The ballot printer’s Oki B432 Change the Default password will be administrative menu has Printers. default admin changed on Oki B432 default credentials. credentials on printers prior to shipment. the Printers. 7. Software Review SLI conducted the Software Review between October 1, 2019, and October 5, 2019. Review of the code included: Adherence to the applicable standards in sections 5 and 7 of the CVSS. 24 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM Adherence to other applicable coding format conventions and standards including best practices for the coding language used. Analysis of the program logic and branching structure. Evaluate whether the system is designed in a way that allows meaningful analysis, including: o Whether the architecture and code are amenable to an external review. o Whether code analysis tools can be usefully applied. o Whether the code complexity is at a level that obfuscates its logic. Security considerations reviewed against the code base included: Search for exposures to commonly exploited vulnerabilities. Evaluate the use and correct implementation of cryptography and key management. Analysis of error and exception handling. Evaluate the likelihood of security failures being detected: o Evaluate whether audit mechanisms are reliable and tamper resistant. o Evaluate whether data that might be subject to tampering is properly validated and authenticated. Evaluate the risk that a user can escalate his or her capabilities beyond those authorized. Evaluate the design and implementation to ensure that sound, generally accepted engineering practices are followed, checking to verify that code is defensively written against: o Bad data. o Errors in other modules. o Changes in environment. o User errors. o Other adverse conditions. Evaluate for embedded, exploitable code (such as “Easter eggs”) that can be triggered to affect the system. Evaluate the code for dynamic memory access features which would permit the replacement of certificated executable code or control data or insertion of exploitable code or data. Evaluate the code for use of runtime scripts, instructions, or other control data that can affect the operation of security relevant functions or the integrity of the data. No source code requirements were found to be an issue within the Verity source code base reviewed; as a result, no discrepancies were written against the code base. 25 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM No vulnerabilities were found to be an issue within the Verity source code base reviewed; as a result, no findings were written against the code base. IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS A. Elections Code Requirements Six sections of the California Elections Code, Sections 19101, 19203, 19204, 19204.5, 19205, and 19270, describe in detail the requirements any voting system must meet in order to be approved for use in California elections. These sections are described in detail and analyzed for compliance below. 1) §19101 (b) (1): The machine or device and its software shall be suitable for the purpose for which it is intended. The system meets this requirement. 2) §19101 (b) (2): The system shall preserve the secrecy of the ballot. The system meets this requirement. 3) §19101 (b) (3): The system shall be safe from fraud or manipulation. The system meets this requirement. 4) §19101 (b) (4): The system shall be accessible to voters with disabilities pursuant to section 19242 and applicable federal laws. The system meets this requirement. 5) §19101 (b) (5): The system shall be accessible to voters who require assistance in a language other than English if the language is one in which a ballot or ballot materials are required to be made available to voters pursuant to Section 14201 and applicable federal laws. The system meets this requirement. 6) §19203: The system shall use ballot paper that is of sufficient quality that it maintains its integrity and readability throughout the retention period specified in sections 1700 through 17306. The system meets this requirement. 26 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM 7) §19204: The system shall not include procedures that allow a voter to produce, and leave the polling place with, a copy or facsimile of the ballot cast by that voter at that polling place. The system meets this requirement. 8) §19205 (a): No part of the voting system shall be connected to the internet at any time. The system meets this requirement. 9) §19205 (b): No part of the voting system shall electronically receive or transmit election data through an exterior communication network, including the public telephone system, if the communication originates from or terminates at a polling place, satellite location, or counting center. The system meets this requirement. 10) §19205 (c): No part of the voting system shall receive or transmit wireless communications or wireless data transfers. The system meets this requirement. 11) §19270 (a): The Secretary of State shall not certify or conditionally approve a direct recording electronic voting system unless the system includes an accessible voter verified paper audit trail. The system meets this requirement. B. Elections Code Review 1) §305.5(b): A paper cast vote record is a ballot only if the paper cast vote record is generated on a voting device or machine that complies with ballot layout requirements and is tabulated by a separate device from the device that created the paper cast vote record. The system meets this requirement. 2) §15360: During the official canvass of every election in which a voting system is used, the official conducting the election shall conduct a public manual tally of the ballots tabulated by those devices cast in one percent of the precincts chosen at random by the elections official. If one percent of the precincts should be less than one whole precinct, the tally shall be conducted in one precinct chosen at random by the elections official. 27 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM In addition to the one percent count, the elections official shall, for each race not included in the initial group of precincts, count one additional precinct. The manual tally shall apply only to the race not previously counted. The system supports this requirement. 3) §19300: A voting machine shall, except at a direct primary election or any election at which a candidate for voter-nominated office is to appear on the ballot, permit the voter to vote for all the candidates of one party or in part for the candidates of one party and in part for the candidates of one or more other parties. The system meets this requirement. 4) §19301: A voting machine shall provide in the general election for grouping under the name of the office to be voted on, all the candidates for the office with the designation of the parties, if any, by which they were respectively nominated. The designation may be by usual or reasonable abbreviation of party names. The system meets this requirement. 5) §19302: The labels on voting machines and the way in which candidates’ names are grouped shall conform as nearly as possible to the form of ballot provided for in elections where voting machines are not used. The system meets this requirement. 6) §19303: If the voting machine is so constructed that a voter can cast a vote in part for presidential electors of one party and in part for those of one or more other parties or those not nominated by any party, it may also be provided with: (a) one device for each party for voting for all the presidential electors of that party by one operation, (b) a ballot label therefore containing only the words “presidential electors” preceded by the name of the party and followed by the names of its candidates for the offices of President and Vice President, and (c) a registering device therefore which shall register the vote cast for the electors when thus voted collectively. If a voting machine is so constructed that a voter can cast a vote in part for delegates to a national party convention of one party and in part for those of one or more other parties or those not nominated by any party, it may be provided with one device for each party for voting by one operation for each group of candidates to national conventions that may be voted for as a group according to the law governing presidential primaries. No straight party voting device shall be used except for delegates to a national convention or for presidential electors. The system meets this requirement. 28 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM 7) §19304: A write-in ballot shall be cast in its appropriate place on the machine, or it shall be void and not counted. The system supports this requirement. 8) §19320: Before preparing a voting machine for any general election, the elections official shall mail written notice to the chairperson of the county central committee of at least two of the principal political parties, stating the time and place where machines will be prepared. At the specified time, one representative of each of the political parties shall be afforded an opportunity to see that the machines are in proper condition for use in the election. The party representatives shall be sworn to perform faithfully their duties but shall not interfere with the officials or assume any of their duties. When a machine has been so examined by the representatives, it shall be sealed with a numbered metal seal. The representatives shall certify to the number of the machines, whether all of the counters are set at zero (000), and the number registered on the protective counter and on the seal. The system supports this requirement. 9) §19321: The elections official shall affix ballot labels to the machines to correspond with the sample ballot for the election. He or she shall employ competent persons to assist him or her in affixing the labels and in putting the machines in order. Each machine shall be tested to ascertain whether it is operating properly. The system supports this requirement. 10) §19322: When a voting machine has been properly prepared for an election, it shall be locked against voting and sealed. After that initial preparation, a member of the precinct board or some duly authorized person, other than the one preparing the machines, shall inspect each machine and submit a written report. The report shall note the following: (1) Whether all of the registering counters are set at zero (000), (2) whether the machine is arranged in all respects in good order for the election, (3) whether the machine is locked, (4) the number on the protective counter, (5) the number on the seal. The keys shall be delivered to the election board together with a copy of the written report, made on the proper blanks, stating that the machine is in every way properly prepared for the election. The system supports this requirement. 11) §19340: Any member of a precinct board who has not previously attended a training class in the use of the voting machines and the duties of a board member shall be required to do so, unless appointed to fill an emergency vacancy. 29 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM The system does not adversely impact this requirement. 12) §19341: The precinct board shall consist of one inspector and two judges who shall be appointed and compensated pursuant to the general election laws. One additional inspector or judge shall be appointed for each additional voting machine used in the polling place. The system does not adversely impact this requirement. 13) §19360: Before unsealing the envelope containing the keys and opening the doors concealing the counters the precinct board shall determine that the number on the seal on the machine and the number registered on the protective counter correspond to the numbers on the envelope. Each member of the precinct board shall then carefully examine the counters to see that each registers zero (000). If the machine is provided with embossing, printing, or photography devices that record the readings of the counters the board shall, instead of opening the counter compartment, cause a “before election proof sheet” to be produced and determined by it that all counters register zero (000). If any discrepancy is found in the numbers registered on the counters or the “before election proof sheet” the precinct board shall make, sign, and post a written statement attesting to this fact. In filling out the statement of return of votes cast, the precinct board shall subtract any number shown on the counter from the number shown on the counter at the close of the polls. The system supports this requirement. 14) §19361: The keys to the voting machines shall be delivered to the precinct board no later than twelve hours before the opening of the polls. They shall be in an envelope upon which is written the designation and location of the election precinct, the number of the voting machine, the number on the seal, and the number registered on the protective counter. The precinct board member receiving the key shall sign a receipt. The envelope shall not be opened until at least two members of the precinct board are present to determine that the envelope has not been opened. At the close of the polls the keys shall be placed in the envelope supplied by the official and the number of the machine, the number written on the envelope. The system supports this requirement. 15) §19362: The exterior of the voting machine and every part of the polling place shall be in plain view of the election precinct board and the poll watchers. Each machine shall be at least four feet from the poll clerk’s table. The system supports this requirement. 30 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM C. Review of Federal Statutes or Regulations. 1) The Voting Rights Act (VRA) of 1965, as amended (42 U.S.C. 1973), requires all elections in certain covered jurisdictions to provide registration and voting materials and oral assistance in the language of a qualified language minority group in addition to English. Currently in California, there are ten VRA languages (English, Spanish, Chinese, Hindi, Japanese, Khmer, Korean, Tagalog, Thai, and Vietnamese) as prescribed under the law. The system meets this requirement. The system’s paper ballots can be easily printed in these languages, as well as others. 2) The National Voter Registration Act of 1993 (42 U.S.C. 1973gg and 11 CFR 8) allows for the casting of provisional ballots through Fail-Safe Voting procedures. The system meets this requirement. Provisional ballots can be cast with this system. 3) The Voting Accessibility for the Elderly and Handicapped Act of 1984 (42 U.S.C. 1973ee through 1973ee-6) requires each political subdivision conducting elections within each state to assure that all polling places for federal elections are accessible to elderly and handicapped voters, except in the case of an emergency as determined by the state’s chief election officer or unless the state’s chief election officer: (1) determines, by surveying all potential polling places, that no such place in the area is accessible or can be made temporarily accessible, and (2) assures that any handicapped voter assigned to an inaccessible polling place will, upon advance request under established state procedures, either be assigned to an accessible polling place or be provided an alternative means of casting a ballot on election day. This system supports this requirement. 4) The Retention of Voting Documentation (42 U.S.C. 1974 through 1974e) statute applies in all jurisdictions and to all elections in which a federal candidate is on a ballot. It requires elections officials to preserve for twenty two months all records and papers which came into their possession relating to an application, registration, payment of a poll tax, or other act requisite to voting. Note: The US Department of Justice considers this law to cover all voter registration records, all poll lists and similar documents reflecting the identity of voters casting ballots at the polls, all applications for absentee ballots, all envelopes in which absentee ballots are returned for tabulation, all documents containing oaths of voters, all documents relating to challenges to voters or absentee ballots, all tally sheets and canvass reports, all records reflecting the appointment of persons entitled to act as poll officials or poll watchers, and all computer programs used to tabulate votes electronically. In addition, it is the Department of Justice’s view that the 31 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM phrase “other act requisite to voting” requires the retention of the ballots themselves, at least in those jurisdictions where a voter’s electoral preference is manifested by marking a piece of paper or by punching holes in a computer card. The system meets this requirement. All votes in this system are recorded on paper ballots that can be retained. D. Help America Vote Act (HAVA) Requirements The Help America Vote Act (HAVA) §301(a) mandates several requirements for voting systems, including: 1) The ability to verify the vote choices on the ballot before that ballot is cast and counted, 2) Notification to the voter of over-votes on a ballot, 3) Auditability with a permanent paper record of votes cast, d) Accessibility for individuals with disabilities, including nonvisual accessibility for the blind and visually impaired, in a manner that provides the same opportunity for access and participation (including privacy and independence) This system supports these requirements in the following manner: i. The paper ballots themselves lend themselves to visual inspection and verification. ii. The Verity TouchWriter provides its users with a ballot review screen prior to printing the ballot. Further, any voted ballot can be inserted into Verity Reader for review and verification. iii. The Verity TouchWriter will prevent over-voting a contest. iv. Because all ballots in this system are paper based, there is a fully auditable and permanent record of the election. v. Deployment of the Verity TouchWriter and Verity Reader in a precinct provides accessibility for persons with disabilities at the polling place. V. CONCLUSION The Hart Verity Voting 3.1 voting system, in the configurations tested and documented by the Verity Voting 3.1 Installation and Use Procedures, meets applicable California Voting System Standards and Elections Code requirements. 32 | P a ge SECRETARY OF STATE’S STAFF REPORT- HART VERITY VOTING 3.1 VOTING SYSTEM