OVSTA
Use Procedures
VSAP Tally Version 2.0
Read the report at Los Angeles County VSAP ↗
[Document subtitle]
Use Procedures
VSAP-UPM-001
Version 6
January 31, 2020
[DATE]
[COMPANY NAME]
[Company address]
Document Revision History
Date Version Section/Page Update Description
06/03/2019 1 Document Initial Publication
07/15/2019 2 Document Miscellaneous updates.
10/14/2019 3 Document Miscellaneous updates.
11/2/2019 4 Document Miscellaneous updates.
12/2/2019 5 Document Miscellaneous updates.
1/31/2020 6 Chapter 5 and Updated security procedures.
chapter 10.4
1
Contents
1. Introduction ................................................................................................................................. 5
1.1 System Components: Definitions and Descriptions ............................................................. 9
1.1.1 Functional Components ............................................................................................... 10
1.1.2 Ballot Marking Device Manager (BMG) Functional Components ............................. 11
1.1.3 Electronic Signing Authority (ESA) Functional Components ..................................... 12
1.1.4 Interactive Sample Ballot (ISB) Functional Components ........................................... 13
1.1.5 Tally Functional Components ...................................................................................... 14
1.1.6 VSAP Ballot Layout Functional Components ............................................................. 15
2 Ballot Definition ........................................................................................................................ 17
2.1 Overview Procedures to Operate Voter Ballot Layout ....................................................... 17
2.2 Paper and Printing Specifications ....................................................................................... 17
2.2.1 Specifications for Thermal Paper (BMD) .................................................................... 17
2.2.2 Specifications for Tally ................................................................................................ 25
2.3 Layout Requirements and Specifications ............................................................................ 25
3. System Installation and Configuration...................................................................................... 26
3.1. Hardware Requirements and Specifications ...................................................................... 26
3.2 Hardware and Network Setup and Configuration ............................................................... 28
3.3 Software Installation and Configuration ............................................................................. 29
3.4 Acceptance Testing ............................................................................................................. 30
3.5 Software and Firmware Upgrades ...................................................................................... 43
4. Election Setup and Definition ................................................................................................... 44
4.1 Programming and Configuration of Election Management System/Software ................... 44
4.2 Programming and Configuration of Vote Recording Tabulation Device- ......................... 48
General Prerequisites ............................................................................................................ 48
Preparing Tally Nodes .......................................................................................................... 56
Getting Nodes Ready for the Main Installer ......................................................................... 57
Main Installer ........................................................................................................................ 58
Starting Tally ........................................................................................................................ 60
Viewing Tally ....................................................................................................................... 61
Stopping Tally ....................................................................................................................... 61
Other Helpful Commands ..................................................................................................... 61
4.3 System Diagnostic Testing Procedures ................................................................................... 63
4.4 System Proofing ...................................................................................................................... 65
4.5.1 Generate VBM Logic and Accuracy (L&A) Decks ............................................................ 70
4.5.2 Generate BMD Logic and Accuracy (L&A) Poll Passes -Version 5 ................................... 71
2
4.5.3 Lab Test Mode ..................................................................................................................... 72
4.5.3.1 Results ............................................................................................................................... 75
4.5.4 Remake Mode ...................................................................................................................... 76
4.5.5 Activating the Remake Mode on the BMD ......................................................................... 76
4.5.6 Multiple Elections ................................................................................................................ 82
4.6 Ballot Tally Programs ............................................................................................................. 83
Purpose ...................................................................................................................................... 83
Process ...................................................................................................................................... 83
4.7 Election Observer Panel .......................................................................................................... 84
4.8 Hardware Maintenance and Preparation for Use .................................................................... 85
Preventative Maintenance Schedule By System ....................................................................... 86
5. Polling Place Procedures........................................................................................................... 89
5.1 Voting Center Supplies, Delivery, and Inspection .............................................................. 89
5.2 Vote Center Set-up .............................................................................................................. 90
5.2.1 Cleaning the BMD Scanner and Touchscreen ........................................................... 105
5.3 Opening the Polls .............................................................................................................. 113
5.4 Polling Procedures ............................................................................................................ 120
5.4.1 Voting Using the BMD Touchscreen ........................................................................ 120
5.4.2 Using a Poll Pass ........................................................................................................ 129
5.4.3 Emptying the Ballot Box During the Day.................................................................. 132
5.4.4 Restarting BMD After Interruption ........................................................................... 139
5.4.5 Dealing with Fleeing Voters ...................................................................................... 141
5.5 Voters with Disabilities and Voters using Audio Features ............................................... 142
5.5.1 Auxiliary Device and Ports ........................................................................................ 142
5.6 Provisional Voters ............................................................................................................. 144
5.7 Closing the Polls and Vote Reporting ............................................................................... 145
5.8 Securing Audit Logs and Backup Records ....................................................................... 152
5.9 Troubleshooting and Problem Resolution ........................................................................ 153
6. Absentee/Mail Ballot Procedures ........................................................................................... 165
6.1 System Startup and Pre-Tabulation Report Procedures .................................................... 165
6.2 Tabulation Procedures ...................................................................................................... 167
6.2.1 To generate a report: .................................................................................................. 168
6.2.2 To generate a final report: .......................................................................................... 168
6.3 Post-Tabulation Report and Shutdown Procedures .......................................................... 168
7. Semi-Official Canvass ............................................................................................................ 170
Purpose .................................................................................................................................... 170
7.1 System start-up and pre-tabulation reports ....................................................................... 170
3
7.2 Processing vote reports ..................................................................................................... 171
7.3 Integration with other systems and Calvoter .................................................................... 172
Calvoter ............................................................................................................................... 173
8.0 Official Canvass and Post-Election Procedures ............................................................... 174
8.1 Election Observer Panel ........................................................................................................ 174
8.2 Canvassing Precinct Returns ................................................................................................. 176
8.3 Canvassing Absentee Ballots ................................................................................................ 177
8.4 Canvassing Provisional Ballots............................................................................................. 183
8.5 Canvassing Write-in Votes ................................................................................................... 185
8.6 1% Manual Tally Procedures ................................................................................................ 187
8.7 Handling Ballot Exceptions .................................................................................................. 189
8.8 Post-Election Logic and Accuracy Testing ........................................................................... 190
8.9 Final Reporting of Official Canvass ..................................................................................... 193
8.10 Backup and Retention of Election Material ........................................................................ 195
9. Manual Recount Procedures ................................................................................................... 198
10. Security ................................................................................................................................ 199
10.1 Physical Security of System and Components................................................................ 199
10.2 Logical Security of System and Components ................................................................. 201
10.2.1 Essential and Non-Essential Services and Ports ...................................................... 201
10.2.2 User-Level Security ................................................................................................. 202
10.2.3 Anti-Virus Protection ............................................................................................... 202
10.2.4 Verifying, Checking, and Installing Essential Updates and Changes ...................... 203
10.3 Security Procedures for the BMD Warehouse ................................................................ 207
10.4 Security Procedures for Vote Center .............................................................................. 212
10.5 Audit Trails ......................................................................................................................... 213
11. Biennial Hardware Certification and Notification ................................................................ 215
Notification of Equipment ...................................................................................................... 215
4
1. Introduction
The VSAP voting system allows voters in Los Angeles County to engage in elections using
interactive technology, mobile devices, touchscreen interfaces, QR code readers, and application-
based candidate selection. The system is comprised of six core components: Ballot Marking
Device (BMD), BMD Manager (BMG), Enterprise Signing Authority (ESA), Interactive
Sample Ballot (ISB), Tally, and VSAP Ballot Layout (VBL).
Figure 1 VSAP components
Ballot Marking Device
The BMD is the primary touchpoint for the voter and hub of the voting system, guiding users
with screen prompts and symbols. The BMD features a touchscreen, an audio and tactile
controller, and dual-switch input that voters use to generate, verify, and cast a paper ballot.
Completed ballots are transferred to the Integrated Ballot Box, which can be detached for
unloading. Through the BMD, voters participate in elections in Los Angeles County.
5
Figure 2. BMD
Ballot Marking Device Manager
The BMG manages and maintains the BMDs. It allows operators to manage software,
configurations, and data. The BMG provides files necessary for BMDs to present election data
such as candidate information, multi-lingual audio, and supporting text. The BMG is the
manager and custodian of the voting system.
Figure 3. BMG
6
Enterprise Signing Authority
The ESA establishes the security root and chain of trust for the VSAP voting solution. This
subsystem comprises the following processes: key management, distribution, and authentication.
The ESA uses a cryptographic module to generate a public/private key pair, which authenticates
devices and transactions. The ESA is the basis of the authorization, authentication, and data
integrity for the voting system.
Figure 4. ESA
Interactive Sample Ballot
7
The ISB is a web-based application that allows voters to pre-mark their selections on a sample
ballot, either on their desktop or mobile device, prior to formally voting at a vote center. The ISB
generates a Quick Response (QR) code called a Poll Pass, which pre-populates selections in the
BMD. The ISB also supports Remote Accessible Vote by Mail (RAVBM) and the Overseas
Citizens Absentee Voting Act (UOCAVA). The ISB is what voters use when they interact with
the system on their computers or mobile devices.
Figure 5. ISB
Tally
Tally captures and processes ballot images to digitally count voter selections from paper ballots.
Tally scans and creates images of ballots, converts the images into Cast Vote Records (CVRs),
tabulates them, and allows the election results to be exported. Tally is responsible for counting
votes at the end of an election.
Figure 6. Tally
8
VSAP Ballot Layout
The VBL enables election managers to configure and generate ballot layouts. The VBL
subsystem ingests election information files and generates ballot layout files to be used by other
components of the system. The VBL makes setting up elections possible.
Figure 7. VBL
1.1 System Components: Definitions and Descriptions
9
1.1.1 Functional Components
Figure 1. VSAP functional components
Each subsystem of the VSAP system is described at a high level in the following table:
Table 1. VSAP functional subsystems
# Subsystem Description
The BMD is the primary touchpoint for the voter and the hub of the
voting system. It includes a tablet touchscreen interface and several
1 BMD
hardware peripherals supporting manual interaction, scanning, and
printing capabilities.
The BMG allows operators to manage the software, configurations, and
data on the BMDs. Although some diagnostics require manual
2 BMG intervention (e.g., scanner and printer diagnostics, which require paper),
the BMG performs automated diagnostics on the BMD without physical
access.
The Enterprise Signing Authority (ESA) is a cryptographic module
used to ensure each component of the VSAP system is conforming to
3 ESA
security standards and to validate the data passed to components are
secure and authenticated.
The ISB is a digital version of the sample ballot. It is accessible as a
web application that permits prospective voters to review election
4 ISB
material and pre-mark their selections on their desktop or mobile
device.
The Tally system is responsible for capturing and processing ballot
5 Tally images so that voter selections originating from paper ballots are
digitally represented and counted.
10
# Subsystem Description
The VBL defines the ballot print formats for BMD, VBM, RAVBM
6 VBL and UOCAVA ballots, and generates data files and packages necessary
to configure the BMD, BMG, ISB, and Tally.
1.1.2 Ballot Marking Device Manager (BMG) Functional
Components
Figure 2. BMG functional components
The BMD Manager (BMG) manages and maintains the BMDs and allows operators to manage
software, configurations, and data.
The BMG loads the operating system and the voting application onto the BMDs and conducts
system verification. The BMG maintains the location information of the BMDs connected to the
BMG network. Processes and interactions are logged. Additionally, the BMG also runs
automated diagnostics of the BMDs.
Pre-election, the BMG uploads election data into its repository. The election data can then be
loaded onto the BMDs that will be provisioned for an election. Post-election, the BMG
downloads the public key files and the log files from the BMDs.
Each function of the BMG system is described at a high level in the following table:
Table 3. BMG functional components
# Function Name Description
Initially, the BMG loads the operating system and BMD
Configure the
1 applications onto the BMDs. The BMG loads election data and
BMDs
configuration data onto the BMDs prior to an election.
Inventory and The BMG identifies the warehouse locations of the BMDs when
2
Location they are attached to the BMG network.
11
# Function Name Description
3 Event logging The BMG logs processes and interactions.
Retrieve Election Following an election, the BMG retrieves election logs,
4
Data interaction logs, and the security keys from the BMDs.
1.1.3 Electronic Signing Authority (ESA) Functional Components
Figure 3. ESA functional components
The Enterprise Signing Authority (ESA) subsystem is a cryptographic module used to ensure
each component of the VSAP system is conforming to security standards and to help ensure that
the data being passed to components are secure and authenticated. The ESA creates a “security
world” in the Hardware Security Module (HSM). The ESA sets up sets of operator cards to
manage security keys. The ESA provision Certificate Authorities to establish the security root
and chain of trust using a cryptographic module to generate a public/private key pair. Once this
process is completed, the ESA generates public/private export key pairs for each component
(VBL, ISB, BMG, Tally and the Trusted Environment), encrypts each key with its private key,
and exports the keys for use in their target servers.
Each function of the ESA system is described at a high level in the following table:
Table 4. ESA functional components
# Function Name Description
Create secure
1 The ESA creates a security world and operator cards.
environment
Provision Certificate
2 The ESA creates a single root CA key and intermediate CA keys.
Authorities
12
# Function Name Description
Generate and Export The ESA creates server keys that are exported to target servers in
3
Keys an encrypted state.
1.1.4 Interactive Sample Ballot (ISB) Functional Components
Figure 12. Interactive Sample Ballot functional components
The Interactive Sample Ballot (ISB) is a software application that allows voters to review and
mark their sample ballots, either on their desktop or mobile device, prior to voting at a vote
center. The preprocessor takes the input files and generates data packages optimized for the ISB
client application. A map assembles the data about precincts, ballot styles, and parties to
associate the voter with the appropriate precinct and identify ballot style. The Voter Selection
Manager tracks voter selections and enforces legal and business rules.
To set up the ISB session, the voter enters either their voter information (last name, date of birth,
house number), or address only lookup, allowing the client application to identify the correct
precinct and display the appropriate ballot. The voter marks their selections on the sample ballot
on their mobile device or personal computer, then reviews their selections. The ISB generates a
Poll Pass, which is a QR code representing the selected information. Voter selections can be
saved locally on their mobile device for use at the Vote Center to populate their selections onto
the BMD via the Poll Pass.
The ISB also enables Remote Accessible Vote by Mail (RAVBM) and Uniformed and Overseas
Citizens Absentee Voting Act (UOCAVA).
Each function of the ISB system is described at a high level in the following table:
Table 5. ISB functional components
# Function Name Description
Generate data packages for the ISB client application, map
1 Build sample ballots
precincts to ballot styles, publish ballot files.
13
# Function Name Description
The ISB identifies and retrieves the appropriate ballot based on
2 Identify Ballot
voter information and location.
Present Sample
3 The ISB displays the sample ballot to the voter
Ballot
4 Mark Sample Ballot The voter marks their selections on the sample ballot.
The ISB generates a QR code with the information about the
5 Generate Poll Pass election, ballot style, and precinct, as well as codes
corresponding to the voter selections.
1.1.5 Tally Functional Components
Figure 4. Tally functional components
The Tally system is responsible for capturing and processing ballot images so that voter
selections from paper ballots (including BMD, VBM, RAVBM and UOCAVA ballots) may be
digitally counted. There are, from the perspective of the software system architecture, four main
Tally processes: (1) Ballots are scanned and images captured; (2) ballot images are converted
into Cast Vote Records (CVRs); (3) CVRs are tabulated; and (4) Tabulated results are exported
for reporting and auditing.
Each function of the Tally system is described at a high level in the following table:
Table 6. Tally functional components
14
# Function Name Description
The scanning process captures a digital image of each paper
1 Scan
ballot.
2 Process ballots Tally processes the ballots to decode voter intent
Generate Ballot The processed ballot data is saved as a tabulation-ready record in
3
Record the database.
Records in Tally database are refined and counted to determine
5 Tabulate
election results.
The raw vote data produced by the tabulator is copied to an
6 Report data
external database used by an external reporting system.
1.1.6 VSAP Ballot Layout Functional Components
Figure 5. VBL functional components
The VSAP Ballot Layout is an application that enables election managers to configure and
generate ballot layouts.
The VBL application supports the logical layout and production of VBM Ballots and election
files. These output files provide the rest of VSAP with a definition of the election and ballot
layout information. The Auth Service is a standalone authentication service used to manage
users, roles, and permissions. The log viewer provides a primary location that consolidates
records of critical issues, errors, warnings and other information.
Each function of the VBL system is described at a high level in the following table:
Table 7. VBL functional components
# Function Name Description
Generate Ballot The VBL application produces the ballots and election
1
Layout configuration files (aka configuration files).
15
# Function Name Description
2 Logs Events executed by VBL are captured and available for review.
Export Ballot
3 The Ballot Layout is exported to receiving subsystems.
Layout
16
2 Ballot Definition
2.1 Overview Procedures to Operate Voter Ballot Layout
See the VSAP Ballot Layout User Guide for instructions on how to configure and generate ballot
layouts.
2.2 Paper and Printing Specifications
2.2.1 Specifications for Thermal Paper (BMD)
This section provides specific information about thermal paper.
Use the specifications below for thermal Paper Grades, Substance GSM and Caliper MM.
17
18
19
20
21
22
23
24
2.2.2 Specifications for Tally
Before beginning the system setup for tally, there are two basic setups required:
1. Single Node
2. Two Node.
Single Node
The first required setup is Single Node deployment. The Single Node has two machines, one
with a file system and the other is a machine comprised with Tally Node of services, Cassandra
database and Kafka. Kafka is used for building real-time data pipelines and streaming
applications.
Two Node
The second setup requirement is a Two Node deployment, which has three machines:
1. File System - two machines comprising the Tally Node
2. Services
3. Cassandra database (and Kafka)
2.3 Layout Requirements and Specifications
Ballot Layout Specifications
See Section 15 of VSAP Ballot Layout User Guide for ballot layout specifications.
25
3. System Installation and Configuration
3.1. Hardware Requirements and Specifications
Purpose
This document details the hardware components that come with each aspect of the VSAP
system, as well as any additional hardware needed.
BMG Hardware Requirements
The following are the components needed to set up the BMG computer and server cluster:
• Server(s)
• PC that is completely free of any files, programs, or operating systems
• ESXi operating system, verified by County officials
• Software provided by Smartmatic, reviewed by County
• Trusted DVDs provided by State
BMD Hardware Requirements
BMD Components shows the systems that comprise the BMD
• Ballot Control System
• Scan Ballot Activation Mechanism (BAM)
• Print ballot with QR for selection (SBE)
• Scan ballot
• Integrated Ballot Box (IBB)
• Application Control System
• Render User Interface
• Make Selection
• Review
• Scan ISB
• Admin Console
The BMD application has three layers:
1. Presentation Layer (React.js runs on Electron)
2. Application Layer (Node.js modules in Electron)
3. OS Layer (Linux with device drivers)
BMD Modularity
During the design phase the following major modules were identified:
• Top module: Includes 8 electronics boards, plastic parts/metal parts, cables, and hinges
• Bottom module: Includes 4 electronic boards, printer/scanner (for paper handling),
speaker, plastic parts and cables
26
• LCD module: Includes LCD display, touch panel, plastic/metal parts, and cables
• Keypad module: Contains 1 electronic board, plastic part, and cables
• BCR module: Barcode reader, metal parts
• Ballot Box module: Plastic parts
• Privacy Flaps: Foam with PU Microfiber Backer/Microfiber Melange
• Legs
BMD Controller Devices
The BMD has three controller devices:
• Touch Screen
• Handheld Controller
• Dual Switch
Tally Hardware Requirements
See Tally Build/Installation User Guide.
VBL Hardware Requirements
See VBL Build/Installation User Guide.
27
3.2 Hardware and Network Setup and Configuration
Purpose
This document details the configuration and setup of each component of the VSAP voting
system. See the sections below to learn how to set up the different components.
BMG Hardware Installation
See the BMG/BMD Build/Installation User Guide.
BMD Software Installation
See BMG User Guide for instructions on loading initial software onto BMDs in preparation for
an election.
Tally
See Tally Build/Installation User Guide for software installation and configuration procedures.
VBL
See VBL Build/Installation User Guide.
28
3.3 Software Installation and Configuration
Purpose
Setup guides listed below detail step-by-step procedures for installing and configuring software
on each VSAP component.
BMG
See BMG/BMD Installation Guide.
BMD
See BMG User Guide for initial file uploads to BMDs.
ISB
See ISB Installation Guide.
Tally
See Tally Build/Installation User Guide.
VBL
See VBL Build/Installation User Guide.
29
3.4 Acceptance Testing
Purpose
The VSAP components must be tested for acceptance through the successful running of the tests
specified in the System Test Specification documents. For each component, those documents
which detail the tests required to successfully authenticate their acceptance and readiness for use
are referenced here.
Tally
See the Tally Installation User Guide.
BMG, BMD, & ISB
References
Document Description Owner Location
California Describes the
California https://admin.cdn.sos.ca.gov/
Voting System requirements for the
Secretary of regulations/elections/ california-
Standards electronic components
State voting-system-standards.pdf
(CVSS) of voting systems.
Voting
VSAP-TDP- Acronyms and Within the TDP documentation
Systems for
011 Definitions package
All People
System Test and
Voting
VSAP-TDP- Verification Within the TDP documentation
Systems for
006-C Specification package
all People
Conformity Matrix
30
Abstract
The System Test and Verification Specification document describes the system test and
verification specifications of the Voting Solutions for All People (VSAP) voting system.
Purpose
This document enables the State-Approved Testing Agency (S-ATA) to identify system test and
verification specifications, as well as related descriptions, drawings, and diagrams. It is meant to
satisfy §9.7 System Test and Verification Specification of the California Voting System
Standards (CVSS), October 2014.h1.System Test and Verification Specification
Development Test Specifications
See attachments:
• BMD Test Plan
• BMG Test Plan
• ESA Test Plan
• ISB Test Plan
• VBL and Tally Test Plan
Logic Correctness, Data Quality, and Security
See attachments:
• BMD Test Plan
• BMD Test Cases
• BMG Test Plan
• BMG Test Cases
• ESA Test Plan
• ESA Test Cases
• ISB Test Plan
• ISB Test Cases
• VBL and Tally Test Plan
• Tally Test Cases
• VBL Test Cases
Test Identification and Design
See attachments:
• BMD Test Cases
• BMG Test Cases
• ESA Test Cases
• ISB Test Cases
• Tally Test Cases
• VBL Test Cases
Table 1. General test description
31
Sequence or
Test Structure Conditions
Progression
Metrics are
Tests written prior to collected and
code. reported at the end
Unit testing isolates the
All unit tests are run of every sprint. At
smallest testable parts of a
against the build. the project level,
Unit testing build. Testing is
All tests need to pass the metrics are
performed on each module
before quality assurance used to identify
or block of code.
testing. areas of
improvement and
address them.
Unit tests for code low-
level modules (can
overlap with engineering
unit testing).
Metrics are
Integration testing with
collected and
other products.
reported at the end
End-to-end functional
of every sprint. At
testing for the overall
the project level,
solution, including input
the metrics are
Functional testing checks from stakeholders.
used to identify
all documented User experience testing
areas of
functions/requirements of by community
improvement
the application/product. stakeholders. A selection
and address them.
Functional testing is of people from different
Functional testing Some of the
conducted by feeding parts of the community
metrics gathered
inputs and validating will document all issues
are code coverage
expected outputs against found and will convert
for unit tests,
observed outputs from the the issues to "defects."
velocity,
application. Testing will be
burndown, test
conducted at the end of
progress per
Engineering Verification
sprint, and
Testing (EVT),
functional
Development
breakdown of
Verification Testing
defects.
(DVT), and Production
Verification Testing
(PVT).
32
The tests follow the
general assumptions for
functional tests. The
testers validate the input Metrics are
and output of each test collected on an
and make sure they align ongoing basis and
with the reported at the end
requirements/stories. The of every sprint.
tests cover software, They include
hardware, and any files defect and sprint
consumed. summary reports
Non-functional tests like with test/pass
performance, numbers. At the
compliance, project level, the
accessibility, security, metrics are used to
System integration tests and design validation are identify areas of
are performed on all also performed at this improvement; they
components. The test level. All issues are are also discussed
cases will incorporate test reported in Jira as during the sprint
scenarios that confirm defects. Performance retrospective
System testing
continuity and accuracy tests in this context meeting with
across modules and include scenarios like action items for
accommodate testing of average response time on the following
files produced by or for the Get and Post APIs. sprint. Metrics
external systems. Security tests at this level gathered at the
will be, for example, project level are
secure communication code coverage for
between the different unit tests, velocity
modules. and burndown
Smoke tests are a charts, and defects
predefined set of tests found by severity.
that touch critical Additional metrics
features of the system. can be considered
When a new build is if they help the
delivered to the test team with
team, smoke testing can continuous
quickly give feedback to improvement.
the testers on the status
of the build.
33
Metrics are
collected and
reported at the end
Verify the functional of every sprint. At
aspects of the integrated the project level,
Integration test activities
system including the metrics are
are performed on all the
hardware, software, and used to identify
components and results
consumables. areas of
from those tests are
Verify the compliance of improvement and
reported. The test cases
non-functional address them.
incorporate test scenarios
Intergration testing requirements such as Some of the
that confirm continuity
performance targets and metrics gathered
and accuracy across
security for this level. are code coverage
modules and
Report defects found in for unit tests,
accommodate testing of
the integration tests. velocity,
files produced by or for
Identify solution design burndown, test
external systems.
problems. progress per
sprint, and
functional
breakdown of
defects.
Defect Summary
Report: The
defects found in a
sprint along with
their priority and
impact.
The QA team will verify Sprint Summary
functional and non- Tests are defined by the Report: Rollup of
functional requirements of QA team and reviewed to testing progress
the system using ensure they meet VSAP for the week, such
hardware, so that any requirements. as the daily report.
Hardware/software
deviation from the These reviews are at the
integration testing
expected behavior is end of every sprint or on Daily and weekly
identified to serve as a schedule established Project Level
information for possible before testing begins. Reports:
hardware or software Determined by the
adjustments. project manager;
they may include
overall velocity,
burndown charts,
hot spots, potential
problem areas,
and/or trending
information.
34
Defect Summary
Report: The
defects found in a
sprint along with
their priority and
User acceptance tests are impact.
performed by the
appropriate team using the Sprint Summary
test suites, test cases, and Report:
checklists as well as the Tests are defined by the Rollup of testing
information about the QA team and reviewed to progress for the
required data and ensure they meet VSAP week, like the
environment. requirements. daily report.
User acceptance
Acceptance testing These reviews are at the
testing
validates that business end of every sprint or on Daily and
functions are operating in a schedule established Weekly
a manner suited to real- before testing begins. Project Level
world circumstances and Reports:
usage. It also gives a Determined by the
chance for stakeholders to project manager;
review the product before they may include
starting production. overall velocity,
burndown charts,
hot spots, potential
problem areas,
and/or trending
information.
35
The first step of pre-
certification testing is to
ensure all requirements
are accounted for in the
development process.
Certification specialists
will be present at scrum
meetings to ensure the
CVSS requirements are
being considered prior to
This testing is integral to coding. They participate As builds are
the overall successful in code reviews to ensure completed, they
development of the VSAP proper coding are verified by the
Pre-certification solution. The pre- conventions are adhered compliance team,
testing certification testing to. and copies of the
encompasses both in- and During the EVT and build are provided
out-of-scope VSAP DVT stages, State- to the S-ATA for
components. Approved Testing review.
Agency (S-ATA)
resources are integrated
into the QA teams. As
builds are completed,
they are verified by the
compliance team, and
copies of the build are
provided to the S-ATA
for review.
Non-functional testing is
As builds are
performed to check non-
completed, they
functional requirements of
are verified by the
the application/product. Performance testing
Non-functional compliance team,
This testing is conducted Usability testing
testing and copies of the
by validating expected
build are provided
outputs against observed
to the S-ATA for
outputs from the
review.
application.
Standard and Special Purpose Test Procedures
See attachments:
• BMD Test Cases
• BMG Test Cases
• ESA Test Cases
• ISB Test Cases
• Tally Test Cases
36
• VBL Test Cases
Test Details
See attachments:
• BMD Test Cases
• BMG Test Cases
• ESA Test Cases
• ISB Test Cases
• Tally Test Cases
• VBL Test Cases
Table 2. Test details
Test Data
(Source, Real
Test Expected Results Evaluation Criteria
or Simulated,
Controls)
Planning phase is
Verify the functional
completed
aspects of the integrated
System design, technical
system including
Source: design, and other relevant
hardware, software, and
Software documents are properly
consumables
specific reviewed, analyzed, and
Verify the compliance of
approved
non-functional
Unit testing Type: Business and functional
requirements such as
Simulated requirements are defined
performance targets and
and approved
security for this level
Controls: User Testable codes or units are
Report defects
defined available
Identify solution design
Test environment is
problems
available
Verify the functional
aspects of the integrated Unit testing phase is
system including complete
Source: hardware, software, and Priority bugs found during
Software consumables unit testing have been
specific Verify the compliance of fixed and closed
non-functional Integration plan and test
Functional testing
Type: Real requirements such as environment to carry out
performance targets and integration testing are
Controls: User security for this level ready
defined Report defects Unit testing for each
Identify solution design module is complete
problems
37
Verify the functional
aspects of the integrated
system including Integration testing
Source: hardware, software, and completed successfully
Software consumables Priority bugs found during
specific Verify the compliance of previous testing activities
non-functional are fixed and closed
System testing
Type: Real requirements such as The system testing
performance targets and environment is available
Controls: User security for this level Test cases are available to
defined Report defects execute
Identify solution design
problems
Verify the functional
aspects of the integrated
system including
Source: hardware, software, and
Software consumables Stress, performance, and
specific Verify the compliance of load tests have executed
non-functional satisfactorily
Intergration testing
Type: Real requirements such as Priority bugs are fixed and
performance targets and closed
Controls: User security for this level
defined Report defects
Identify solution design
problems
Verify the functional
aspects of the integrated
system including
Source: hardware, software, and
Software consumables Stress, performance, and
specific Verify the compliance of load tests have executed
Hardware/software non-functional satisfactorily
integration testing Type: Real requirements such as Priority bugs are fixed and
performance targets and closed
Controls: User security for this level
defined Report defects
Identify solution design
problems
38
Verify the functional
aspects of the integrated The user acceptance tests
system including have executed successfully
Source: hardware, software, and Management has approved
Software consumables user acceptance testing
specific Verify the compliance of completion
User acceptance non-functional Business requirements are
testing Type: Real requirements such as fulfilled
performance targets and No critical defects are
Controls: User security for this level remaining
defined Report defects Acceptance testing signed
Identify solution design off
problems
Verify the functional
aspects of the integrated
system including
Hardware and software
Source: hardware, software, and
received.
Software consumables
TDP documentation
specific Verify the compliance of
completed
Pre-certification non-functional
User and installation
testing Type: Real requirements such as
guides completed
performance targets and
User defined procedures
Controls: User security for this level
followed
defined Report defects
Identify solution design
problems
Verify the functional
aspects of the integrated
system including
Source: hardware, software, and
Software consumables
specific Verify the compliance of
Non-functional non-functional
User defined
testing Type: Real requirements such as
performance targets and
Controls: User security for this level
defined Report defects
Identify solution design
problems
Please see VSAP-CMP-001 Configuration Management Plan for further details about tests.
Test Specifications
Specifications
39
Procedures for the verification and validation of overall software performance have been based
on CVSS requirements and are included in the test cases. These tests provide procedures for
assessing and demonstrating the suitability of the software for election use.
Figure 1. BMD partially configured for the polling place
Control and Data Input/Output
As multiple features/functions are combined to simulate an election, testing is performed on
those sets of features and functions with a set of steps and procedures. The data entry process is
defined by the "Steps" section listed for each test case.
Acceptance Criteria
The features/functions under test are known before the start of the election and are integrated
into the design of the test. When the test is performed, these features/functions are examined and
must meet the expected results described in each test case.
Processing Accuracy
Every feature and function tested must meet acceptance criteria as described in each test case.
Data Quality Assessment and Maintenance
Data quality and accuracy is measured by determining the expected results of the simulation
before any voting is performed. Test results are inspected to ensure they match the expected
outcome for the specific input. The data is always within the boundaries of the election system,
so any maintenance is inherent in the assessment of data quality.
Ballot Interpretation Logic
40
Ballot interpretation logic is defined before the start of the test. The results of the voting and the
response of the system to the voting variations are then known beforehand and listed in the
"Expected Results" section of test cases.
Exception Handling
Exception handling is verified using the test cases that check for correct handling of exceptions.
These test cases represent Error or Exception Handling test scenarios, or the exception handling
addressed in individual test cases if the possible exceptions are within scope.
Security
Security is an overall functionality tested independently of voting variations. The security
aspects are tested within individual test cases.
Production of Audit Trails and Statistical Data
Statistical data in the form of election results may be used for determining accuracy and data
quality. In each election test, all election test results are produced and examined. Audit trail
production is an overall functionality that can be tested independently of voting variations. The
election results or statistical data tests steps are addressed in an individual test if the tabulation of
results are within scope.
Procedures for Assessing Suitability for Election Use
Suitability for election use is controlled by the CVSS. All equipment, hardware, and software are
assessed and only items that meet the requirements are employed in the VSAP system. This
determination is developed via the design and architecture documentation for each sub-system
where requirements are outlined and component selection is controlled, and the requirements are
analyzed by the corresponding conformity matrices.
Please see attachments:
• BMD Software Design Document.pdf
• BMD Software Architecture Document.pdf
• Designing and Using the BMD.pdf
• BMG Software Design Document.pdf
• BMG Software Architecture Document.pdf
• ESA Security Architecture.pdf
• ISB Software Design Document.pdf
• ISB Software Architecture Document.pdf
• Tally and VBL Software Functional Specification.pdf
• Tally and VBL Software Design and Specification.pdf
Attachments
• BMD Software Architecture Document.pdf
• BMD Software Design Document.pdf
• BMD Test Cases.pdf
• BMD Test Plan.pdf
• BMG Software Architecture Document.pdf
• BMG Software Design Document.pdf
• BMG Test Cases.pdf
• BMG Test Plan.pdf
• Designing and Using the BMD.pdf
41
• ESA Security Architecture.pdf
• ISB Software Architecture Document.pdf
• ISB Software Design Document.pdf
• ISB Test Cases.pdf
• ISB Test Plan.pdf
• Tally and VBL Software Design and Specification.pdf
• Tally and VBL Software Functional Specification.pdf
• Tally Test Cases.pdf
• VBL and Tally Test Plan.pdf
• VBL Test Cases.pdf
42
3.5 Software and Firmware Upgrades
Upgrades and updates to software and firmware will use the same process as the initial
installation.
43
4. Election Setup and Definition
4.1 Programming and Configuration of Election
Management System/Software
Purpose and Scope
To define the processes for conducting the internal quality audits of the Smartmatic quality
management system. This procedure applies to all areas of the quality management system,
as identified on the Smartmatic process map located in the Manual. Some of these
processes, however, such as manufacturing, are managed through the supplier of these
processes and this internal audit program will audit the management of these suppliers,
specifically related to the manufacturing requirements.
Procedure
• Definitions
QMS Representative- The person with responsibility and authority for day to day
oversight of the performance of the QMS. This person is appointed by top management
at Smartmatic and serves as the owner of the internal audit process.
QMS Review- Described in ISO 9001 as "management review", the QMS Review is
the process that reviews the health of the QMS at periodic intervals to ensure the QMS
maintains its suitability, adequacy and effectiveness.
Conformance- Meeting a requirement
Non-conformance- Not meeting a requirement
Opportunities for improvement- A conforming process that might be considered for
improvement, due to inefficiencies, chance for increased effectiveness, poor
performance trending, use of obsolete technology or processes, cost savings, etc.
Finding(s)- What was found during an audit, may be positive (conformance), negative
(non-conformance) or an opportunity for improvement (OFI).
• Internal Audit Program- The Smartmatic audit program is designed to determine the extent of
conformance in Smartmatic processes and to identify relevant opportunities for improvement.
The objective of this internal audit program is to determine if the QMS is meeting the intended
results of managements objectives (operational, financial, etc.) as well as continued improvement
of the QMS processes.
The audit program is designed to meet the changing needs of Smartmatic and to allow
competent auditors to conduct audits of value on QMS requirements and management
objectives. Smartmatic management views this audit program as a dynamic means to
assist in meeting the organizations purpose and strategy in the global marketplace.
44
• Internal audit schedule- An audit schedule is created annually by the Smartmatic QMS
Representative. The schedule is reviewed, possibly revised and approved in Smartmatic QMS
Review and is attached to the QMS review minutes for future use.
The internal audit schedule lists the activities, areas, requirements, processes or
locations to be audited on an annual basis. The audits may be scheduled monthly, every
other month or quarterly. In some cases, the audits may be conducted twice a calendar
year with many auditors participating.
The activities, areas, requirements, processes or locations listed on the audit schedule
ensure that all core processes are audited in some fashion every year and all parts of the
QMS are audited at least every 3 years. Smartmatic management may provide
additional input or guidance into certain areas of Smartmatic that need to be added to
the audit schedule.
The audit schedule can also be modified during the year based on process issues,
customer complaints, non-conformance, management direction, new processes added at
Smartmatic, process improvements or if the QMS scope has changed.
Auditors are assigned to each audit on the audit schedule and are assigned to audit in
pairs if resources allow. Auditor pairs will select the "lead auditor" within that pair that
will handle any logistics, decisions, etc. related to each audit assignment.
• Auditors and competency- Only personnel that have been trained may perform audits of the
Smartmatic QMS. Auditors are selected by management and/or the QMS Representative to be
QMS auditors. Auditors are required to participate in auditing each year to maintain their status
as an auditor. Auditors are requested to gain additional auditing competence through additional
training, reading, participating in on-line discussions and groups and possibly seminars,
webinars, etc. Auditors are expected to demonstrate the "auditor behaviors" identified in ISO
19011 (current version) when conducting audit activities.
Auditors are expected to maintain objectivity and impartiality throughout the audit
process.
Auditor training is selected and approved by the QMS Representative and/or
Smartmatic management. Smartmatic has no requirement for certified or accredited
ISO 9001 training classes for requirements or for auditing. Training should be provided
by credentialed professionals with extensive knowledge, understanding and experience
in ISO-based management systems and in quality auditing. Trainers should also possess
business knowledge to promote value in the QMS and its processes, specifically the
internal audit process. Employees that join Smartmatic with previous ISO auditing
experience may be added to the auditor roster at the discretion of the QMS
Representative.
• Planning for the audit- Planning for scheduled audits begins before the audit scheduled date(s).
The QMS Representative determines the feasibility of the audit during the time frame and if
feasible, notifies the auditor(s) to begin preparations. If the QMS Representative determines it is
not feasible, then an alternative time frame is selected. The QMS Representative will make
available to the auditor(s) any necessary documents needed to begin the preparation, such as
previous audit results for that area/process, any significant changes to that area/process, any
recent complaints or non-conformance from last audits, etc. The QMS Representative will then
45
define the audit area/process, the scope of the audit and possibly audit objectives. The auditor(s)
will then begin planning for the audit, beginning with determining the exact date(s) and time(s)
for the audit interview. Once this is completed, the auditor(s) begin the preparation.
• Preparation for the audit- The auditor(s) will review process/area, the scope and the objectives
for the audit and begin creating a checklist (or using an internal checklist). This checklist is
based on the information received from the QMS Representative or this same information
gathered by the auditor(s).
The auditor(s) will create questions to ask during the audit, based on the checklist of the
audit specific checklist. These questions will focus on what's most important in the
process/area being audited and should be asked to different people in different levels of
activity in the process/area.
The auditor should have general understanding of the ISO 9001 and 10007
requirements and should consider bringing a copy along on the audits.
The audit checklist should serve as a guide during the audit to help the auditors stay
focused, stay in scope and stay on time. Additionally, the checklist may be a good place
to take the auditor(s) notes.
• Conducting the Audit- The auditor(s) should conduct the audit at the place where the process is
performed. The auditor(s) should use the checklist to lead the audit, knowing that the audit may
change based upon what the auditor finds.
The auditor can use the checklist or another means to keep good notes of the findings
(conformance, non-conformance or opportunities for improvement)
The auditor should use the most appropriate questioning technique(s) to get information
related to the process being audited. These can include: open-ended questions, closed-
ended questions, clarifying questions and leading questions. The auditor is looking for
conformance and when a possible non-conformance is identified in the audit process,
the auditor(s) should use clarifying questions to ensure that we record the actual
response.
Audit evidence is collected via interview with person(s) working in the process,
observations of person(s) and reviewing records or evidence of the process being
conducted.
The auditor should keep the person(s) being audited aware of how the audit is
progressing and should share any concerns, non-conformance, opportunities, etc. with
them.
Once the questions have been answered, the audit trails have been taken and the auditor
is satisfied that the audit objectives have been achieved, the auditor should recap the
findings, answer any questions and thank them for their assistance. Additionally, the
auditor ensures that the notes taken are sufficient to create an accurate, truthful and
complete audit report.
• Reporting the audit results- The results of the audits are compiled into a single audit report.
This report includes a summary of the findings, which includes conformance (including best
46
practices, noteworthy efforts, etc.), non-conformance (which include the requirement not being
met and the list of evidence that verifies the requirement was not met) and opportunities for
improvement. This report is submitted to the QMS Representative for review and issue. The
QMS representative will ensure that any necessary corrective actions are issued to the
appropriate process owner(s). This report is maintained as a record. Evidence collected during
the audit that is used for corrective actions may be retained at the discretion of the QMS
representative.
• Audit follow-up- If required or requested, a follow-up audit may be performed for certain
reasons: corrective action review, to complete the original audit, to conduct a deeper dive into
certain parts of a process for better understanding or management request. Any findings that
need recording will be added into a separate audit report or appended to a previous audit report.
These findings will be included in the Smartmatic QMS Review.
47
4.2 Programming and Configuration of Vote Recording
Tabulation Device-
Tally System CONTENTS
Introduction
This document provides instructions for a production deployment of Tally.
Color conventions to keep in mind with Terminal Code:
• White/Gray - The command to run in the terminal. Run one line at a time.
• Turquoise - The output of the command where applicable to display
• Red - String/Text these values are variable depending on your own server equipment.
• Green - Comments
General Prerequisites
To complete the offline deployment, you will need the following:
• Collection of machines to install Tally
• Install media for CentOS 7.6.1810
• Access to the following VSAP repositories: installer, tally-core, auth-service, and
logviewerservice.
• GoLang 1.12.4 for Linux AMD64 (from https://golang.org/dl/)
• Access to VSAP Azure container registry
• Build system: a system from which it is possible to clone Git repos to and "build" the Docker
images.
• Deployment system: a second system on the air-gapped network in which the pre-built
distribution package can be run to "build" the cluster
You will also need two users to complete the installation of Tally:
• user will reference the user created during CentOS configuration
• ssh-user will reference the user that has been granted ssh access to all nodes in the cluster
This readme is made up of the following sections:
1. Building Distribution Kit
2. Preparing Tally Nodes
3. Getting Nodes Ready for the Main Installer
4. Main Installer
5. Starting Tally
6. Viewing Tally
48
7. Stopping Tally
8. Other Helpful Commands
1 Building Distribution Kit
The following is required before moving the repositories to the Tally machines:
1. Install minimal CentOS 7.6.1810 to the Tally machines
2. Clone Tally Repositories
3. Build Docker Images
4. Download GoLang
5. Move Go to VSAP Directory and Create Bundle
4.2.4.1 1.1 Install minimal CentOS
All machines must be running CentOS 7.6.1810 with the minimal installer option and the "file
and storage server" selection.
There should be a USB flash drive or CD with the minimal CentOS 7.6.1810 ready for install.
To do so follow these steps:
1. Plug in the USB flash drive or CD
2. Look up instructions to get to the Quick Boot menu for specific machine
3. Select EFI Boot drive for the flash drive
4. Select "Install CentOS 7"
5. Select English > English (United States)
a. Click "Continue" (bottom right)
6. Select "Date & Time"
49
7. Select Los Angeles on the map
8. Click "Done" (top left)
9. From the primary menu go to "Installation Destination"
50
10. Select all disks in "Local Standard Disks"
11. Check "I will configure partitioning" in "Other Storage Options"
12. Click "Done" (top left)
13. (Skip if fresh install on new machine) Delete any existing groups of partitions (e.g. CentOS
Linux 7.6.1810 for x86_64 OR Unknown)
a. Open each dropdown
b. Select the minus button (near the bottom left)
c. Check "Delete all file systems..."
d. Click "Delete it"
51
14. Repeat (if necessary)
15. Select option 'Click here to create them automatically'
16. Set /home capacity to be about 3% of total storage
17. Delete any storage entered in / (centos-root). This will allocate all remaining available space
to /.
18. Click "Done" (top left)
19. Click "Accept Changes"
52
20. Select "Network & Host Name"
a. Set Host name (e.g. lac-df-master1) (bottom left)
b. Click "Apply"
c. Plug in the network cable to the system.
d. Choose the network interface on the left-hand list. If there are multiple network
interfaces in the system, choose the one that isn't listed as "unplugged".
e. Toggle on Ethernet (top right)
f. Click on [Configure…] to configure static IP address
g. Click "Apply"
h. Click "Done" (top left)
21. Check that "Software Selection" is set to "Minimal Install"
22. Click "Begin Installation" (bottom right)
53
23. Select "Root Password"
a. Set root password and confirm it
b. Click "Done" (top left)
24. Select "User Creation"
a. Enter Full Name
b. Enter username
c. Check both 'Make this user admin' and 'Require a password to use this account'
d. Set a password and confirm it
25. Click "Done" (top left)
54
26. Once installation is complete (this may take a few minutes), click the "Reboot" button
(bottom right)
4.2.4.2 Clone Tally Repos
Once Go has been downloaded, you will need to clone the Tally repos. Once the Tally repos
have been cloned both Go and the repos will be moved over to the deployment system. To
clone the Tally repos run the following commands from the build system:
mkdir -p /tmp/go/src/bitbucket.org/export GOPATH=/tmp/gocd /tmp/go/src/bitbucket.org/
mkdir vsapcd $_
# clone the tally repositoriesgit clone git@bitbucket.org:vsap/installer.gitgit clone
git@bitbucket.org:vsap/tally-core.git # currently takes ~ 50mingit clone
git@bitbucket.org:vsap/auth-service.gitgit clone git@bitbucket.org:vsap/logviewer-service.git
# Download resources from Git LFS cd tally-coregit lfs pull cd ../installergit lfs pull
4.2.4.3 Build Docker Images
Once the repos have successfully been cloned, the next step is to provide to build the images on
the build system.
Prior to initiating the build, the user must have installed and logged in to Microsoft's Azure
service.
# login to azure. This command only needs to be run once per system build. az login # login to
the vsap acr. This needs to be run every time we build images.
# (NOTE: this cannot be done through BlueCoat: lac users must use a system
# with a BlueCoat bypass) az acr login --name vsapacr # begin building the imagesgo run
/tmp/go/src/bitbucket.org/vsap/installer/cmd/tally/build_deployment/main.go -d # enter project
directory values for each prompt
55
Enter the tally-core project directory Enter a value: ../tally-core Enter the auth-service project
directoryEnter a value: ../auth-service Enter the auth-service project directoryEnter a value:
../logviewer-service
After entering the directories, the docker images will be built. This will take upwards of 30
minutes to complete.
4.2.4.4 Download GoLang
The deployment system requires that GoLang 1.12.4 for Linux AMD64 be installed prior to
running the installer script.
Start from the build system. Download the Go linux package from {+}https://golang.org/dl/+. If
not readily available, check the Archived versions which are towards the bottom of the page.
4.2.4.5 Move Go to VSAP Directory and Create Bundle
Once the images have been built, move the downloaded Go package to the VSAP directory, so
they can be bundled together.
To do that run the following commands from the build system:
# copy Go to the directory the repos were cloned into. cd ~/directory Go was downloaded into
cp go1.12.4.linux-amd64.tar.gz /tmp/go/src/bitbucket.org/vsap cd /tmp/go/src/bitbucket.org/
# tar the vsap bundle
tar -czf vsap.tar.gz --exclude .git vsap
Preparing Tally Nodes
Once the Distribution Kit has been built, the remaining Tally nodes need to be setup. To setup
the Tally nodes the following steps need to be taken:
1. Install minimal CentOS (these are the same instructions used in Section 1)
2. SSH User Generation
4.2.5.1 SSH User Generation
All machines should be set up with a user with an SSH authorized key, owned by the user doing
the install on the deployment system. This will allow password-less login to the node systems
during the install process.
To create a new ssh user with an authorized key, first create a new ssh key from the
deployment system on the user that will be running the installer. Run the following commands
and leave all response fields empty.
# generate ssh key from the deployment system ssh-keygen -C "add comment to identify key"
56
# copy the ssh public key to the other nodes scp ~/.ssh/id_rsa.pub user@node-
ipaddress:/tmp/masteruser.pub # repeat for each Tally machine# replace this string in the next
command with the username you are trying to create (e.g. tallyadmin2)
NEW_USER="newusername" # the user in the following command is the user created during
the CentOS setup SSH_KEY="/user/.ssh/id_rsa.pub" # add a new user sudo useradd -m
${NEW_USER} -G wheel # set ssh configurations sudo mkdir -m 0700
/home/${NEW_USER}/.ssh # ssh is being set to the contents sudo sh -c "cat ${SSH_KEY} >>
/home/${NEW_USER}/.ssh/authorized_keys" sudo chown -R
${NEW_USER}:${NEW_USER} /home/${NEW_USER}/.ssh sudo chmod 600
/home/${NEW_USER}/.ssh/authorized_keys # allow passwordless ssh sudo sed -i
'/NOPASSWD:\sALL/c%wheel ALL=(ALL) NOPASSWD: ALL' /etc/sudoers
Once this has been done for the deployment system, it will need to be done for each Tally
machine running the following commands:
# ssh to a Tally machine from the deployment
system ssh user@node-ip-address
# replace this string with the username you are trying to create (e.g. tallyadmin2)
NEW_USER="new-username" # replace this string with the ssh public key copied
from the previous step SSH_KEY="/tmp/masteruser.pub" # add a new user sudo
useradd -m
${NEW_USER} -G wheel # set ssh configurations sudo mkdir -m 0700
/home/${NEW_USER}/.ssh # ssh is being set to the contents sudo sh -c "cat
${SSH_KEY} >>
/home/${NEW_USER}/.ssh/authorized_keys" sudo chown -R
${NEW_USER}:${NEW_USER} /home/${NEW_USER}/.ssh sudo chmod 600
/home/${NEW_USER}/.ssh/authorized_keys # allow passwordless ssh sudo sed -i
'/NOPASSWD:\sALL/c%wheel ALL=(ALL) NOPASSWD: ALL' /etc/sudoers
# repeat for each Tally machine
Getting Nodes Ready for the Main Installer
Once the images have been built, everything necessary to run the installer will be ready to move
to the deployment system. The following sections describe getting the images on the deployment
system and installing Go.
1. Move VSAP Directory to Deployment System
2. Install Go to the Deployment System
3. Move VSAP directory to other Nodes
4.2.6.1 Move VSAP Directory to Deployment System
Once the VSAP directory bundle has been created, you will need to physically connect to the
cluster's air-gapped network to copy the bundle to the deployment system.
In the following command, [user] is the user that was created when installing CentOS.
# copy the vsap directory to the deployment system
57
scp vsap.tar.gz user@deployment-system-ip-address:/tmp # ssh to the deployment system ssh
user@deployment-system-ip-address
4.2.6.2 Install Go to the Deployment System
Next, create the project structure on the deployment system and then create a $GOPATH at /go
# create the project structure sudo mkdir -p /go/src/bitbucket.org/ # untar the VSAP bundle sudo
tar -C /go/src/bitbucket.org/ -xzf /tmp/vsap.tar.gz # grant permissions for Go path sudo chmod -
R 0777 /go
# unbundle the Go tar sudo tar -C /usr/local -xzf
/go/src/bitbucket.org/vsap/go1.12.4.linuxamd64.tar.gzecho 'export
PATH=$PATH:/usr/local/go/bin' >> ~/.bashrc # creating the
`$GOPATH` echo 'export GOPATH=/go' >> ~/.bashrc
Apply the configurations and test the Go install:
source ~/.bashrc # test the go installation go version go
version go1.12.4 linux/amd64
4.2.6.3 Move VSAP directory to other Nodes
The previous step copied the VSAP directory to the primary master node. Next the VSAP
bundle needs to be copied to all remaining provider and compute nodes. Additional master
nodes do not require the VSAP directory.
# copy the vsap directory into every other Tally machine
scp /tmp/vsap.tar.gz user@compute-node-ip-address:/tmp scp /tmp/vsap.tar.gz user@provider-
node-ip-address:/tmp # once the VSAP directory has been copied to every machine, run the
next command # ssh to a node ssh user@node-ip-address # unbundle the VSAP directory sudo
tar -C /mnt -xzf /tmp/vsap.tar.gz # go back to the deployment system exit # repeat for every
node
Once the project resources are in the right place, we can begin the kubernetes installer script.
Main Installer
This section covers the main installation process for Tally. It can be executed either as a stepby-
step walkthrough or by command flags. For new users, the step-by-step mode is recommended.
# go into the installer directory on the deployment system cd /go/src/bitbucket.org/vsap/installer
# to run the installer, /ssh-user is a user that has been granted ssh access to all nodes in the
cluster. To run the command in step-by-step mode, omit flags. go run
cmd/tally/installer/main.go ssh-user flags
4.2.7.1 Configuration
When the main installer starts, it will require the user to specify the nodes that will be included
in the cluster, as well as their type.
The first node to be setup will be the deployment system. The deployment system configuration
cannot be changed once in the current version of the installer, so double check the entered values
before submitting the information. Also, the first node is where HA proxy is deployed and will
be the entry point for Tally through the web browser.
58
# enter the deployment system hostname
Enter the hostname configured for this master systemEnter a value: deployment-
systemhostname Enter the ip address configured for this master systemEnter a value:
deploymentsystem-ip-address
Below is an example configuration once the first master system has been setup:
---------------------------------------------------------| Node Type | Hostname | IP ||----------------|------
---------|----------------|| MASTER | lac-df-master1 | 10.0.5.151 |----------------------------------------
----------------
Next you will have the option to: 1) Enter a new node, 2) remove an existing node, 3) Finished.
If the only node that has been setup is the deployment node, you will not be able to remove an
existing node. Entering a new node will lead to a multi-node cluster and finishing the setup will
lead to a single-node cluster.
On a multi-node cluster, it is mandatory to set at least one:
• master node
• compute node
• provider node
• file node
If a dedicated file node does not exist, you can assign the same hostname and IP address as a
compute node. This is true for other types of nodes, but a minimum of three nodes is
recommended for a multi-node cluster.
What type of node is this?master (m), compute (c), provider (p), file (f)Enter a value:
Below is an example of a valid multi-node cluster setup, which appears once you finish the
setup:
---------------------------------------------------------------| Node Type | Hostname | IP ||-----------------
-|-----------------|------------------|| MASTER* | lac-df-master1 | 10.0.5.151 || COMPUTE | lac-
dfcompute1 | 10.0.5.161 || PROVIDER | lac-df-provider1 | 10.0.5.171 || FILE | lac-df-compute1 |
10.0.5.161 |---------------------------------------------------------------* = This node (the first master
node)
The output above will be paired with the following prompt:
The above are the nodes that you have configured, is this correct? (y/n)Enter a value:
Entering 'y' will end the configuration and proceed to the next step in the installer. Entering 'n'
will allow you to make changes to the configuration. As a reminder, the only node that cannot be
modified is the first master system.
The last step in node configuration is to name the configuration:
What is the name of this cluster?Enter a value:
Keep track of the name you use for the cluster. If the installation is interrupted past this prompt,
you will need to input the name to continue with the installation of Tally. Otherwise, you will
need to redo the node configuration.
This command will take some time to complete. If this process is interrupted (e.g. machine goes
to sleep) it will leave you in a bad state, and you will need to reset the machines and start over.
4.2.7.2 Initializing Kubernetes Cluster
59
After the node configuration is complete, the next step will be to initialize the cluster. The next
prompt will be to restart the machines in the cluster:
Compiling node resources requires that you restart the machines in the cluster, are you sure you
want to proceed? (y/n)Enter a value:
Entering 'y' will continue with the installation. Entering 'n' will exit out of the installation. This
step will take some time.
After the machines are rebooted, you will need to rerun the installer command from the
deployment system to continue the installation process from where you left off.
# ssh to the deployment system
ssh user@deployment-system-ip-address
# go into the installer directory cd /go/src/bitbucket.org/vsap/installer
# rerun the installer command
go run cmd/tally/installer/main.go ssh-user flags # continue the installation from where it left off
It looks like you're starting from a node where pre-restart has already been run. Would you like
to continue from a saved cluster? (y/n)Enter a value:
Entering 'y' will then prompt for the name of the configuration cluster set at the end of node
configuration. If the name matches a saved configuration, the cluster node configuration will
appear to allow for you to review before continuing. Entering 'n' will restart the node
configuration.
4.2.7.3 Creating Docker Registry
The next step in the installation process will be to create a username and password for the
Docker registry. Keep track of the username and password you enter, since it will be required
later in the installation.
Configuring private docker registry specifications...Username for the Docker registryEnter a
value: Enter the password to create for the docker registryConfirm docker registry password
You will need to enter the password for the docker registry twice.
Starting Tally
Once the cluster and its various nodes have been set up and Docker images have been built, the
Tally system can be started by running the create_all command.
To do this, run the following based on whether the installation is for single or multi node
deployment:
# run for a single-node deployment: go run cmd/tally/create_all/main.go deployment-
systemhostname -k # run for a multi-node deployment: go run cmd/tally/create_all/main.go
deployment-system-hostname file-node-hostname -m -k
The [deployment-system-hostname] can be referenced in the example configuration output.
This will compile template files for the tally system into .yaml files to create k8s pods.
This process includes 2 flags: --multinode and --kube-create.
-m --multinode indicates that the cluster being used is multinode. Setting this flag indicates that
you must also pass the [file host], which is the hostname of the file node.
-k --kube-create indicates that the process should also create k8s pods based on the compiled
.yml files, which will start the Tally system.
60
Regardless of deployment type, the system may take several minutes to start. To check the status
of the pods as they spin up, run kubectl get pods -n tally.
When the system is ready, the tallymanager-deployment pod will have a status of "Running." On
first run, the system may take longer to spin up; if tallymanager is unable to reach cassandra
and/or kafka, delete the tallymanager-deployment pod and it should automatically restart.
Viewing Tally
On any machines meant to access tally, the accepted hostnames must be mapped to the IPs of the
cluster nodes.
To do this, modify /etc/hosts (on Windows it's located at
c:\Windows\System32\Drivers\etc\hosts) to include the hostnames and IP addresses of the
deployment system from which Tally was installed. It should be formatted similar to:
10.166.135.84 rrcc58607
Once the hostname has been mapped, go to a new browser window and navigate to:
https://deployment-system-hostname:30069/logout (example: https://rrcc58607:30069/logout)
Stopping Tally
There are known issues with the functionality to Stop Tally. This section should be avoided for
now.
To stop the tally system and delete running services, run
go run cmd/tally/delete/main.go
from this installer project root. This will delete all resources generated by files found in the
configuration dist directory.
Note: running this program will clear the MySQL state database as well
To check that all resources have been deleted, run the following command:
kubectl get all -n tally
Other Helpful Commands
4.2.11.1 Set Desired Hostnames
Before beginning installation, ensure that all nodes are set to their desired hostnames and ip
addresses.
4.2.11.1.1 Checking Hostnames
To verify the hostnames of the Tally machines, you can run the following command from each
Tally machine:
hostname
4.2.11.1.2 Changing Hostnames
If the hostname needs to be changed, it should be reset from each Tally machine with the
command:
61
sudo hostnamectl set-hostname desired-hostname
4.2.11.2 Configuring IP addresses
Configure the IP address for each Tally machine. Start with the deployment system:
sudo vi /etc/sysconfig/network-scripts/ifcfg-eth0
Once the file has opened, modify the contents to configure the system for your network. Below
is an example configuration used on a simple air gapped network:
TYPE=EthernetBOOTPROTO=noneDEFROUTE=yesNAME=eth0UUID=0e1b359c-ab0e-
4f66abea-
095a74c7074aDEVICE=eth0ONBOOT=yesIPADDR=192.168.1.100GATEWAY=192.168.1.1
00 NETMASK=255.255.255.0ZONE=public
Below are more detailed instructions for Configuring the IP address:
1. Login with the user setup during CentOS installation
2. run sudo vi /etc/sysconfig/network-scripts/ifcfg-
a. Enter tab to get the remainder of the name
b. Add that back to the command and run it
3. Enter password configured during CentOS installation
4. Using the arrow keys navigate down to BOOTPROTO=dhcp
a. hit i
b. delete dhcp
c. replace it with none (BOOTPROTO=none)
d. Navigate to ONBOOT
e. Replace no with yes (ONBOOT=yes)
5. Press Enter (to get a new line)
6. Enter 'IPADDR=[ip-address]' (e.g. 10.0.5.151)
7. Hit ESC key
8. Enter :wq
9. run sudosystemctl restart network
10. If prompted, enter password configured during CentOS installation
11. Run ipaddr (to check whether ip address was properly set)
12. Repeat for each Tally machine
62
4.3 System Diagnostic Testing Procedures
BMD
You can run diagnostics on any individual BMD, a filtered group of BMDs, or all BMDs
simultaneously. See below to learn how.
1. From the BMG main page, in the "Search BMDs by" menu, click List All, or choose
specific search filters to isolate a group of BMDs, or a single BMD.
• You'll see a list of BMDs, filtered by your search criteria.
2. Check the boxes next to any BMD or check the box at the top of the list to select all
BMDs.
3. Using the first "Choose Bulk Action" dropdown, select Run Diagnostics.
4. Click Submit.
5. You'll be brought to a new page where you'll see a status list of the command you've just
run. You'll see either the "SUCCESS", or "FAILURE" test results in the "Status" column,
along with details in the "Description" column.
63
64
4.4 System Proofing
Purpose
The components of VSAP need to be system proofed to ensure that they are working properly
and securely. Each component has its own method of system proofing. See below to learn how.
Generate VBM L&A Decks
Context: Generates a Logic and Accuracy deck based on set configurations. Creates archives of
generated L&A decks so they can be retrieved, and used for the appropriate testing scenarios on
other systems
To generate VBM L&A ballot decks:
1. Navigate to the VBM L&A page from the menu drawer.
2. The page displays the current configuration set for Logic and Accuracy. Make sure that
this is your desired configuration.
3. If not, navigate back to Configure Logic and Accuracy.
4. Click the Generate button
5. A message on the Dashboard in Active Processes displays the progress of the
generation.
6. When generation has completed return to Generate Logic and Accuracy. The
configured deck is a new row in the table.
7. To access the deck, click the icon in the Create PDF Archive column. This creates a
zipped folder on the main VBL server that can be accessed manually following the path
defined under Archive Location.
8. To convert the deck from PDF to JPEG format, click the icon in the Convert to JPEG
column.
9. Once the conversion completes, click Create JPEG Archive to create a zipped folder on
the main VBL server.
Note: The Undervote deck is created during VBM Generation.
Generate BMD L&A Poll Passes
Context: In order to execute logic and accuracy on the BMDs, VBL produces poll passes
following configurable vote patterns. These are produced as sets of PDFs with 4 poll passes per
PDF.
Once the L&A poll passes have been scanned and printed, these selection ballots will then have
to be scanned into the Tally system to get tabulated. Tally can then print out the list summary of
the test results and compare it to the list summary generated by the VBL system to ensure that
the results from the BMD match those of the predetermined totals.
To generate BMD L&A poll passes:
65
1. Navigate to the BMD L&A page from the menu drawer.
2. The page displays the current configuration set for Logic and Accuracy. Make sure that
this is your desired configuration.
3. If not, navigate back to Configure Logic and Accuracy .
4. Click the Generate button
5. A message on the Dashboard in Active Processes displays the progress of the
generation.
6. When generation has completed return to BMD L&A. The configured deck is a new row
in the table.
To access the deck, click the icon in the Archive column. This creates a zipped folder on the
main VBL server that can be accessed manually following the path defined under Archive
Location.
BMD L&A
Prior to an election, Logic and Accuracy testing must be done on a BMD to ensure the ballot
layouts are correct. In order to perform this procedure, you need to switch a BMD to L&A mode.
Follow the steps below to perform Logic and Accuracy testing using a BMD.
A BMD can't be put into L&A mode if the BMD is in Vote mode. Further, Logic and Accuracy
testing can only be done by an election worker whose credentials activate L&A mode. Scanning
these credentials automatically puts the BMD into L&A mode, given that the BMD is not in
Vote mode.
66
1. Scan and Enter Credentials, then
2. Tap Start New 3. Insert a blank paper
tap Return To Start.
Test. ballot.
67
The ballot prints and drops into the ballot
4. Scan L&A poll 5. Tap Exit Test to return to
box, then returns to the insert a blank
pass. the L&A test page.
paper ballot page.
68
6. Tap New Test to start a new test, or tap Exit to exit L&A mode.
69
4.5.1 Generate VBM Logic and Accuracy
(L&A) Decks
Generate VBM L&A Decks
Context: Generates a L & A deck based on set configurations. Creates archives of generated
L&A decks so they can be retrieved, and used for the appropriate testing scenarios on other
systems
To generate VBM L&A ballot decks
1. Navigate to the VBM L&A page from the menu drawer.
2. The page displays the current configuration set for Logic and Accuracy. Make sure that this is
your desired configuration.
3. If not, navigate back to Configure Logic and Accuracy.
4. Click the Generate button
5. A message on the Dashboard in Active Processes displays the progress of the generation.
6. When generation has completed return to Generate Logic and Accuracy. The configured deck
is a new row in the table.
7. To access the deck, click the icon in the Create PDF Archive column. This creates a zipped
folder on the main VBL server that can be accessed manually following the path defined under
Archive Location.
8. To convert the deck from PDF to JPEG format, click the icon in the Convert to JPEG column.
9. Once the conversion completes, click Create JPEG Archive to create a zipped folder on the
main VBL server.
Note: The Undervote deck is created during VBM Generation.
70
4.5.2 Generate BMD Logic and Accuracy
(L&A) Poll Passes -Version 5
Generate BMD L&A Poll Passes
Context: In order to execute logic and accuracy on the BMDs, VBL produces poll passes
following configurable vote patterns. These are produced as sets of PDFs with 4 poll passes per
PDF.
To generate BMD L&A poll passes:
1. Navigate to the BMD L&A page from the menu drawer.
2. The page displays the current configuration set for Logic and Accuracy. Make sure that this is
your desired configuration.
3. If not, navigate back to Configure Logic and Accuracy
4. Click the Generate button
5. A message on the Dashboard in Active Processes displays the progress of the generation.
6. When generation has completed return to BMD L&A. The configured deck is a new row in the
table.
To access the deck, click the icon in the Archive column. This creates a zipped folder on the
main VBL server that can be accessed manually following the path defined under Archive
Location.
71
4.5.3 Lab Test Mode
Lab Test Mode
Lab Tests are used by the Certification Lab to perform the environmental test on the BMD.
This mode can be accessed at any BMD and the status can be not open, opened or closed. Only
Lab Test Operators have access to this mode. The credentials for the Lab Test are generated in
the BMG.
To simulate the Voting Process:
1. Scan and park
2. Print image
3. Eject and hold, repeat
The paper handler test has a counter of how many cycles have been done. During the paper
handler diagnostic, all LEDs must turn white and the QR scanner must come on. The time
between the cycles must be 10-seconds.
Prior to an election, Logic and Accuracy testing must be completed on a BMD to ensure the
ballot layouts are correct. In order to perform this procedure, you need to switch a BMD to Logic
and Accuracy mode. Follow the steps below to perform Logic and Accuracy testing using a
BMD.
Testing the BMD
A BMD can't be put into L&A mode if the BMD is in Vote mode. Further, Logic and Accuracy
testing can only be done by an election worker whose credentials activate Logic and Accuracy
mode. Scanning these credentials automatically puts the BMD into Logic and Accuracy mode,
given that the BMD is not in Vote mode.
72
1. Scan and Enter 2. Tap Start New Test. 3. Insert a blank paper
Credentials, then tap ballot.
Return To Start.
73
4. Scan L&A poll pass. The ballot prints and drops 5. Tap Exit Test to return to
into the ballot box, then the L&A test page.
returns to the insert a blank
paper ballot page.
6. Tap New Test to start a new test, or tap Exit to exit L&A mode.
74
4.5.3.1 Results
75
4.5.4 Remake Mode
The Remake Mode is used to remake a ballot that has incurred damage and cannot be tabulated
by Tally. Only Remake operators have access to this mode. The BMG generates credentials for
Remake operators. Remake operators can go through the full voting process in order to reprint
voter ballots. The Remake Mode can be activated on any BMD from the voting application.
4.5.5 Activating the Remake Mode on the
BMD
To activate the Remake Mode on the BMD, an operator with the appropriate authorization will
scan their two-factor authentication credentials using the bar code scanner to scan their QR
Code, and inputting their PIN using the touch screen. Authorizations are established within the
BMG. The activation is initialized in either the open or closed poll status. After the operator has
entered their proper credentials, the operator will be prompted to insert a blank ballot in the
BMD and then must scan the SBE from the unusable ballot. The voter selections will be
reviewed (Note: This information is always in English).
After reviewing the information, a new ballot with a unique ID and sequence number will be
generated and then printed. The unique ID is located on the upper right-hand corner of the ballot.
All Remake Ballots are composed by BMD ID + Sequence.
1. Select
Remake
Ballot
76
2. Insert Blank
Ballot
3. Ballot
Loaded
4. The precinct
can be entered
by scanning the
BPM of the
damaged ballot
(the BMP
includes
Precinct,
Provisionality,
and Party), or
by manually
inputting the
data, and
selecting Next.
Note: When
using the BPM
77
5. Precinct
validation will
be displayed,
select Next to
continue. Note:
When using the
BPM this
screen will not
be displayed.
6. Select Yes
or No for
Provisional
voting, then
select Next.
Note: When
using the BPM
this screen will
not be
displayed.
7. Select your
party, then
select Next.
Note: When
using the BPM
this screen will
not be
displayed.
78
8. Precinct
loaded will be
displayed
briefly.
9. The ballot
can be remade
by scanning the
SBE QR code
of the damaged
ballot, which
will include all
contest
selections, or
by manually
entering the
contests.
10. **Series of
contest**
79
11. Let’s
review
12. Review
your selections
80
13. Select Yes
- Ready to
Print, then
select Print.
14. Printing
Ballot & Ballot
printed will
display briefly.
81
15. Please
remove the
ballot
16. The remake
ballot will be
printed with a
unique code in
upper right-
hand corner
(highlighted in
Yellow)
4.5.6 Multiple Elections
All BMDs are designed to accept multiple elections. When a BMD is loaded with multiple
elections, a welcome screen displays the name of all elections configured on the BMD. In this
configuration, all activation counters will be stored by the election.
82
4.6 Ballot Tally Programs
Purpose
The Tally Scanners need to be connected to the Tally system and a directory needs to be
specified in order to receive scanned ballots. Follow the directions below to connect a Tally
Scanner to the Tally system.
Process
1. Once an election is configured, specify which directory will be used to receive the
scanned ballot images. From the Home page, select System Management > Scanners
from the menu.
Figure: Scanner Folders
2. From the Scanner Folders page, click Add Scanner.
Figure: Scanners
3. Set the scanner name and path to the directory on the file system and select the election to
be associated with the scanner
4. Click OK.
Multiple scanners can be configured either for a single election or for multiple
o
concurrent elections.
83
4.7 Election Observer Panel
Purpose
The purpose of Election Observers is to:
1. Provide an avenue for public observation of and input into the election process.
2. Assist in ensuring the integrity of the election process.
3. Encourage participation and build voter confidence in the election process.
Invitation
Between E-60 and E-30, prepare a media release and letters of invitation (see samples attached)
to parties likely to participate, such as the following:
1. County Grand Jury
2. Political Party Central Committee Members
3. Language Advocacy Groups
4. Community Based Organizations
5. Media
6. Other groups or individuals expressing an interest in observing election day activities
may also be included in the observer panel, as deemed appropriate.
Group Presentations:
After letters of invitation have been sent out, offer to attend group meetings to provide an
opportunity for the groups to ask questions about the process. Groups should be contacted to
arrange time on their agendas for staff presentations. This is optional at the request of the group,
but staff should make every effort to contact the groups and offer this service.
Appointment Letters (for introduction to precinct workers)
After the groups have provided the names of interested panelists, prepare letters of introduction
(see sample attached) for the panelists to use when visiting polling places on Election Day.
Materials to be prepared for each panelist will include a listing of all polling places within the
county for that specific election as well as the central counting site location and hours of
operation.
Mechanism for Feedback
Observers attend training at government facilities, where they can ask questions about the
process.
84
General Rules for Observers
Observers may:
• Observe the proceedings at the polls, including the opening and closing procedures.
• Obtain information from the precinct index that is posted near the entrance.
• Make notes and watch all procedures.
• View all activities at the central counting site on election day.
• View the canvass of the vote activities following the election.
• View absentee and provisional ballot processing.
• Ask questions of staff or voters at the polls.
• Ask questions of supervisors at the central counting site.
Observers are responsible for:
• Checking in at each site, whether polling place or central counting site.
• Wearing an identification badge.
• Maintaining a professional manner while observing the election processes.
• Ensuring they do not interfere with the elections process.
Observers may not:
• Interfere in any way with the conduct of the election.
• Touch any voting materials or equipment or sit at the official worktables.
• Converse with voters (within 100 feet of the entrance to a polling place) regarding the
casting of a vote, or speak to a voter regarding his or her qualifications to vote.
• Display any election material or wear campaign badges, buttons or apparel.
• Wear the uniform of a peace officer, a private guard, or security personnel.
• Use cellular phones, pagers, or two-way radios inside the polling place and/or within 100
feet of the entrance to the polling place.
• Talk to central counting site workers while they are processing ballots.
• Use the telephones, computers or other polling place facilities at polling places or the
central counting site.
• Touch election personnel.
• Eat or drink in the polls or the central counting site.
• Assist in operations at any polling place.
4.8 Hardware Maintenance and Preparation
for Use
Purpose
85
The purpose of this document is to provide the end-user with a maintenance schedule to
minimize system component downtime and failure.
Scope
The scope of this document includes end-user maintenance items for BMG, BMD and ISB
Definitions, Acronyms, and Abbreviations
AWS Amazon Web Services
Amazon Cloudfront Amazon CloudFront is a content delivery network
Amazon S3 Amazon Simple Storage Service (S3)
BMD Ballot Marking Device
BMG Ballot Marking Device (BMD) Manager
CDN Content Delivery Network
CIS Contact Image Sensor
CMOS Complementary Metal Oxide Semiconductor
ISB Interactive Sample Ballot
LAT Logic and Accuracy Test
VSAP Voting Solutions for All Peoples
Preventative Maintenance Schedule By System
The routine inspection of system components reduces the risk of major system failures. By
implementing a preventative maintenance regimen, minor issues can be detected and addressed
before failure occurs and renders the system unusable. The following table lists maintenance
items that are usage and calendar based. Perform the maintenance items in the interval or time
specified for each system component.
System
Action Name Schedule/Timing Action/Comments
Component
Archive/back-up, clear
BMG Post-election Per BMG User Guide
logs
Clean/dust the Do not use canned air or
computing equipment similar, or liquids, on the
and networking Every six months equipment. Follow County
equipment; check any incident response procedure
tamper evident seals regarding tampered seals.
86
Every six months and
30 days before pre-
Run diagnostics Per BMG User Guide
LAT, whichever is
more frequent
Every three years or
BMD CMOS battery change upon battery depleted Per BMD User Guide
indication
Clean the BMD touchscreen
Clean for any spills, Every election cycle, using a lint free alcohol wipe
dust, other either as part of pre- before and after every election.
contaminants - before LAT or upon Spot clean the screen using a
every election equipment return lint free cloth every time the
ballot box is emptied as well.
Open the lid, visually inspect
for debris, loose printer parts,
Every time the ballot
clean using compressed air and
box is emptied, or
Printer then a lint free, dust attracting
every 200 ballots cast
cloth to remove any dust; clean
whichever comes first
the CIS (internal scanner) with
lint free alcohol wipes.
Clean for any spills, dust, other
Privacy Flaps Before every election contaminants; inspect for
visible damage.
Clean using a lint free, dust
attracting cloth to remove any
Bar code reader Before every election
dust; check for
scratches/damage to the lens.
Clean any spills, dust, other
Ballot box Before every election contaminants; inspect for
visible damage.
Every election cycle,
either as part of pre- Inspect for visible damage;
Legs
LAT or upon repair/replace if needed.
equipment return
Archive/back-up, clear Per ISB Pre-Processor User
ISB Post-election
logs Guide
Every six months and
30 days before pre-
Per ISB Pre-Processor User
Run diagnostics LAT; whichever
Guide
lends the greater
frequency
87
Check AWS
Agreements to ensure
proper account settings,
Every six months and
S3 bucket availability
30 days before pre- Per County AWS Agreement
as well as correct
LAT
expected capacity, and
verify configuration of
CloudFront (CDN).
88
5. Polling Place Procedures
5.1 Voting Center Supplies, Delivery, and Inspection
This section lists the supplies required to setup the voting location with an emphasis on setting
up the Ballot Marking Device (BMD).
• Cart containing five BMDs or a case with a single BMD
• BMD peripherals (including stand, privacy shield, headphones, and ballot box)
• Cleaning cloths to wipe the BMD Touchscreen
• Paper ballots shall be in the quantity and manner required by the California Elections
Code
• General purpose supplies as provided in the California Elections Code
• Sample ballot booklets of each ballot style if required by the California Elections Code
• Seals and any other supplies and forms
• Tables and chairs
• Power surge protectors
• Power extension cords
• UPS (uninterruptible power supply) if required per jurisdiction procedure
After the carts and containers have arrived, and before the vote center location opens, Election
workers will perform the following actions:
1. Perform a visual inspection of all carts and containers. Inspect and record that all seals
are intact on the outside of all carts and containers as per jurisdictional procedure.
2. Perform a visual inspection of all BMDs. Inspect and record all seals are intact on all
BMDs as per jurisdictional procedure.
3. Setup the BMDs per procedure described in Section 5.2.
89
5.2 Vote Center Set-up
The Ballot Marking Device (BMD) is used by voters to mark and cast a ballot. BMDs will
arrive at the Vote Center in carts, with each cart containing five BMDs.
The BMD is comprised of the following components:
Integrated Ballot Box
Cross-support bar
Headphones
Leg stand
Power cord
Power module
Power module bracket
Privacy shield
BMD top module
Handheld controller
BMD cabinet
The BMD has a headphone jack and auxiliary port for voter's use. There are two headphones
jacks located on the BMD: the first is located on the left-side front of the BMD; the other is
located in the back left-side of the BMD, next to the power button. The auxiliary port is located
on the lower-right side of the BMD.
The BMD Technician will assemble the BMD using the following instructions:
1. Remove the folded leg stand from the peripherals container.
90
2. Pull each leg up and out, one at a time, until all four legs lock into place. Each leg has a
spring-loaded feature that allows it to be pulled outward and lock securely into place.
3. Remove the cross-support bar from the container.
91
4. Line up the grooves on each end of the cross-support bar with the attachment point on
the back legs of the stand. Then, snap them into place, one at a time.
Note: There will be a slight clicking sound that indicates that the cross-support bar is
securely in place.
5. Turn the leg stand over so it is resting on all four legs. The leg stand is assembled with
the cross-support bar locked into place. The stand is ready to have the power cord
attached.
92
6. Remove the power module and the power cord from the cart.
7. Connect the power cord to the base of the power module.
93
8. Remove the power module bracket from the container.
9. Attach the power module inside the power bracket. Use pressure in the middle of the
power bracket when attaching to the leg stand. You will hear a loud snapping sound,
indicating the power bracket has been attached properly.
94
10. Line up the hooks on the back of the power module bracket to the leg stand.
Note: To avoid difficulty connecting the power cord to the power module, it is
necessary to connect the power prior to adding the BMD top module. Do not connect
the other end of the power cord into the wall.
95
11. Attach the BMD top module to the leg stand by aligning the grooves underneath the
BMD top module.
12. Line up the openings on the back of the Integrated Ballot Box with the hooks on the
BMD top module, ensuring that the openings are lined up and securely fit together.
96
13. Slide the Integrated Ballot Box onto both hooks on the lower end of the BMD top
module, then tilt the Integrated Ballot Box slightly upward to snap it into place.
97
14. Attach and record the Serialized Tie in the Chain of Custody per jurisdictional
procedure. In addition, place the tamper-evident seal over the seam of the IBB (see
picture below of tamper-evident seal) and record in the Chain of Custody per
jurisdictional procedure.
98
15. Remove the privacy shield from the BMD container.
99
16. Unfold the privacy shield flaps and attach it to the slotted holes on the sides of the BMD
top module, one side at a time.
100
17. Insert the six-pronged end of the power cord into the six-pronged socket found on the
back of the BMD top module.
18. Plug the power cord into the wall outlet; do not turn the BMD on.
19. Remove the headphones from the BMD container. Place them on the left-hand side of
the BMD top module.
101
20. Plug the headphone cord into the port on the bottom left side of the BMD top
module as displayed.
Note: This ends the BMD top module set up procedure.
102
Additional Ports
Sip and Puff/Dual-Switch Device: There is an additional port in the lower right-hand corner of
the BMD top module that serves as a place to connect personal assistive devices. (Example: Sip
and Puff unit or a dual switch.) See image below.
Additional Headphones Port: There is an additional Headphones Auxiliary Port on the front
of the BMD top module to plug in another set of headphones for another person to assist a voter
who's already using the other port. See image below.
103
Setup Complete
After the setup is complete, the Election Worker must turn on the BMD top module using the
power button on the back.
An auto-diagnostics test of the system will occur; in the event the system fails, an error message
(#4422) will display on the screen. Shut down the BMD and reboot. If the system fails again
after rebooting, an Election Worker should shut down the BMD and report the issue to an
Election Worker Lead.
104
5.2.1 Cleaning the BMD Scanner and Touchscreen
Touchscreen
To maintain and clean the Touchscreen, use lint free alcohol wipes. Pictured below is an
example of a wipe that can be used.
2. Avoid other chemical agents (except for alcohol) to clean the Touchscreen. Do not
spray other cleaning agents directly onto the Touchscreen, as the liquids may seep into the
screen or contaminate the front bezel.
3. Wipe the Touchscreen using gentle wiping motions.
Note: Do not wipe or press the Touchscreen with excessive force.
105
Scanners
There are two scanners on the BMD; the Poll Pass/Security Pass scanner underneath
the right front corner, and the Ballot scanner located within the Paper Handler.
Bar Code Reader
1. To clean the Poll Pass/Security Pass scanner, first locate the glass scanner lens
underneath the front right-side of the BMD.
2. The election worker uses compressed air to remove external dust, followed by polishing
the glass surface with a clean dry cloth.
3. If further cleaning is necessary, use a soft cloth dampened with isopropyl alcohol to wipe
the scanner glass. Do not spray liquid directly on the scanner surface. Do not use any
other cleaning solvents.
106
Ballot Scanner and Printer Rollers
To clean the Ballot Scanner and Printer Rollers, it is necessary to break the Serialized Tie,
open the Integrated Ballot Box, and open the Paper Handler to get access to the scanner.
1. Press the Power Button to turn the BMD off.
2. Remove the security seal on the Integrated Ballot Box. Follow jurisdictional procedure
for removing Serialized Ties.
107
3. Push the button on the upper-left side of the Integrated Ballot Box and pull the back of
the Integrated Ballot Box.
4. Press the button at the center of the plastic top cover and pull the cover upward.
108
5. Pull the metal printer cover upward.
6. Use compressed air to remove external dust.
109
7. Using lint free alcohol wipes, clean the surfaces of the:
• Ballot Scanner Lens (see picture below); and
• Each Printer Roller (see picture below)
Note: Use gentle wiping motions to remove dust. Do not spray liquid directly on the
scanner surface; do not use any other cleaning solvents.
Ballot Scanner
Printer Rollers
110
8. Close the metal printer cover.
9. Close the plastic top cover.
10. Close the Integrated Ballot Box.
111
11. Attach the Serialized Tie per jurisdictional procedure
12. Press the Power Button to turn the BMD back on.
112
5.3 Opening the Polls
This procedure details how two Election Workers can "open the poll" to enable voting on each
BMD. Opening the polls requires proper Credentials which incorporate a 2-factor security
process. These Credentials consist of a six-digit PIN and a QR coded Security Pass that is
generated by the BMG and issued to Election Workers. These Credentials are secured and
passed out per jurisdictional procedure.
1. Check the Serialized Tie per 2. Press the Power 3. The system initializes.
jurisdictional procedure (see button.
picture below), and also check
the tamper-evident seal placed
over the seam of the IBB.
Verify it has not been tampered
(see picture below of tamper-
evident seal).
113
4. Tap anywhere to begin. 5. Scan the Security Pass with the bar code scanner, located
under the BMD on the lower right side.
6. Enter Credentials. 8. Tap Open Polls. 9. Insert blank thermal
paper.
7. Tap System Status. (After the first day of an
election, this button will
read Re-open Polls.)
114
10. The Open Poll Report is printed. Two Election Workers
should verify the report per jurisdictional procedure.
See samples of Open Poll Reports below.
11. Tap Start Voting.
115
12. Voting is enabled.
116
Open Poll Report
Date - The date of the Open Poll Report.
Time - The time the Open Poll Report is printed.
BMD ID - Each BMD has its own unique ID number
HW Test Results - Indicates whether or not the hardware passed the inspection for the BMD
to properly function.
Election Title - The title for the election, i.e. - Presidential Primary Election
Election Jurisdiction - The jurisdiction of the election
Software version - The BMD software version.
OS Version - The BMD Operating System version.
Totals:
Cumulative*
• Total Ballots Printed
• Total Ballots Cast
• Total Emptied Ballot Box
• Total ReOpened
*When Polls are Re-Opened, Cumulative Totals must be reconciled against the previous
day's Closing Poll Report.
These totals should match those on the Close Poll Report with one exception - the Total
ReOpened should equal one plus the previous day's total.
Daily*
• Total Daily Ballots Printed
• Total Daily Ballots Cast
*Daily totals should equal zero - unless polls are opened more than once on the same day.
117
Sample Open Poll Report for the first day of an election
Note: All Totals are Zero.
118
Sample Open Poll Report for when polls are re-opened
Note: Only the Daily Totals are zero.
119
5.4 Polling Procedures
5.4.1 Voting Using the BMD Touchscreen
1. The Election worker provides 3. Choose language of
the voter with an official paper preference.
ballot and directs them to
4. Tap Next.
the BMD.
The BMD Touchscreen displays
a blue screen with the year and
type of election (general or
primary).
2. Touch the circle to start.
120
5. A message instructs the 6. The voter inserts their
voter to Insert your ballot. ballot into the tray on the
right-hand-side of the BMD.
7. Loading ballot is displayed. 8. Ballot loaded is displayed.
121
9. The Let's get started screen 10. The Make your
displays two options: selections screen displays the
following message:
a. I want to start voting – Brings
the voter to the Make your There are x contests on today's
selections screen ballot. When you reach the end,
b. I have a Poll Pass to scan – you will be able to review your
Asks the voter to Scan your Poll selections.
Pass
11. Tap Next to begin voting.
122
12. To make a selection, tap the Candidate Name or Yes/No for a Proposition or Measure.
13. Tap Next to move to the next contest.
Note:
• Marked selections will be highlighted with a check mark (see second screenshot below)
• To deselect, tap the marked selection - which will remove the highlighting and check
mark
• To move past a contest without marking a selection, tap Skip (see third screenshot
below)
123
14. After all selections are made, the Let's 16. The Review your selections screen
Review screen is displayed to notify the voter opens displaying the voter's selections;
they can review their selections. voters can tap the Change button to
make a new selection.
15. Tap Next.
17. Tap Next when finished.
124
18. The Ready to print screen displays 19. Tap Yes - I am ready to print.
the following message:
20. Tap Print.
This is your last chance to go back and
make any changes.
125
22. Ballot printed is displayed.
21. Printing Ballot is displayed.
Once the ballot is printed, the Ready to cast? screen appears and the voter can do the following:
• Cast your ballot now – See the steps below
• Read back my printed ballot – Re-scans the ballot and reads back the voter's selections
through the headphones
• Make a change on the printed ballot – the voter must contact a Election worker;
the Election worker will spoil the ballot and provide the voter with a new ballot per
jurisdictional procedure
126
23. The Ready to 24. Tap Cast your ballot 26. Reinsert the ballot into
cast? screen displays the now. t he BMD.
following message:
25. Tap Next.
Verify your printed ballot
before casting.
127
27. The Casting 28. Ballot has been cast is 29. The Thanks for
ballot screen displays the d isplayed. Voting! screen displays the
following message: following message:
Please wait, your ballot is Take your printed ballot to
being placed into the an Election worker for
ballot box. assistance.
128
5.4.2 Using a Poll Pass
A voter can go online and access their Interactive Sample Ballot. They can then digitally mark
their sample ballot using a computer or personal device prior to going to a Vote Center. Voter
selections are captured in a QR code that can either be printed onto paper or downloaded to their
personal device. This is called a Poll Pass. A sample of the Poll Pass is shown below. When the
voter arrives at the Vote Center, they must check in using the normal check-in process.
Printed Poll Pass Mobile Device Poll Pass
After the voter has checked in and received a blank ballot, they will scan their Poll Pass at a
BMD to transfer their selections to the BMD for validation before printing on a paper ballot.
129
1. Touch the circle to start 2. Tap a language. 3. Insert ballot.
the voting process.
130
Message: Ballot loaded 4. Tap I have a Poll Pass to Scan your Poll Pass screen
scan and then click Start. will appear.
5. Place your mobile Poll Message: Poll Pass 6. Review and change
Pass or printed copy of scanned. selections as desired. Then tap
a Poll Pass directly beneath Next.
the scanner located below
the BMD paper deck.
To view additional steps to finish casting a ballot, go to Section 5.4.1 Voting Using the BMD
Touchscreen.
131
5.4.3 Emptying the Ballot Box During the Day
The Integrated Ballot Box is full when 250 ballots (limits set by BMG administrator) are cast
into the Integrated Ballot Box. The BMD screen displays Ballot Box is full. Once
the Integrated Ballot Box is full, an Election worker should empty the Integrated Ballot Box
using the procedure below and secure the ballots according to jurisdictional procedure.
1. Screen will display Integrated Ballot Box is full.
132
2. Scan Security Pass under the right-side of BMD.
3. Enter Credentials.
4. Tap Enter Poll Menu.
133
5. Tap Empty Ballot Box on the System Status menu.
134
6. Remove the tamper-evident seal from seam of the IBB and the Serialized Tie on
the Integrated Ballot Box per jurisdictional procedure; record removal by logging the
serial number into the Chain of Custody.
7. Push the button on the upper-left side of the Integrated Ballot Box and pull the back of
the Integrated Ballot Box outward.
135
8. Remove ballots from Integrated Ballot Box.
136
9. Close Integrated Ballot Box and listen for a clicking sound, which indicates
the Integrated Ballot Box is properly closed.
Place a new tamper-evident seal on the seam of the IBB and Serialized
Tie per jurisdictional procedure and log it into the Chain of Custody. Be sure to tightly
cinch the Serialized Tie to ensure the IBB is secured.
137
10. Tap Confirm all ballots were removed.
11. Tap Start Voting from the menu.
138
5.4.4 Restarting BMD After Interruption
When a BMD is restarted, it keeps the last status prior to the interruption. If the BMD is
interrupted during the day, for example, by a power failure, one of the following status messages
is displayed on the BMD screen:
• Re-Open Polls
• Open Polls
• Start Voting
If a ballot was left in the BMD when an interruption occurred, the ballot is ejected from the
BMD when the power is restored. The ballot is handled according to jurisdictional procedures.
To restart a BMD after an interruption, follow this procedure.
139
2. After the system initializes, 3. Scan Security Pass.
4. Enter Credentials, and
tap the check mark on the
then tap Enter Poll Menu.
System Ready screen. The
Enter Credentials screen
displays.
5. One of the three screens below will be shown. Tap either Re-Open Polls, Open Polls, or
Start Voting.
Note: Please refer to the Opening the Polls procedure for additional directions.
140
5.4.5 Dealing with Fleeing Voters
This procedure details what an Election Worker should do when a voter has left before casting
their ballot.
1. If during a voting session, 2. After an additional period 3. The Election Worker will
the voter stops interacting of time (set by the BMG enter their Credentials and
with the BMD for an administrator), the BMD select Enter Poll Menu.
administrator-specified will lockout. The LED will
period of time, the system flash yellow indicating the
will display the screen BMD has been timed-out.
below. Note: If the voter has At the bottom of the screen,
not fled, the voter can select the system will say: Notify
Continue voting session. an authorized election
worker.
4. The system automatically ejects the ballot and returns to the Welcome Screen.
Follow jurisdictional procedures to cast the ballot. See section 5.4.1 Voting Using the BMD
Touchscreen for system steps.
141
5.5 Voters with Disabilities and Voters using Audio Features
This section describes procedures for voters utilizing the audio feedback, handheld controller,
and customized screen settings.
5.5.1 Auxiliary Device and Ports
The BMD has two auxiliary ports, and one connected device which enables voters to mark and
cast their ballots.
• Handheld Controller
• Headphones Jack
• Dual-Switch Port
Handheld Controller
The Handheld Controller allows the voter to use the BMD without having to touch the screen
to navigate and mark their selections on the ballot. Braille is provided for voters with a visual
impairment. The Handheld Controller has several components available for the voter, such as
Help, Audio Volume, Pause, and Playback Rate. There are also four directional arrow buttons
used to navigate, and a round button used to mark selections.
Handheld Controller
142
See table below for controller functionality:
Component/Location Use/Functionality Braille
Help Press this button to access the help menu Yes
Audio Volume Press the audio button to increase or decrease the volume Yes
Pause Press the pause button to pause the voting process Yes
Select Button Press to select Candidate/Measure No
Rate Press the rate buttons to increase or decrease the rate of speed Yes
for listening to the ballot
Arrow Up Press the arrow up to listen to the contest name above current No
candidate, Proposition/Measure
Arrow Down Press the arrow down to listen to the contest name below the No
current candidate, Proposition/Measure
Arrow Right Press the arrow to the right to make a selection to the right No
Arrow Left Press the arrow to the left to make a selection to the left No
Headphone Ports
Headphones are located on the top left corner of the BMD and are plugged into the
Headphones Jack located on the rear left-hand side, which automatically and continuously
plays the audio voting instructions. There is an additional audio port provided at the left front of
the BMD where a voter may plug in their own headphones. Both audio ports remain active at all
times in case the voter desires a helper to listen to the voting session at the same time. The two
audio ports are always at the same volume level and playback speed—changing the volume level
or playback speed always affects both audio ports. The voter can plug in or unplug Headphones
from either of the headphones jacks at any time, with no resulting message displayed by the
BMD application. The audio can only be played in the language displayed on the screen.
Dual-Switch Port
The right-front port is for connecting any Dual-Switch compatible device, such as a Sip and
Puff assistive technology controller. The BMD application detects when a device is plugged into
the port and shows a Dual-Switch specific configuration page that also informs the voter that if
they are trying to plug in Headphones, they should use the headphones jack. The audio will
always be available when using the system regardless of what voting method is being used, i.e.:
Touchscreen, Audio, or Poll Pass. The language displayed on the Touchscreen will be the
same language used when using the audio voting feature.
143
5.6 Provisional Voters
This section details the procedure for assisting provisional voters. These voters receive a ballot
containing a QR code indicating the vote is provisional. The voter's experience is the same with
one exception - the voter cannot cast their ballot into the Integrated Ballot Box. Instead, they
place their ballot in an envelope and return it to an Election Worker who will place the
envelope in the Integrated Ballot Box per jurisdictional procedure.
Note: The same procedure is used across precincts.
After marking their selections using the BMD, the voter will follow the steps below:
1. Tap Complete voting 3. Remove the provisional 4. The screen displays
session on the Ready to cast? ballot and return it to an Thanks for voting!
screen. Election Worker.
2. Tap Next.
144
5.7 Closing the Polls and Vote Reporting
Follow the steps below when Closing the Polls at the end of each election day. Closing the
Polls requires an Election Worker to insert thermal printer paper to print a Close Poll
Report (see example below). The Integrated Ballot Box is also emptied when Closing the
Polls. After closing the polls, a Close the Polls report is printed. The Close the Polls report will
include cumulative and daily totals for the BMD. Election Workers must use this report to
reconcile with the Open Polls report the following morning. This procedure must be used at
each BMD.
1. Scan a Security Pass with the 2. Enter Credentials. 4. Tap Close the Polls.
bar code scanner, located under 3. Tap Enter Poll Menu.
the BMD on the lower-right side.
145
5. Remove the ballots from 6. Remove the tamper-evident 7. Push the button on the upper-
the Integrated Ballot Box. seal from seam of the IBB and left side of the Integrated
the Serialized Tie on Ballot Box and pull the back of
the Integrated Ballot Box per the Integrated Ballot Box
jurisdictional procedure; record outward.
removal by logging the serial
number into the Chain of
Custody.
146
8. Remove all ballots from 9. Close the Integrated Ballot 11. Tap Confirm all
the Integrated Ballot Box. Box and listen for a clicking sound, ballots were removed.
which indicates the Integrated
Ballot Box is properly closed.
10. Place a new tamper-evident seal
on the seam of the
IBB and Serialized Tie per
jurisdictional procedure and log it
into the Chain of Custody.
147
12. Insert a blank sheet of thermal paper. 13. The Close Poll Report is printed.
148
Sample of a Close Poll Report
Note: This Close Poll Report must be signed by two Election Workers and reconciled per
jurisdictional procedure.
149
14. Tap the Shutdown icon located in the 15. Tap Shut Down to power down the BMD.
upper-left side.
150
Sample Close Poll Report
Note: This Close Poll Report must be signed by two Election workers and reconciled per jurisdictional
procedure.
151
5.8 Securing Audit Logs and Backup Records
See Section 10.5 Audit Trails.
152
5.9 Troubleshooting and Problem Resolution
This procedure details how an Election worker can troubleshoot the following issues:
• Printer has a paper jam
• BMD cannot read a Ballot
• BMD Touchscreen is frozen
• Headphones are not working
Problem: Printer has a paper jam
If a paper jam occurs in the scanner/printer, the BMD will display an error screen notifying the
voter there is a Printer Paper Jam. Call an Election worker for assistance. The screen will
display instructions to the Election worker on how to manually remove the jammed ballot.
1. When there is a paper jam, the BMD screen will display Printer Paper Jam.
153
2. Scan Security Pass.
3. Enter Credentials and Press Continue.
154
4. The following screen will appear, Resolve Paper Jam
5. Remove the tamper-evident seal from seam of the IBB and the Serialized Tie on
the Integrated Ballot Box per jurisdictional procedure; record removal by logging the
serial number into the Chain of Custody.
155
6. Push the button on the upper-left side of the Integrated Ballot Box and pull the back of
the Integrated Ballot Box outward.
7. Press the button at the center of the plastic top cover and pull the top cover outward.
156
8. Open the metal printer cover upward.
9. Pull the entire metal printer tray upward.
157
10. Remove the jammed paper from the printer.
11. Close the metal printer tray.
158
12. Close the Plastic Top Cover.
13. Close the Integrated Ballot Box.
159
14. Place a new tamper-evident seal on the seam of the IBB and Serialized
Tie per jurisdictional procedure and log it into the Chain of Custody. Be sure to tightly
cinch the Serialized Tie to ensure the IBB is secured.
15. Tap Next on the Resolve Paper Jam screen.
160
16. The touchscreen will prompt the Election Worker to scan their Security Pass.
161
17. Enter Credentials.
18. Tap Continue.
19. If the Ballot jammed as the voter was printing the Ballot, tap Continue where voter left
off. Selecting this option will prompt the BMD to reprint the voter's ballot. If the Ballot
jammed when entering the BMD, tap Cancel voting session and restart. Note: The
screen below will only display this option.
162
20. Escort the voter to the Check-in Clerk where a replacement ballot will be printed and
given to the voter. Follow jurisdictional procedure to spoil the damaged Ballot. Load the
new blank ballot into the BMD. If the paper jammed while the ballot was printing, the
BMD will reprint the ballot at this stage.
Problem: BMD cannot read a Ballot
1. Unlock BMD with security credentials and retrieve Ballot
2. Check if the ballot is damaged
a. If the ballot is damaged, spoil the ballot and issue a new ballot
3. If the ballot is undamaged insert the ballot again
4. If the error message happens again, move voter to a second BMD
a. If the ballot cannot be read on the second BMD, spoil the ballot and issue a new
ballot
b. If the ballot can be read on the second BMD:
i. Clean the Scanner on the first BMD
1. If the first BMD cannot read another ballot, remove it from service
Problem: BMD Touchscreen is frozen
1. Turn the BMD off and then back on again
2. If the Touchscreen remains frozen, remove the BMD from service
Problem: Headphones are not working
163
1. If the headphones are not 2. If the headphones still do not 3. If the headphones still do not
working, check that the work, plug the headphones into work, replace the headphones
headphones are plugged into an the other audio port and try and try a new pair of
audio port. again. headphones.
4. If the new headphones 5. The Election worker will power down the 6. If the headphones
do not work, move the original BMD. continue to
headphones Follow the steps in section 3.3.5 Restarting the malfunction with the
to another BMD. If the BMD after an Interruption. original BMD, the
headphones function Election Worker
properly in the new BMD, removes
the voter will move to the the BMD from
new BMD and continue service.
voting from there.
164
6. Absentee/Mail Ballot Procedures
6.1 System Startup and Pre-Tabulation Report Procedures
This section covers the main installation process for Tally. It can be executed either as a step-by-
step walk through or by command flags. For new users, the step-by-step mode is recommended.
Configuration
When the main installer starts, it will require the user to specify the nodes that will be included in
the cluster, as well as their type.
The first node to be setup will be the deployment system. The deployment system configuration
cannot be changed once in the current version of the installer, so double check the inputted
values before submitting the information. Also, the first node is where HA proxy is deployed and
will be the entry point for Tally through the web browser.
Below is an example configuration once the first master system has been setup:
Next you will have the option to: 1) Enter a new node, 2) remove an existing node, 3) Finished.
If the only node that has been setup is the deployment node, you will not be able to remove an
existing node. Entering a new node will lead to a multi-node cluster and finishing the setup will
lead to a single-node cluster.
On a multi-node cluster, it is mandatory to set at least one:
• master node
165
• compute node
• provider node
If a file node is not added to the configuration, then the file sharing steps will be skipped
altogether.
Below is an example of a valid multi-node cluster setup, which appears once you finish the
setup:
The output above will be paired with the following prompt:
Entering 'y' will end the configuration and proceed to the next step in the installer. Entering 'n'
will allow you to make changes to the configuration. As a reminder, the only node that cannot be
modified is the first master system.
The last step in node configuration is to name the configuration:
Keep track of the name you use for the cluster. If the installation is interrupted past this prompt,
you will need to input the name to continue with the installation of Tally. Otherwise, you will
need to redo the node configuration.
Starting Tally
166
Once the cluster and its various nodes have been set up and the Docker registry has been loaded
onto the cluster, the Tally system can be started by running the create_all script.
To do this, run the following:
After this process is complete, check kubernetes system pods and the cluster nodes to check the
cluster’s status:
The [deployment-system-hostname] can be referenced in the example configuration output. This
will compile template files for the tally system into .yaml files to create kubernetes pods.
This process includes 3 flags: --node-color , --kube-create, and --development..
-k --kube-create indicates that the process should also create k8s pods based on the compiled
.yml files, which will start the Tally system.
Regardless of deployment type, the system may take several minutes to start.
To determine when the system is ready for viewing, check the tallymanager-deployment pod’s
log to determine if tallymanager is completely spun up yet:
6.2 Tabulation Procedures
After all the ballots have gone through Receive, Recognize, and Refine, the user can view
reports. From the Home page header, navigate via the main menu drop-down to Reports >
Tabulation. Please note that a tabulator's first tabulation event must not happen before 8 p.m.
local time on the night of the election. This is fully managed through the election process.
167
Figure: Tabulate/Reports main page
6.2.1 To generate a report:
1. From the heading drop-down, select the election that needs reports run.
2. Set the test/production toggle to match the type of ballots processed.
3. Refresh the page.
4. Select the type of report needed -- Tabulation (overall), by scanner, by contest, or box
tabulation.
5. For Tabulation Report, click the “Generate Reports” button, and after a short time a new
Press Bulletin link will be generated along with supporting downloadable files. Click on
the Press Bulletin link and review the Semi-Final Election results that display in a new
browser tab.
6.2.2 To generate a final report:
1. Select the type of report needed and click on the “Generate Final Reports” button. After a
short time, a new Press Bulletin link will be generated with a “Yes” in the Final column.
2. Click on the Press Bulletin link and review the Final Election results that display in a
new browser tab.
6.3 Post-Tabulation Report and Shutdown Procedures
To stop the tally system and delete running services, run
This will delete all resources generated by files found in the configuration dist directory.
To check that all resources have been deleted, run the following command:
168
169
7. Semi-Official Canvass
Purpose
Officials will comply with the Use Procedures approved by the Secretary of State for the VSAP
Voting System.
7.1 System start-up and pre-tabulation reports
Once the Tally System Environment is set up and the election is configured you can start the
system for tabulation.
Start Tally Services
The first step is to start the Tally System services. To start the services you provide a start script.
There are several command line options that will need to be provided for different setups.
The following are the individual commands that can be run to start the services:
The -t/--type argument accepts two valid options, “services” and “providers”. If the type
parameter is not passed, the run script will assume it is being executed on the single Tally
machine deployment. The scripts are run from the /opt/tally directory.
• sudo python scripts/run.py # single node Tally machine deployment
• sudo python scripts/run.py -t services # services machine deployment
• sudo python scripts/run.py -t providers # providers machine deployment
If this is the first time starting the environment, or if the database has been cleared, provide the -
seed argument (or --seed-db argument) to empty and recreate the base schema for tally in the
database. This will erase all existing database data. For single node deployment, the script should
be run on the Tally System machine. For the two node deployment, the script should be run on
providers machine.
• Single node Tally System machine
sudo python scripts/run.py -seed
• Two node providers machine
sudo python scripts/run.py -seed -t providers
If the -d/--detached argument is passed, the Tally System will start detached from terminal,
running as a background process:
• sudo python scripts/run.py -d
VSAP Tally Manager
170
The Tally Manager is the Tally System user interface. It is designed to work on the Google
Chrome browser. Other browsers are not supported.
1. Open the Chrome Browser.
2. Enter address "192.168.7.80".
3. Log in.
Processing VBM Ballots
All staff processing VBM ballots are required to check in with a Tally System supervisor and
sign a log in sheet with date, time and scan station. When work is completed or assignments
change, staff are to sign out with date, time and scan station.
VBM ballot processing roles per scanner:
• One staff operating the scanner. Role includes loading, removing and starting the
scanner.
• One supervisor is responsible for managing and monitoring a scanner.
• Input runners are used for moving boxes of unprocessed ballots to scanners and assist
preparing ballots for scanner operator including unboxing and jogging ballots.
• Output runners used to box processed ballots and move them to staging area for ballot
storage.
• One snag Operator for every two scanners. Manages ballots not able to be processed by
the scanner and reports them to ballot remakes.
• Ballot storage operators scan processed ballot boxes with a storage location.
Instructions on operating the ballot scanners are available in the System Operation Manual .
7.2 Processing vote reports
Once all the ballots have gone through Receive, Recognize, and Refine and have returned to
IDLE status, the user can view reports.
From the Home page header, click on a menu tab labeled Tabulate/Reports . This displays a
page with two subsections: Generate New Reports and Past Tabulation Reports.
1. Click the Generate Reports button, and after a short time a new Tabulation ID link will
be generated.
171
2. Click on the Tabulation ID link and review the Semi-Final Election results that display in
a new browser tab.
3. Navigate back to the Tabulate/Reports tab and click on the Generate Final Reports
button, and after a short time, a new Tabulation ID link will be generated.
4. Click on the Tabulation ID link and review the Final Election results that display in a new
browser tab.
Once both the Semi-Final Election Results and Final Election Results pages have been reviewed,
you may close the browser tabs. Navigating back to the Reports browser tab, you may reload the
page and see that new entries under Past Tabulation Reports now display. These were the reports
that you previously generated.
7.2.1 Central tabulation
Tabulation can begin once the Tally System is configured, services have started and the Tally
Manager has been logged on.
7.2.2 Precinct tabulation
Not Applicable. Ballots tabulated centrally.
7.3 Integration with other systems and Calvoter
Aggregator Application
The Aggregator Application integrates election results between the MTS system with the Tally
System. The Aggregator Application is a command line driven application. Below are the basic
commands to aggregate totals.
For help on available commands and syntax type: ./aggregate -help
The mts_summary.dat (MTS results file) and vsap.json (Tally System results file) that need to be
aggregated are put into the “inputs” folder. These files are copied using removable digital
media.
Type the following to start aggregating the totals: ./aggregate
The following result files are put into the output and archive folder:
• Mts_summary.dat - New aggregated results in MTS result file format
• Press.html - Semi-Official Results Press Bulletin
• Lna.html - Logic and Accuracy Results Report. Contains a matrix of counter and value
• Vsap.json - New aggregated results in Tally System results file format
172
To create a version of Final Official Press Bulletin enter the following command: ./aggregate -
final=true
Calvoter
Officials' MTS and ECBMS complies with election night vote reporting using electronic files.
These reports are put in the the Secretary of State CalVoter II system sftp. The CalVoter II
system retrieve the report, transfer the data to the database, and process the information into the
elections reporting system.
173
8.0 Official Canvass and Post-Election
Procedures
8.1 Election Observer Panel
Purpose
The purpose of Election Observers is to:
Provide an avenue for public observation of and input into the election process.
Assist in ensuring the integrity of the election process.
Encourage participation and build voter confidence in the election process.
Invitation
Between E-60 and E-30, prepare a media release and letters of invitation (see samples attached)
to parties likely to participate, such as the following:
County Grand Jury
Political Party Central Committee Members
Language Advocacy Groups
Community Based Organizations
Media
Other groups or individuals expressing an interest in observing election day activities may also
be included in the observer panel, as deemed appropriate.
Group Presentations:
After letters of invitation have been sent out, offer to attend group meetings to provide an
opportunity for the groups to ask questions about the process. Groups should be contacted to
arrange time on their agendas for staff presentations. This is optional at the request of the group,
but staff should make every effort to contact the groups and offer this service.
Appointment Letters (for introduction to precinct workers)
After the groups have provided the names of interested panelists, prepare letters of introduction
(see sample attached) for the panelists to use when visiting polling places on Election Day.
Materials to be prepared for each panelist will include a listing of all polling places within the
county for that specific election as well as the central counting site location and hours of
operation.
Mechanism for Feedback
Observers attend training at government facilities, where they can ask questions about the
process.
General Rules for Observers
Observers may:
174
Observe the proceedings at the polls, including the opening and closing procedures.
Obtain information from the precinct index that is posted near the entrance.
Make notes and watch all procedures.
• View all activities at the central counting site on election day.
• View the canvass of the vote activities following the election.
• View absentee and provisional ballot processing.
• Ask questions of staff or voters at the polls.
• Ask questions of supervisors at the central counting site.
Observers are responsible for:
• Checking in at each site, whether polling place or central counting site.
• Wearing an identification badge.
• Maintaining a professional manner while observing the election processes.
• Ensuring they do not interfere with the elections process.
Observers may not:
• Interfere in any way with the conduct of the election.
• Touch any voting materials or equipment or sit at the official worktables.
• Converse with voters (within 100 feet of the entrance to a polling place) regarding the
casting of a vote, or speak to a voter regarding his or her qualifications to vote.
• Display any election material or wear campaign badges, buttons or apparel.
• Wear the uniform of a peace officer, a private guard, or security personnel.
• Use cellular phones, pagers, or two-way radios inside the polling place and/or within 100
feet of the entrance to the polling place.
• Talk to central counting site workers while they are processing ballots.
• Use the telephones, computers or other polling place facilities at polling places or the
central counting site.
• Touch election personnel.
• Eat or drink in the polls or the central counting site.
• Assist in operations at any polling place.
175
8.2 Canvassing Precinct Returns
Time for Conducting Canvass
The canvass shall commence no later than the Thursday following the election, shall be open to
the public, and, for state or statewide elections, shall result in a report of results to the Secretary
of State. The canvass shall be continued daily, Saturdays, Sundays, and holidays excepted, for
not less than six hours each day until completed.
Tasks of the Official Canvass
The official canvass shall include, but not be limited to, the following tasks:
(a) An inspection of all materials and supplies returned by poll workers.
(b) A reconciliation of the number of signatures on the roster with the number of ballots recorded
on the ballot statement.
(c) In the event of a discrepancy in the reconciliation required by subdivision (b), the number of
ballots received from each polling place shall be reconciled with the number of ballots cast, as
indicated on the ballot statement.
(d) A reconciliation of the number of ballots counted, spoiled, canceled, or invalidated due to
identifying marks, overvotes, or as otherwise provided by statute, with the number of votes
recorded, including vote by mail and provisional ballots, by the vote counting system.
(e) Processing and counting any valid vote by mail and provisional ballots not included in the
semifinal official canvass.
(f) Counting any valid write-in votes.
(g) Reproducing any damaged ballots, if necessary.
(h) Reporting final results to the governing board and the Secretary of State, as required.
Examination of Materials Returned from the Precincts
In jurisdictions using a central counting place, the elections official may appoint not less than
three deputies to open the envelopes or containers with the materials returned from the precincts.
If, after examination, any of the materials are incomplete, ambiguous, not properly authenticated,
or otherwise defective, the precinct officers may be summoned before the elections official and
examined under oath to describe polling place procedures and to correct the errors or omissions.
176
8.3 Canvassing Absentee Ballots
Processing and Counting Vote By Mail Ballots
Vote by mail ballots and mail ballot precinct ballots returned to the elections office and to the
polls on or before election day that are not included in the semifinal official canvass phase of the
election, including any ballots returned to another jurisdiction in the state and forwarded to the
elections official who issued the ballot, shall be processed and counted during the official
canvass as described below.
Processing Vote By Mail Ballots
(a) Any jurisdiction in which vote by mail ballots are cast may begin to process vote by mail
ballot return envelopes beginning 29 days before the election. Processing vote by mail ballot
return envelopes may include verifying the voter’s signature on the vote by mail ballot return
envelope and updating voter history records.
(b) Any jurisdiction having the necessary computer capability may start to process vote by mail
ballots on the 10th business day before the election. Processing vote by mail ballots includes
opening vote by mail ballot return envelopes, removing ballots, duplicating any damaged ballots,
and preparing the ballots to be machine read, or machine reading them, including processing
write-in votes so that they can be tallied by the machine, but under no circumstances may a vote
count be accessed or released until 8 p.m. on the day of the election. All other jurisdictions shall
start to process vote by mail ballots at 5 p.m. on the day before the election.
(c) Results of any vote by mail ballot tabulation or count shall not be released before the close of
the polls on the day of the election.
Observation of Vote By Mail Ballot Processing and Counting
(a) The processing of vote by mail ballot return envelopes, and the processing and counting of
vote by mail ballots, shall be open to the public, both prior to and after the election.
(b) A member of the county grand jury, and at least one member each of the Republican county
central committee, the Democratic county central committee, and of any other party with a
candidate on the ballot, and any other interested organization, shall be permitted to observe and
challenge the manner in which the vote by mail ballots are handled, from the processing of vote
by mail ballot return envelopes through the counting and disposition of the ballots.
(c) The elections official shall notify vote by mail voter observers and the public at least 48 hours
in advance of the dates, times, and places where vote by mail ballots will be processed and
counted.
(d) Vote by mail voter observers shall be allowed sufficiently close access to enable them to
observe the vote by mail ballot return envelopes and the signatures thereon and challenge
whether those individuals handling vote by mail ballots are following established procedures,
including all of the following:
(1) Verifying signatures and addresses on the vote by mail ballot return envelopes by comparing
them to voter registration information.
177
(2) Duplicating accurately damaged or defective ballots.
(3) Securing vote by mail ballots to prevent tampering with them before they are counted on
election day.
(e) A vote by mail voter observer shall not interfere with the orderly processing of vote by mail
ballot return envelopes or the processing and counting of vote by mail ballots, including the
touching or handling of the ballots.
Challenges
Prior to processing and opening the identification envelopes of vote by mail voters, the elections
official shall make available a list of vote by mail voters for public inspection, from which
challenges may be presented. Challenges may be made for the same reasons as those made
against a voter voting at a polling place. In addition, a challenge may be entered on the grounds
that the ballot was not received within the time provided by this code or that a person is
imprisoned for a conviction of a felony. All challenges shall be made prior to the opening of the
identification envelope of the challenged vote by mail voter.
Except as otherwise provided, the processing of vote by mail ballot return envelopes, the
processing and counting of vote by mail ballots, and the disposition of challenges of vote by mail
ballots shall be according to the laws now in force pertaining to the election for which they are
cast. Because the voter is not present, the challenger shall have the burden of establishing
extraordinary proof of the validity of the challenge at the time the challenge is made.
If a challenge is overruled, the board shall open the identification envelope without defacing the
affidavit printed on it or mutilating the enclosed ballot and, without viewing the ballot, remove it
and destroy the numbered slip, if any remains, and store the ballots in a secure location.
If a challenge is allowed, the board shall endorse on the face of the identification envelope the
cause of the challenge and its action thereon.
Comparing of Signatures
(a) (1) Upon receiving a vote by mail ballot, the elections official shall compare the signature on
the identification envelope with either of the following to determine if the signatures compare:
(A) The signature appearing on the voter’s affidavit of registration or any previous affidavit of
registration of the voter.
(B) The signature appearing on a form issued by an elections official that contains the voter’s
signature and that is part of the voter’s registration record.
(2) In comparing signatures pursuant to this section, the elections official may use facsimiles of
voters’ signatures, provided that the method of preparing and displaying the facsimiles complies
with the law.
(3) In comparing signatures pursuant to this section, an elections official may use signature
verification technology. If signature verification technology determines that the signatures do not
178
compare, the elections official shall visually examine the signatures and verify that the signatures
do not compare.
(4) The variation of a signature caused by the substitution of initials for the first or middle name,
or both, is not grounds for the elections official to determine that the signatures do not compare.
(b) If upon conducting the comparison of signatures pursuant to subdivision (a) the elections
official determines that the signatures compare, he or she shall deposit the ballot, still in the
identification envelope, in a ballot container in his or her office.
(c) If upon conducting the comparison of signatures pursuant to subdivision (a) the elections
official determines that the signatures do not compare, the identification envelope shall not be
opened and the ballot shall not be counted. The elections official shall write the cause of the
rejection on the face of the identification envelope only after completing the procedures
described in subdivision (d).
(d) (1) A minimum of eight days prior to the certification of the election, the elections official
shall provide notice to all voters identified pursuant to subdivision (c) of the opportunity to
verify their signatures no later than 5 p.m. two days prior to the certification of the election.
(2) The notice and instructions shall be in substantially the following form:
“READ THESE INSTRUCTIONS CAREFULLY. FAILURE TO FOLLOW THESE
INSTRUCTIONS MAY CAUSE YOUR VOTE BY MAIL BALLOT NOT TO COUNT.
1. We have determined that the signature you provided on your vote by mail ballot does not
match the signature(s) on file in your voter record. In order to ensure that your vote by mail
ballot will be counted, the signature verification statement must be completed and returned as
soon as possible.
2. The signature verification statement must be received by the elections official of the county
where you are registered to vote no later than 5 p.m. two days prior to certification of the
election.
3. You must sign your name where specified on the signature verification statement (Voter’s
Signature).
4. Place the signature verification statement into a mailing envelope addressed to your local
elections official. Mail, deliver, or have the completed statement delivered to the elections
official. Be sure there is sufficient postage if mailed and that the address of the elections
official is correct.
5. If you do not wish to send the signature verification statement by mail or have it delivered,
you may submit your completed statement by email or facsimile transmission to your local
elections official using the information provided.”
(3) The elections official shall not reject a vote by mail ballot identified pursuant to subdivision
(c) if each of the following conditions is satisfied:
(A) The voter delivers, in person, by mail, by fax, or by email, a signature verification statement
signed by the voter and the elections official receives the statement no later than 5 p.m. two days
179
prior to the certification of the election, or the voter, before the close of the polls on election day,
completes and submits a signature verification statement to a polling place within the county or a
ballot dropoff box.
(B) Upon receipt of the signature verification statement, the elections official shall compare the
signature on the statement with the signature on file in the voter’s record.
(i) If upon conducting the comparison of signatures the elections official determines that the
signatures compare, he or she shall deposit the ballot, still in the identification envelope, in a
ballot container in his or her office.
(ii) If upon conducting the comparison of the signatures the elections official determines that the
signatures do not compare, the identification envelope shall not be opened and the ballot shall
not be counted. The elections official shall write the cause of the rejection on the face of the
identification envelope.
(4) The signature verification statement shall be in substantially the following form and may be
included on the same page as the notice and instructions specified in paragraph (2):
“SIGNATURE VERIFICATION STATEMENT
I,, am a registered voter of __________ County,
State of California. I declare under penalty of perjury that I requested and returned a vote by
mail ballot. I am a resident of the precinct in which I have voted, and I am the person whose
name appears on the vote by mail ballot envelope. I understand that if I commit or attempt any
fraud in connection with voting, or if I aid or abet fraud or attempt to aid or abet fraud in
connection with voting, I may be convicted of a felony punishable by imprisonment for 16
months or two or three years. I understand that my failure to sign this statement means that my
vote by mail ballot will be invalidated.
Voter’s Signature
Address”
(5) An elections official shall include the vote by mail ballot signature verification statement and
instructions provided in this subdivision on his or her Internet Web site, and shall provide the
election official’s mailing address, email address, and facsimile transmission number on the
Internet Web page containing the statement and instructions.
(6) If the elections official determines that the signatures compare, the official shall use the
signature in the signature verification statement, even if returned untimely, to update the voter’s
signature for future elections.
(e) (1) (A) Notwithstanding any other law, if an elections official determines that a voter has
failed to sign the identification envelope, the elections official shall not reject the vote by mail
ballot if the voter does any of the following:
(i) Signs the identification envelope at the office of the elections official during regular business
hours before 5 p.m. on the eighth day after the election.
180
(ii) Before 5 p.m. on the eighth day after the election, completes and submits an unsigned ballot
statement in substantially the following form:
“UNSIGNED BALLOT STATEMENT
I,, am a registered voter of __________ County,
State of California. I declare under penalty of perjury that I requested and returned a vote by
mail ballot and that I have not and will not vote more than one ballot in this election. I am a
resident of the precinct in which I have voted, and I am the person whose name appears on the
vote by mail ballot envelope. I understand that if I commit or attempt any fraud in connection
with voting, or if I aid or abet fraud or attempt to aid or abet fraud in connection with voting, I
may be convicted of a felony punishable by imprisonment for 16 months or two or three years.
I understand that my failure to sign this statement means that my vote by mail ballot will be
invalidated.
Voter’s Signature
Address”
(iii) Before the close of the polls on election day, completes and submits an unsigned ballot
statement, in the form described in clause (ii), to a polling place within the county or a ballot
dropoff box.
(B) If timely submitted, the elections official shall accept any completed unsigned ballot
statement. Upon receipt of the unsigned ballot statement, the elections official shall compare the
voter’s signature on the statement in the manner provided by this section.
(i) If the elections official determines that the signatures compare, he or she shall attach the
unsigned ballot statement to the identification envelope and deposit the ballot, still in the
identification envelope, in a ballot container in his or her office.
(ii) If the elections official determines that the signatures do not compare, the identification
envelope shall not be opened and the ballot shall not be counted.
(C) An elections official may use methods other than those described in subparagraph (A) to
obtain a voter’s signature on an unsigned identification envelope.
(2) Instructions shall accompany the unsigned ballot statement in substantially the following
form:
“READ THESE INSTRUCTIONS CAREFULLY BEFORE COMPLETING THE
STATEMENT. FAILURE TO FOLLOW THESE INSTRUCTIONS MAY CAUSE YOUR
BALLOT NOT TO COUNT.
1. In order to ensure that your vote by mail ballot will be counted, your statement should be
completed and returned as soon as possible so that it can reach the elections official of the
county in which your precinct is located no later than 5 p.m. on the eighth day after the
election.
2. You must sign your name on the line above (Voter’s Signature).
181
3. Place the statement into a mailing envelope addressed to your local elections official. Mail,
deliver, or have delivered the completed statement to the elections official. Be sure there is
sufficient postage if mailed and that the address of the elections official is correct.
4. If you do not wish to send the statement by mail or have it delivered, you may submit your
completed statement by facsimile or email transmission to your local elections official, or
submit your completed statement to a polling place within the county or a ballot drop-off box
before the close of the polls on election day.”
(3) An elections official shall include the unsigned ballot statement and instructions described in
this subdivision on his or her Internet Web site, and shall provide the elections official’s mailing
address, email address, and facsimile transmission number on the Internet Web page containing
the statement and instructions.
(f) A ballot shall not be removed from its identification envelope until the time for processing
ballots. A ballot shall not be rejected for cause after the identification envelope has been opened.
182
8.4 Canvassing Provisional Ballots
Voting a Provisionally Cast Ballot
(a) At all elections, a voter claiming to be properly registered, but whose qualification or
entitlement to vote cannot be immediately established upon examination of the roster for the
precinct or upon examination of the records on file with the county elections official, shall be
entitled to vote a provisional ballot as follows:
(1) An elections official shall advise the voter of the voter’s right to cast a provisional ballot.
(2) The voter shall be provided a provisional ballot, written instructions regarding the process
and procedures for casting the ballot, and a written affirmation regarding the voter’s registration
and eligibility to vote. The written instructions shall include the information set forth in
subdivisions (c) and (d).
(3) The voter shall be required to execute, in the presence of an elections official, the written
affirmation stating that the voter is eligible to vote and registered in the county where the voter
desires to vote.
Handling of Ballot
(b) Once voted, the voter’s ballot shall be sealed in a provisional ballot envelope, and the ballot
in its envelope shall be deposited in the ballot box. All provisional ballots voted shall remain
sealed in their envelopes for return to the elections official in accordance with the elections
official’s instructions. The provisional ballot envelopes specified in this subdivision shall be of a
color different than the color of, but printed substantially similar to, the envelopes used for vote
by mail ballots, and shall be completed in the same manner as vote by mail envelopes.
(c) (1) During the official canvass, the elections official shall examine the records with respect to
all provisional ballots cast. Using the procedures that apply to the comparison of signatures on
vote by mail ballots, the elections official shall compare the signature on each provisional ballot
envelope with the signature on the voter’s affidavit of registration or other signature in the
voter’s registration record. If the signatures do not compare or the provisional ballot envelope is
not signed, the ballot shall be rejected. A variation of the signature caused by the substitution of
initials for the first or middle name, or both, shall not invalidate the ballot.
(2) (A) Provisional ballots shall not be included in any semiofficial or official canvass, except
under one or more of the following conditions:
(i) The elections official establishes prior to the completion of the official canvass, from the
records in his or her office, the claimant’s right to vote.
(ii) The provisional ballot has been cast and included in the canvass.
(iii) Upon the order of a superior court in the county of the voter’s residence.
(B) A voter may seek the court order specified in this paragraph regarding his or her own ballot
at any time prior to completion of the official canvass. Any judicial action or appeal shall have
183
priority over all other civil matters. A fee shall not be charged to the claimant by the clerk of the
court for services rendered in an action under this section.
(3) The provisional ballot of a voter who is otherwise entitled to vote shall not be rejected
because the voter did not cast his or her ballot in the precinct to which he or she was assigned by
the elections official.
(A) If the ballot cast by the voter contains the same candidates and measures on which the voter
would have been entitled to vote in his or her assigned precinct, the elections official shall count
the votes for the entire ballot.
(B) If the ballot cast by the voter contains candidates or measures on which the voter would not
have been entitled to vote in his or her assigned precinct, the elections official shall count only
the votes for the candidates and measures on which the voter was entitled to vote in his or her
assigned precinct.
184
8.5 Canvassing Write-in Votes
Counting of Write-In Votes
Any name written upon a ballot for a qualified write-in candidate, including a reasonable
facsimile of the spelling of a name, shall be counted for the office, if it is written in the blank
space provided and voted as specified below:
(a) For voting systems in which write-in spaces appear directly below the list of candidates for
that office and provide a voting space, no write-in vote shall be counted unless the voting space
next to the write-in space is marked or slotted as directed in the voting instructions, except as
provided in subdivision (f).
(b) For voting systems in which write-in spaces appear separately from the list of candidates for
that office and do not provide a voting space, the name of the write-in candidate, if otherwise
qualified, shall be counted if it is written in the manner described in the voting instructions.
(c) The use of pressure-sensitive stickers, glued stamps, or any other device not provided for in
the voting procedures for the voting systems approved by the Secretary of State to indicate the
name of the write-in candidate are not valid, and a name indicated by these methods shall not be
counted.
(d) Neither a vote cast for a candidate whose name appears on the ballot nor a vote cast for a
write-in candidate shall be counted if the voter has indicated, by a combination of marking and
writing, a choice of more names than there are candidates to be nominated or elected to the
office.
(e) All valid write-in votes shall be tabulated and certified to the elections official on forms
provided for this purpose, and the write-in votes shall be added to the results of the count of the
ballots at the counting place and be included in the official returns for the precinct.
(f) (1) In an election that uses a voting system described in subdivision (a), after tallying all
eligible votes but prior to completion of the official canvass and the issuance of the certified
statement of the results pursuant to this chapter, the elections official, upon the request of a
qualified write-in candidate for an office being voted on in that election for an examination of
undervotes that is received within five days of completion of the semiofficial canvass, may hand
tally the remaining undervotes if any of the following is applicable:
(A) In the case of a primary election or a special election, the sum of the total number of votes
cast for the write-in candidate and the total number of undervotes cast for the office but not
examined pursuant to a hand tally is equal to or greater than the total number of votes cast for the
candidate receiving the second highest number of votes for that office.
(B) In the case of a general election or a special runoff election, the sum of the total number of
votes cast for the write-in candidate and the total number of undervotes cast for the office but not
examined pursuant to a hand tally is equal to or greater than the total number of votes cast for the
candidate receiving the highest number of votes for that office.
(C) In the case of an office for which a voter may vote for more than one candidate, the sum of
the total number of votes cast for the write-in candidate and the total number of undervotes cast
185
for the office but not examined pursuant to a hand tally is equal to or greater than the total
number of votes cast for the candidate receiving the least number of votes that would be
sufficient in order to be elected.
(2) The elections official may stop a hand tally conducted pursuant to this subdivision when the
official determines that the applicable condition in any of subparagraphs (A) to (C), inclusive, of
paragraph (1) is no longer applicable, or when all of the undervotes for the office have been
examined.
(3) In conducting a hand tally pursuant to this subdivision, the elections official shall count a
vote for the office if the intent of the voter can be determined, regardless of whether the voter has
complied with the voting instructions. The elections official shall include the results of a hand
tally conducted pursuant to this subdivision in the official canvass of the election.
(4) For purposes of this subdivision, “undervote” means a ballot on which a voter failed to cast
any vote for a specific office or failed to cast the maximum number of votes permitted, as
detected by an electronic, mechanical, or other vote-tabulating device.
186
8.6 1% Manual Tally Procedures
Manual Tally When Using a Voting System
(a) During the official canvass of every election in which a voting system is used, the official
conducting the election shall conduct a public manual tally of the ballots tabulated by those
devices, including vote by mail ballots, using either of the following methods:
(1) (A) A public manual tally of the ballots canvassed in the semifinal official canvass, including
vote by mail ballots but not including provisional ballots, cast in 1 percent of the precincts
chosen at random by the elections official. If 1 percent of the precincts is less than one whole
precinct, the tally shall be conducted in one precinct chosen at random by the elections official.
(B) (i) In addition to the 1 percent manual tally, the elections official shall, for each race not
included in the initial group of precincts, count one additional precinct. The manual tally shall
apply only to the race not previously counted.
(ii) The elections official may, at his or her discretion, select additional precincts for the manual
tally, which may include vote by mail and provisional ballots.
(2) A two-part public manual tally, which includes both of the following:
(A) A public manual tally of the ballots canvassed in the semifinal official canvass, not including
vote by mail or provisional ballots, cast in 1 percent of the precincts chosen at random by the
elections official and conducted pursuant to paragraph (1).
(B) (i) A public manual tally of not less than 1 percent of the vote by mail ballots canvassed in
the semifinal official canvass. Batches of vote by mail ballots shall be chosen at random by the
elections official.
(ii) For purposes of this section, a “batch” means a set of ballots tabulated by the voting system
devices, for which the voting system can produce a report of the votes cast.
(iii) (I) In addition to the 1 percent manual tally of the vote by mail ballots, the elections official
shall, for each race not included in the initial 1 percent manual tally of vote by mail ballots, count
one additional batch of vote by mail ballots. The manual tally shall apply only to the race not
previously counted.
(II) The elections official may, at his or her discretion, select additional batches for the manual
tally, which may include vote by mail and provisional ballots.
(b) If vote by mail ballots are cast on a direct recording electronic voting system at the office of
an elections official or at a satellite location of the office of an elections official pursuant to
Section 3018, the official conducting the election shall either include those ballots in the manual
tally conducted pursuant to paragraph (1) or (2) of subdivision (a), or conduct a public manual
tally of those ballots cast on no fewer than 1 percent of all the direct recording electronic voting
machines used in that election chosen at random by the elections official.
187
(c) The elections official shall use either a random number generator or other method specified in
regulations that shall be adopted by the Secretary of State to randomly choose the initial
precincts, batches of vote by mail ballots, or direct recording electronic voting machines subject
to the public manual tally.
(d) The elections official shall not randomly choose the initial precincts or select an additional
precinct for the manual tally until after the close of the polls on election day.
(e) The manual tally shall be a public process, with the official conducting the election providing
at least a five-day public notice of the time and place of the manual tally and of the time and
place of the selection of the precincts, batches, or direct recording electronic voting machines
subject to the public manual tally before conducting the selection and tally.
(f) The official conducting the election shall include a report on the results of the 1 percent
manual tally in the certification of the official canvass of the vote. This report shall identify any
discrepancies between the machine count and the manual tally and a description of how each of
these discrepancies was resolved. In resolving a discrepancy involving a vote recorded by means
of a punch card voting system or by electronic or electro-mechanical vote tabulating devices, the
voter verified paper audit trail shall govern if there is a discrepancy between it and the electronic
record.
188
8.7 Handling Ballot Exceptions
VBM ballot extraction begins e-14. During this process QC Staff reviews each ballot and
separates good ballots with ones that need further review.
QC tasks include:
• Remove any portion of the ballot stub, such as an incompletely detached perforation, that
remains attached to a ballot card.
• Jog cards for static electricity removal.
• Inspect the ballots for tears, folds, or damage.
• Damaged ballots are to be placed in the ballot remake box.
• Inspect the ballots for any identifying marks, such as a person’s name, as instructed.
• Ballots with identifying marks are placed in the ballot remake box.
• Inspect the marks on all ballots as instructed.
• When all ballots have been inspected align them so the printed black corner is in the
upper right corner.
Tally System vote mark detector is an operation that determines if the vote mark is selected or
not. Vote mark detector depends on the Tally Layout Definition File (TLDF) to inform how it
will be run. The TLDF also lists out the vote marks that need to be processed by ballot style id.
When calculating whether a vote mark should be considered as selected or not, the number of
pixels counted is compared against this total number of pixels. The target zone of is 113 x 113
pixels with a total of 12,769 pixels, each pixel accounts for about 0.0078% of the total target
area. The current configuration for the percentage threshold is 8.1%-100% of the target area.
This amounts to at least 1,034px of the 12,769px. If there are more than that many pixels, then
the vote mark is counted as a selection.
189
8.8 Post-Election Logic and Accuracy Testing
Purpose
Prior to an election, Logic and Accuracy testing must be done on to ensure the ballot layouts are
correct. See below to perform Logic and Accuracy testing.
BMD
A BMD can't be put into L&A mode if the BMD is in Vote mode. Further, Logic and Accuracy
testing can only be done by an election worker whose credentials activate L&A mode. Scanning
these credentials automatically puts the BMD into L&A mode, given that the BMD is not in
Vote mode.
1. Scan and Enter Credentials,
then tap Return To Start. 2. Tap Start New Test. 3. Insert a blank paper ballot.
190
The ballot prints and drops into
the ballot box, then returns to the 5. Tap Exit Test to return to the
4. Scan L&A poll pass.
insert a blank paper ballot L&A test page.
page.
6. Tap New Test to start a new
test or tap Exit to exit L&A
mode.
191
192
8.9 Final Reporting of Official Canvass
Sealing of Ballots
After ballots are counted and sealed, the elections official may not open any ballots nor permit
any ballots to be opened except as permitted by law or in the event of a recount.
Results
Upon completion of the count, the elections official shall add to the results as so determined, the
results of the write-in votes and any paper ballots used as certified by the precinct board, and
thereupon shall declare the vote, and forthwith post one copy at the counting place for public
inspection.
(a) The elections official shall prepare a certified statement of the results of the election and
submit it to the governing body within 30 days of the election or, in the case of school district,
community college district, county board of education, or special district elections conducted on
the first Tuesday after the first Monday in November of odd-numbered years, no later than the
last Monday before the last Friday of that month.
(b) The elections official shall post the certified statement of the results of the election on his or
her Internet Web site in a downloadable spreadsheet format that may include, but is not limited
to, a comma-separated values file or a tab-separated values file and that is compatible with a
spreadsheet software application that is widely used at the time of the posting. The certified
statement of the election results shall be posted and maintained on the elections official’s Internet
Web site for a period of at least 10 years following the election. This subdivision shall apply only
to an elections official who uses a computer system that has the capability of producing the
election results in a downloadable spreadsheet format without requiring modification of the
computer system.
When ballots are counted, the result of the vote shall be shown by precinct.
(a) The statement of the result shall show all of the following:
(1) The total number of ballots cast.
(2) The number of votes cast at each precinct for each candidate and for and against each
measure.
(3) The total number of votes cast for each candidate and for and against each measure.
(b) The statement of the result shall also show the number of votes cast in each city, Assembly
district, congressional district, senatorial district, State Board of Equalization district, and
supervisorial district located in whole or in part in the county, for each candidate for the offices
of presidential elector and all statewide offices, depending on the offices to be filled, and on each
statewide ballot proposition.
Transmission to Secretary of State
193
The elections official shall send to the Secretary of State within 31 days of the election in an
electronic format in the manner requested one complete copy of all results as to all of the
following:
(a) All candidates voted for statewide office.
(b) All candidates voted for the following offices:
(1) Member of the Assembly.
(2) Member of the Senate.
(3) Member of the United States House of Representatives.
(4) Member of the State Board of Equalization.
(5) Justice of the Court of Appeal.
(6) Judge of the superior court.
(c) All persons voted for at the presidential primary. The results for all persons voted for at the
presidential primary for delegates to national conventions shall be canvassed and shall be sent
within 28 days after the election.
(d) The vote given for persons for electors of President and Vice President of the United States.
The results for presidential electors shall be endorsed “Presidential Election Returns” and shall
be canvassed and sent within 28 days after the election.
(e) All statewide measures.
(f) The total number of ballots cast.
The elections official shall deliver a duplicate of the certified statement of the result of votes cast
to the chairperson of the county central committee of each party.
Announcement of Results
The governing body shall declare elected or nominated to each office voted on at each election
under its jurisdiction the person having the highest number of votes for that office, or who was
elected or nominated under the exceptions noted in law. The governing board shall also declare
the results of each election under its jurisdiction as to each measure voted on at the election.
The elections official shall make out and deliver to each person elected or nominated, as declared
by the governing body, except those elected to a central committee, a certificate of election or
nomination, signed and authenticated by the elections official.
(a) Whenever a candidate whose name appears upon the ballot at any election for an office other
than a voter-nominated office dies after the 68th day before the election, the votes cast for the
194
deceased candidate shall be counted in determining the results of the election for the office for
which the decedent was a candidate. If the deceased candidate receives a majority of the votes
cast for the office, he or she shall be considered elected and the office to which he or she was
elected shall be vacant at the beginning of the term for which he or she was elected. The vacancy
thus created shall be filled in the same manner as if the candidate had died subsequent to taking
office for that term.
(b) Whenever a candidate whose name appears on the ballot at any election for a voter-
nominated office dies, the votes cast for the deceased candidate shall be counted in determining
the results of the election for the office for which the decedent was a candidate. If the deceased
candidate receives a majority of the votes cast for the office at the general election, he or she
shall be considered elected and the office to which he or she was elected shall be vacant at the
beginning of the term for which he or she was elected. The vacancy thus created shall be filled in
the same manner as if the candidate had died subsequent to taking office for that term.
8.10 Backup and Retention of Election
Material
Purpose
After an election, there are some logs and files that must be downloaded and saved. See below to
learn how.
BMG
You can download a system log of events that took place in BMG. An Event is defined as any
sort of system action that occurred on BMG. This includes any and all actions that were run on
BMG, from user log-ins, diagnostic checks, BMD uploads and downloads, or any other actions
taken on the BMG system. You can view and download these logs, filtered by certain criteria, by
following the instructions below.
1. From the BMG home page, in the "System Log Files" menu, click View All.
195
• You'll be brought to a list of all system events with a description of the event, the time it
occurred, and who performed the event.
Click Download, then choose a file format you'd like for the log, or click Add Filters.
If you don't specify any filters, the system will download a log of every single action by default.
Click the dropdown below to learn more about the different filters you can use.
Filter types
• Filter by date
• You can specify a specific date range for the logs you'd like to see.
• Filter By Created By
• You can see a log of actions performed by a specific user.
• Filter By SystemName
• Each type of action is given a specific system name by the BMG system. If you know the system
name for the type of action you're looking for, you can enter it here.
• Filter By Events
• You can filter by the type of action taken.
Depending on your computer settings, you will be asked to either download the file, or open it
without downloading it.
If the file doesn't automatically open, and you can't find it in your "Downloads" folder on your
computer, try searching for the file name, BMG Event Log.
BMD
After an election is over and the BMD devices have returned, it's time to download the election
logs and keys from the devices. The election logs don't record any personal voter data, or any of
their ballot selections during the voting process. The logs are simply a collection of the different
BMD settings that were made by users, such as volume level, screen brightness, language
settings, etc. Reviewing these logs allows developers to enhance the voting experience during the
196
next election by gaining a sense for which BMD functionality settings might need to be updated
to be more in line with the settings selections of the average user.
1. From the BMG main page, in the "Scheduled Elections" section, click View All.
• A page opens with a list of all upcoming elections that have already been scheduled.
Click on the election ID and version whose logs or keys you'd like to download.
Click Show Previous to view a list of elections that have already passed.
a.
Click either Aggregate Keys, or Aggregate Logs.
• If logs or keys are available for download, a new page opens with the option to download the
files.
Click Download.
• Depending on your computer settings, you will be asked to either download the file, or open it
without downloading it.
From here, you must transfer the files to a USB, then hand the USB off to a Tally representative
for processing.
197
9. Manual Recount Procedures
Manual Recount Requests should be made in accordance with the California Elections Code and
California Code of Regulations Chapter 8.1, including the jurisdictions Recount Procedures that
are on file with the Secretary of State.
To validate the accuracy of the vote count, a public manual recount of at least one percent of the
total ballots cast, chosen at random, shall be conducted within fifteen days if requested.
All the original ballots will be reviewed for each contest. Votes will be recorded on tally sheets.
The process for Manual Recounts is as follows:
1. Tally board is prepared with ballots from a batch and tally sheets.
2. For each contest the selection from every ballot is read aloud.
3. Any voter may request a recount pursuant to the Election Code sections 15620, 15621 or
15623.
4. The other party records each vote on the tally sheet with one pencil stroke per vote. Includes
any under or voter voted contests.
5. The total of all pencil strokes for each candidate is counted and written into the proper box on
the tally sheet.
198
10. Security
10.1 Physical Security of System and Components
The System Security describes the voting system security. The system features access control
mechanisms, equipment and data security, software installation and security policies, air gap
policies, event logging details, physical security structures, specifications, standards, and
regulations designed to protect the voting process from malicious attacks, data breaches, and
accidental security incidents.
Network - The network domain that hosts election definition and ballot layout functions is
physically separate from system and does not have inter-connectivity of traffic between domains.
Data is transferred through a manual process under human control. The system is hosted on a
separate network domain that is not physically connected to any other County LAN and no
physical interconnections exist between the system and any other network or end-point device
that connects to the Internet.
Protective Barrier - The placement and design of the room where the system and components
are housed must allow for a secure environment that aims to deter or delay any attempt to disrupt
operations while providing a means for interested parties to observe.
Rack-mounted Equipment - Hardware components such as scanners, servers and network
devices must be housed in locked enclosures that contain racks for servers, network switches,
power distribution units, and other components or peripherals. Serialized tamper-evident seals
are used on removable panels. Removal and replacement of seals must be witnessed by at least
two election staff members and documented using a log with signatures by both parties.
Access Control - Entry and Exit doors must be protected by an electronic key card access
system. Entry and exit must be automatically logged with identity, date, time, and door number
recorded for each instance. The key card system must be operated and maintained by a
designated team and access shall only be granted when authorized by designated managers.
Policies and procedures for access control to the tabulation room must be defined and
implemented.
System Method Description Specifications
The trusted platform
The TPM, a secure crypto-processor,
Trusted Platform module prevents unsigned
BMD integrates cryptographic keys into the
Module (TPM) software from signing onto
BMD.
the system.
199
HP Aruba ClearPass: Tracks the machine MAC addresses
MAC address control, of all computer network cards
Network Access
BMG prevents non-authorized present on the network and removes
Control
computers from accessing any unauthorized network card MAC
network. address from a network.
Two-factor Radio Frequency The smart card RFID is issued to an
ESA authentication Identification (RFID) authorized individual, which serves
with smart card limits access to the HSM as a part of two-factor authentication.
HP Aruba ClearPass: Tracks the machine MAC addresses
MAC address control, of all computer network cards
Network Access
ISB prevents non-authorized present on the network and removes
Control
computers from accessing any unauthorized network card MAC
network. address from a network.
HP Aruba ClearPass: Tracks the machine MAC addresses
MAC address control, of all computer network cards
Network Access
prevents non-authorized present on the network and removes
Tally Control
computers from accessing any unauthorized network card MAC
network. address from a network.
HP Aruba ClearPass: Tracks the machine MAC addresses
MAC address control, of all computer network cards
Network Access
VBL prevents non-auth present on the network and removes
Control
computers from accessing any unauthorized network card MAC
network. address from a network.
200
10.2 Logical Security of System and Components
10.2.1 Essential and Non-Essential Services and Ports
Unused USB data ports are covered with serialized tamper evident seals on the VSAP servers
and related components. The serialized tamper evident seals are manually logged with an
operator signature, seal number, location, date and time.
Component Ports and Access Points
BMD USB port, Ethernet port, 3 x 3.5 mm ports
USB port, Ethernet port, 3.5 mm audio, HDMI, SD card reader, and VGA
HPE ProLiant DL830 Gen10: Display Port 1, 8 LFF chassis standard Flexible
LOM Network Ports, 4 x 1 Gb ports, HPE iLO Remote Management Network
Port, 1 Gb Dedicated Front iLO Service Port, Micro SD Slot 1 Micro SD, USB
3.0: 1 front, 2 rear, 2 internal (secure) HP 8320 JL479A: 48p 10G SFP/SFP+ and
6p 40G QSFP+ Switch HP8320 JL579A: 32p 40G QSFP+ HP3810M JL075A:
16 SFP+ fixed 1000/10000 SFP+ ports; Duplex: 100BASE-TX: half or full;
1000BASE-T: full only; Ports 1 – 16 support MACSec HP2930F JL253A: 24
RJ-45 autosensing 10/100/1000 ports (IEEE 802.3 Type 10BASE-T, IEEE
BMG
802.3u Type 100BASE-TX, IEEE 802.3ab Type 1000BASE-T); Duplex:
10BASE-T/ 100BASE-TX: half or full; 1000BASE-T: full only; 4 SFP+
1/10GbE ports; PHY-less HP2530-8G JL9777A: 8 RJ-45 autosensing
10/100/1000 ports (IEEE 802.3 Type 10BASE-T, IEEE 802.3u Type 100BASE-
TX, IEEE 802.3ab Type 1000BASE-T); Media Type: Auto-MDIX; Duplex:
10BASE-T/100BASE-TX: half or full; 1000BASE-T: full only; 2 dual-
personality ports; each port can be used as either an RJ-45 10/100/1000 port
(IEEE 802.3 Type 10Base-T; IEEE 802.3u Type 100Base-Tx; IEEE 802.3ab
1000Base-T Gigabit Ethernet) or as a SFP slot (for use with SFP transceivers)
ports
Intel NUC7i7DNHE: USB, SATA, Ethernet nShield Edge F2 HSM: SD card
ESA
reader and USB
ISB USB port, Ethernet port, 3.5 mm audio, HDMI, SD card reader, and VGA
Compute servers: USB, Ethernet, Video/display, PS2, Audio Scanner machines
and scanner support machines: Ethernet, Video/display, PS2, Audio Storage
Tally
Appliance: Ethernet, Audio Workstations: USB, Ethernet, Video/display, PS2,
Audio Switches: Various network
Compute server: USB, Ethernet, Video/display, PS2, Audio Workstations: USB,
VBL
Ethernet, Video/display, PS2, Audio Switches: Various network
201
10.2.2 User-Level Security
The system has numerous access controls to deter unauthorized users from accessing the system.
There are three role types in the system. The first role is the Linux administrator. The Linux
administrator can configure the system, setup new users, set up configuration files, configure the
system, and view logs. Second is the application admin. The application administrator can
manage running services in the system, tabulate elections, view errors, and conduct all necessary
election night operations. Finally, is the view-only user who can look at the Manager interface,
but cannot physically affect the system.
The system is only accessible to individuals who have a username and password. Usernames and
passwords are managed via process by the system administrator. User passwords are never stored
in clear text or reversible formats. There is a system tool for generating password entries. All
user passwords are stored with password encoder software. These files are protected via file
permissions.
Password Example: S0n0fM0gh!1701D
10.2.3 Anti-Virus Protection
SYSTEM SECURITY (Air-Gapped Environment)
• Carbon Black Protect Software (CB Protect): This software once installed, takes away
elevated privileges on any operating system. All software on a computer system with CB
protect installed is subject to permission from it to execute. This software functionality
reduces the chances of malicious software to run on a computer. However, it is strongly
advised to have Smartmatic assist in the install of this product in the air-gap
environments and for CVSS testing. Any mis-configuration can interfere with the proper
operation of software on a computer system.
• HP Aruba ClearPass: tracks the machine (MAC) addresses of all computer network
cards present on a computer network. The software, in addition to monitoring MAC
addresses, can remove any network card MAC address from a network that is not
authorized to be on that network. This software function disrupts any attacker from
placing implants or connecting workstations to any air-gap network without
authorization.
It is recommended that Smartmatic personnel assist in the installation of this software to any air-
gapped network. This software improperly configured can also like CB Protect disrupt proper
operation of the computer network.
202
• Snare System Information and Event Management (SIEM): The Snare SIEM tracks
all computer system and network activities and records them for a retention period of up
to several years provided there is adequate storage. SIEM will be the method by which all
network activity will be tracked for review in the event of an attack or issue. Once a
SIEM record is created it is locked in the system and cannot be tampered with or
changed. Smartmatic recommends that Smartmatic personnel assist or take the lead in the
installation of this software inside the air gaps.
•
10.2.4 Verifying, Checking, and Installing Essential Updates and
Changes
Changes are primarily for installing critical updates to operating system, anti-virus protection or
other third-party elements related to security and error correction.
10.2.4.1 Audit Records for the Changes
1.1 Event Logging Capabilities
BMD
A usage data collection log file records executed events on the device; audit logs will record
every event triggered in the BMD as one of the following types: info, error, warn, fatal, and
debug. Logging is performed in the voting app. The BMD Interaction Data (BID) is a fixed-sized
usage log that counts ballots cast. The BMD Election Log (BEL) is an audit log that creates
separate records for each user interaction.
203
The BMD allows multiple BELs for multiple elections. All logs are written to the data partition.
The BMD employs the SIEM to capture system events.
BMG
The BMG contains a file-based audit logging system. Timestamps will be generated in the
format ISO8601 including time zone (e.g. 2017-09-26T01:57:58+00:00). Event logs are stored
and reported through ElasticSearch. The BMG employs the SIEM to capture system events.
ISB
The ISB logs specific events to a log file, including:
• System ID
• Unique event ID and/or type
• Timestamp
• Success or failure of event, if applicable
• User ID trigger the event, if applicable
• Resources requested, if applicable
The ISB will use AWS S3 for storage of the statically hosted log files. It will employ encryption
and will have AWS CloudTrail logs enabled.
Tally
Tally employs the SIEM to capture system events.
VBL
The VBL employs the SIEM to capture system events.
1.2 Event Logging Design and Implementation
BMD
To facilitate security and traceability of the BMD, logging capabilities are designed to capture
information about each unique event, including: sequence number, unique event ID, transaction
results, user and event types, average voting session time, and event occurrences.
SSD has four partitions, one of which stores logs (Data partition). Diagnostic (pre-setup) has
logs, then logs are captured while users are voting; then they’re unpacked or read back at the
warehouse when connected to BMG.
BMG
Elastic Search: for daily logs are aggregated into CSV files for export for any period longer than
24 hours
204
Design = Database (SQL) maybe built into Elastic Search.
The system information and event management (SIEM) software provides an audit trail through
continuous logging of network activity. The system uses Snare as its SIEM, in conjunction with
the network traffic monitor LANGuardian, providing up to one year of highly detailed log data
for the network. This data is suitable to provide actionable intelligence and critical insight both
for security monitoring and incident response forensics. These products are also capable of
reporting a summary overview.
ISB
AWS access logs stored in the S3 bucket.
Tally
Each Tally service logs events to the file system and makes them available through the Log
Viewer page, which is accessible on the Tally environment. The logs are preserved for auditing
and are included in an archive of the election. The archive of the logs includes all election
specific logs and general logs that have been generated at the moment the archive is requested.
Logs are created and use signed log-chaining to ensure the validity of the audit log and to help
discover any logs which have been maliciously added. Rotation of logs is set for each service
and is used to preserve disk space as logs grow over time. Log viewer is not a generic tool that
can pull in logs from any system. Due to that, third party tools such as Kafka and Cassandra log
via their native logging patterns. Those logs are not readily accessible through the Tally UI.
VBL
Each VBL service logs events to logs on the file system. The logs will be preserved for auditing.
Logs are created and use signed log-chaining to ensure the validity of the audit log and to help
discover any logs which have been maliciously added. Logging also includes rotation of files in
order to preserve disk space as logs grow over time.
10.2.4.2 Installation Procedures
The system is hosted on a separate network domain that is not physically connected to any other
County LAN and has no physical interconnections existing between the system and any other
network or end-point device that connects to the Internet. The application runs on a standalone
COTS PC and is physically separated from the system. Data between the two systems is
transferred through a manual process under human control and performed by trusted staff.
Installation of updates is performed through a set of manual procedures overseen by trusted
election managers. Installation activities are documented with at least two staff members
performing updates. Documentation includes, date-time of update, person who performed
activity, person who witnessed the activity, and certification that update installed was previously
approved.
205
10.2.4.3 Acceptance Testing After the Installation
Before each election, version control testing will be conducted to make sure that each component
of the electronic voting system is using a certified version of the vendor’s software and firmware.
The California Secretary of State’s Office requires parallel testing of voting devices on Election
Day. The parallel testing procedure includes the random selection of voting devices the morning
of the election from various precincts within the county. Once selected, the voting devices are
thoroughly tested for accuracy and reliability by designated California Secretary of State election
personnel. The accuracy testing runs the entire duration of the election. Election result reports are
then generated from each devices unit once the election concludes so the accuracy of the system
can be validated.
206
10.3 Security Procedures for the BMD Warehouse
Physical security standards for all persons working or entering the BMD Warehouse. These
policies comply with NIST 800-171 Physical Protection, Media, and Personal Security Policies.
Authorization is required to enter the BMD Warehouse. The following are the only authorized
personnel:
• Select, jurisdictionally appropriate, personnel
• Approved contractors
• Building maintenance personnel
The following personnel are authorized, but may be subject to the jurisdiction's escort and
monitor policy:
• Vendors (including delivery personnel)
• Visitors
Valid ID badges are required to enter the BMD warehouse and must be worn and visible when
one is inside the building. Visitors will be expected to have temporary badges distributed from
the visitor management system. Any person without a badge showing authorization is considered
an adversary and will be escorted to the security desk immediately.
Employees will report a badge that's been lost, stolen, or compromised in any way, to the
security office.
Refer to jurisdictional procedure guides for further information on existing guidelines governing
identification of personnel entering Information Technology areas.
Cameras will monitor all areas of security concern:
• Truck and delivery yard
• Employee parking
• Visitor center entrances
• Employee entrances
• Warehouse for BMDs
• BMD repair facility
• Kitting area
The facility will create protected yards for employee parking, and facilities for trucks and large
equipment.
• Gates and fences will protect the warehouse loading bays from being penetrated by
unauthorized persons.
• Gates will be monitored by site security personnel.
Employee physical access will account for tailgating, which is when an unauthorized person
gains access by trailing behind authorized personnel.
207
• A turnstile connected to the building's access control system shall control access and limit
tailgating to the employee entrance to the facility.
• Outside of the entryways assigned to the employee entrance, there will be an outer
defended area with turnstiles connected to an access control system, allowing only one
employee to enter at a time, thus preventing tailgating.
• There can also be a gated entrance between turnstiles to comply with current Americans
with Disabilities Act standards for those employees who cannot pass between turnstiles.
• The employee entrance area will also be monitored by cameras. In addition to
monitoring, these cameras will remind employees to be vigilant regarding security while
inside the facility.
A magnetic card access system will control overall access to the facility. All entrances to
the BMD warehouse will be connected to the access control system.
• Fenced off areas will be established inside the warehouse for kitting and the maintenance
of the BMDs.
• In addition to the magnetic card system, kitting areas will be fenced off and secured with
combination locks and the combinations to those locks known only to those authorized to
enter the kitting or service areas.
• The BMD repair, and inspection area will be isolated from facility personnel by a fence
and combination lock and will be accessible only to maintenance staff.
In addition, entrances to critical areas will be protected by biometric scanning.
Video will be accessible from inside as well as from outside the facility. Cameras integrated with
a cloud-based enterprise mobility management system (EMM) can be accessed from outside the
facility via the internet. The EMM will have two-factor authentication for accessing the cameras.
Proper authentication will allow for secure access by jurisdictionally appropriate security
personnel and the local sheriff's office, as well as from inside the facility.
A burglar alarm will be configured to detect any unauthorized entrance to the facility. The final
design of the security system will be determined based on the characteristics of the facility
selected for the BMD warehouse.
Kitting and BMD service areas will additionally be protected by combination locks to provide
the additional security necessary to keep these elements of the BMD warehouse facility safe.
208
Critical areas such as the BMG server or switching rooms are to be protected by a biometric iris
reader. The biometric iris reader is a retinal scanning device that unlocks doors to those areas.
Biometric systems protect against duplication and/or theft of any magnetic cards used by the
access control system. A higher level of security for entry is obtained using a “Man Trap”. A
“Man Trap” uses two doors with an entry door connected to a small passageway to an exit door
on the opposite wall utilizing a combination lock or a lock that is unique to the space. One door
of a “Man Trap” cannot be unlocked and opened until the opposite door has been closed and
locked. “Man Traps” are used in physical security to separate non-secure areas from secure areas
and to prevent unauthorized access.
All USB media are to be serialized and tracked to individual users via a checkout sheet
maintained by the IT Security Staff. Any USB media not in use will be inside a safe within the
critical protected areas. Placing the safe inside a room, such as the BMD server room, which is
only accessible via biometric scanning, provides extra security.
• The “Man Trap” will use the building's magnetic card system to control the external door
to the server\switching room. A biometric reader will screen the entrance to the interior
door entrance. "Man Traps" will be constructed in locations where jurisdictionally
prudent.
• Because magnetic cards can be stolen or duplicated, biometric devices will control
special access to any server/switching room.
The system will connect to an electric striker to open doors to these areas of the
o
facility when activated.
The biometric iris reader device requires that a database of authorized users reside
o
on a Windows desktop computer. It is the responsibility of the IT security staff to
maintain that database and upkeep the list authorized users to the rooms.
• The server\switching rooms shall have restrictions on phones and employee-owned
personal electronics inside those areas. The individual devices restriction policy shall be
enforced by BMD warehouse staff via written policy. No employee-owned smartphone or
personal electronic device will be allowed inside critical air-gapped server rooms or
server areas connected to the electronic poll books. All employee-owned electronic
devices shall be kept in lockers placed outside of the server rooms. Failure to follow the
policy should result in disciplinary action from the BMD warehouse management staff.
A set of lockers will be positioned next to any critical air-gapped network
o
server\switching room to allow employees to store their devices before entering
the area.
Employee-owned electronic devices can be compromised by improper security, or
o
by the term of service agreements for applications on the phone.
Terms of service or improper activity may cause cameras, microphones, and the
o
GPS data in the device to be turned on and used for surveillance of restricted sites,
without the knowledge or permission of the owner.
Adherence to the following procedures is required:
• All BMD Warehouse employees are expected to keep a clean workstation area.
• Any documents related to the voting operations will be in a locked drawer or other secure
areas when not in use.
• Workstations screens are to be locked when employees are away from their computers by
Windows group policy of no longer than 5 minutes.
• Any removable storage devices must be locked in a protected area.
• Any documents to be discarded must be shredded.
209
Employees are not allowed to use personal devices to audio- or video-record any activity within
the BMD Warehouse. Management must be notified to find a solution if an employee requires
audio or video recordings. As stated earlier, it is possible via a term of service for photographs
taken on a smartphone to be shared without the user's knowledge.
Only jurisdictionally appropriate or Smartmatic issued computers are allowed to connect to the
VSAP network facilities at any time.
All computers must be registered to the network access solution protecting the VSAP network.
Any computer not known to the network access software will be restricted, and alerts will be sent
to IT security staff immediately.
Personal storage and media devices are not allowed to be connected to computers. Security
software will only allow connections by USB to devices designated by an appropriate local,
state, or federal jurisdiction personnel. Restricted storage and media devices include:
• USB drives
• Flash drives
• Mobile phones
• Any other devices capable of recording
A vendor who brings these devices into the BMD warehouse must present them to IT security for
malware scanning by the designated AI antivirus software. Any necessary or required data will
be copied to a USB storage device issued by an appropriate local, state, or federal
jurisdiction and provided to the vendor for the work required and returned at the completion of
the work to the security desk. This provided storage device must be returned to IT security once
the vendor has completed their task. The vendor then will retrieve their personal device. Any
vendor who violates these rules will be subject to immediate removal from the BMD warehouse.
In some cases, IT security may authorize, issue, clear, and track media devices that connected
to BMD warehouse computers and servers. Any USB device or media shall be purchased by
the appropriate local, state, or federal jurisdiction and security tested by IT security personnel
prior to use in the network. Devices will then be assigned random serial numbers to verify they
are safe to use.
Only serialized USB storage media managed and tracked by BMD warehouse security staff will
be connected to VSAP equipment.
All computers not requiring a USB media connection, as determined by BMD warehouse
security staff, will have their USB ports disabled by an endpoint security software or physically.
Any device used to connect to VSAP equipment without a serial number must be turned in to IT
security for examination.
Security Product Recommendations:
210
Every quarter, the security staff will perform random tests to assess physical security and
compliance with access procedures. It is strongly recommended that a "red team" of security
evaluators test the facility after each election to determine security compliance.
211
10.4 Security Procedures for Vote Center
Vote Center Security
BMD VOTE CENTER STORAGE & SECURITY SEALS
BMD devices will be delivered to the Vote Centers prior to Election Day. During transit, carts
and storage containers are sealed with evidence tape and/or tamper evident seals. Access points
to the BMD are outfitted with tamper evident seals with either or both tamper evident residue or
visual appearance change to the seal itself to reveal modification or removal and to help prevent
access or theft (see pictures below). The BMD ballot boxes are also outfitted with tamper evident
zip-tie style seals utilizing signaling evident technology to reveal modification and/or
removal. In addition, a tamper-evident seal is also placed over the seam of the IBB (see picture
below of tamper-evident seal). Removing, creasing, scratching of laminating the factory applied
film exposes prominent "OPEN VOID" messages. Seals use Secure ID technology that has a
distinctive metallic finish which serves as an anti-counterfeiting and authentication feature. In
addition, BMDs will be kept in a secure location at each Vote Center. During overnight storage,
BMDs should be stored in rooms that are sealed with evidence tape at access points and/or in
rooms that can be locked with a key.
Integrated Ballot Box security seal
212
USB and Ethernet port security seal
All tamper evident seals are serialized and logged via established "chain-of-custody" procedures;
this includes replacing and logging any need to break seal(s) for reason of entering a storage
area, room, ballot box, or any other secured locale. An election inspector / overseer will verify
that the correct seals are intact on the BMD containers, carts, and devices prior to set up, and use
in the election.
BALLOT QR CODES
The Ballot Page Metadata (BPM) QR code in the upper left-hand corner of the ballot contains
information about current election status and indicates the ballot’s originating BMD. BMDs
assigned to the election pass their security keys to Tally; BMDs that are not officially part of the
election will produce an error.
ADDITIONAL SECURITY MEASURES:
• An audit of each precinct's electronic tally of the number of votes cast will be conducted
against the number of signatures in the precinct's ePollbook.
• Vote center officials will be required to certify in writing that the proper locks and seals
were found intact on the BMD devices, carts, and containers before the polls open.
Exceptions and discrepancies will be reported to the Help Desk immediately upon
discovery.
• A physical inventory of all BMD devices will be conducted before and after each election
to ensure custody of all devices is maintained and/or accounted for; there are functions
within the BMG that can be used to aid in this inventory (for more information see the
BMG User Guide).
10.5 Audit Trails
213
Election audit trails are vital to validating the accuracy of election results. All system
components create an audit log anytime the system is accessed, or data is changed. Audit logs
can be opened and printed to hard copy if needed.
BMD Log Files
The BMD logs significant system events during elections and anonymous usage data. This
information is useful for auditing purposes and for ongoing user experience analysis. These logs
are retrieved using the BMG.
Table 1. Log file types
Log File Type What it Tracks
Information about the interactions between the voter
and the system, such as:
· Font size
BID - BMD Election
Audit · Language
Interaction Data
· Voting system time
Only aggregate interaction data is recorded, not
individual voter choices.
Each event triggered during the voting experience at
the BMD, such as:
· Shutdown
BEL - BMD Election Logs Usage
· Empty ballot box
· Cancel voting session
214
11. Biennial Hardware Certification and
Notification
California Elections Code requires jurisdictions to inspect voting systems and certify their
accuracy once every two years. All ballot marking devices, tabulators, scanners, elections
management software, and supplementary equipment must be certified by California’s Secretary
of State prior to their use in any election taking place in California. In addition, all specialized
tally equipment must be certified for use in elections by the Secretary of State prior to use in any
election.
Notification of Equipment
For each statewide election, the responsible county Election Official prepares a list, including
quantities, of all equipment to be used to tabulate votes during the semi-official and official
canvass. Seven days before each statewide election, the Election Official shall certify to the
Secretary of State the results of the logic tests, as well as the accurate functioning of all ballot
tally equipment. This certification shall also affirm the use of the same equipment for the Pre-
Election Logic and Accuracy test, and for semi-official and official vote canvasses.
In the event of a change to the ballot tally program after certification, an amended certificate
shall be submitted no later than the day before the election. In the event any equipment is
repaired, altered or replaced following the certification specified in this section, and prior to
completion of the official canvass of the vote, an amended certification of Logic and Accuracy
testing and a revised list of equipment used must be submitted to the Secretary of State no later
than official canvass submission.
215