Los Angeles County Vsap 3.0 Ovsta Staff Report

Office of Voting Systems Technology Assessment | 1500 11th Street, 6th Floor Sacramento, CA 95814 | Tel 916.695.1680 | www.sos.ca.gov Los Angeles County Voting Solutions for All People (VSAP 3.0) Staff Report Prepared by: Secretary of State’s Office of Voting Systems Technology Assessment February 23, 2022 Table of Contents I. Introduction ............................................................................................. 1 1. Scope....................................................................................... 1 2. Summary of the Application .................................................... 1 3. Contracting and Outsourcing .................................................. 1 II. Summary of the System ....................................................................... 2 1. Tally Version 3.0.20 ................................................................ 2 2. FormatOS Version 3.0.2 ......................................................... 2 3. Ballot Marking Device Versions A0.1, A0.2, A0.3, A0.4 ....... 2 4. Ballot Marking Device BASI 3.0.2……………………………….2 5. Ballot Marking Device BESI 3.0.2 …………………………...….2 6. Ballot Marking Device Management Network (BMG) 3.0.0…...2 7. VSAP Ballot Layout (VBL) 2.0.21………………………………..2 8. Enterprise Signing Authority (ESA) 1.0………………………….3 9. Fujitsu Scanner 1 - fi-7180PR…………………………………...3 10. Fujitsu Scanner 2 - fi-7800……………………………………….3 11. IBML Scanner 6400………………………………………………3 III. Testing Information and Results .......................................................... ..3 1. Background ............................................................................. ..3 2. Functional Testing Summary ................................................. ..3 3. Software Review Testing Summary ...................................... .6 4. Security and Telecommunications Testing Summary .......... 7 5. Volume Testing Summary ...................................................... 9 6. Usability, Accessibility & Privacy Testing Summary ............ 12 2 | Pa ge IV. Compliance with State and Federal Laws and Regulations ................ 13 1. Elections Code Requirements................................................. 13 2. Elections Code Review ........................................................... 15 3. Review of Federal Statutes & Regulations ............................. 19 4. Help America Vote Act (HAVA) Requirements ...................... 20 V. Conclusion ............................................................................................... 21 3 | Pa ge I. INTRODUCTION 1. Scope This report presents the test results for all phases of the certification test of the Los Angeles County Voting Solutions for All People (VSAP 3.0) voting system. The purpose of the testing is to test the compliance of the voting system with Federal law and California law and standards, including California Voting System Standards (CVSS). Testing also uncovers other findings, which do not constitute non-compliance, and those findings are reported to the voting system vendor to address the issues procedurally. The procedures for mitigating any additional findings are made to the documentation, specifically the VSAP 3.0 Use Procedures. 2. Summary of the Application Los Angeles County applied for the testing for certification of the VSAP 3.0 voting system on July 7, 2021. The system is comprised of the following major components: • Tally Version 3.0.20 • FormatOS Version 3.0.2 • Ballot Marking Device (BMD) Hardware Version A0.1, A0.2, A0.3, and A0.4, and Software 3.0.0 • Ballot Marking Device BASI 3.0.2 • Ballot Marking Device BESI 3.0.2 • Ballot Marking Device Management Network (BMG) 3.0.0 • VSAP Ballot Layout (VBL) 2.0.21 • Enterprise Signing Authority (ESA) 1.0 • Fujitsu Scanner 1 - fi-7180PR • Fujitsu Scanner 2 - fi-7800 • IBML Scanner 6400 In addition to these major components, which includes the executable code and the source code, Los Angeles County was required to submit the following: 1) the technical documentation package (TDP); 2) all the hardware components to field two complete working versions of the system, including all peripheral devices, one for the Functional Test Phase and one for the Security and Telecommunications Penetration Test Phase; 3) all the peripherals that would be in the polling place; and 4) the VSAP 3.0 Use Procedures. 3. Contracting and Consulting Upon receipt of a complete application, the Secretary of State released a Request for Quote for assistance with the Functional, Volume, Software (Source 1 | Pa ge Code) Review, Security and Telecommunications (Red Team Penetration), Usability, Accessibility and Privacy Testing. Through the formal California contracting process, the Secretary of State awarded a contract to SLI Compliance (SLI), a division of Gaming Laboratories International, LLC, to serve in the capacity as the state-approved testing agency or expert technician to examine the voting system. II. SUMMARY OF THE SYSTEM The VSAP 3.0 system consists of the following components: • Tally Version 3.0.20 – Tally captures and processes ballot images to digitally count voter selections from paper ballots. Tally scans and creates images of ballots, converts the images into Cast Vote Records (CVRs), tabulates them, and allows the election results to be exported. Tally is responsible for counting votes at the end of an election. • FormatOS Version 3.0.2 – Application used to wipe the ballot marking devices. • Ballot Marking Device (BMD) Hardware Version A0.1, A0.2, A0.3, and A0.4 and Software 3.0.0 - The BMD is the primary touchpoint for the voter and hub of the voting system, guiding users with screen prompts and symbols. The BMD features a touchscreen, an audio and tactile controller, and dual-switch input that voters use to generate, verify, and cast a paper ballot. Completed ballots are transferred to the Integrated Ballot Box, which can be detached for unloading. Through the BMD, voters participate in elections. • Ballot Marking Device BASI 3.0.2 – Application software for the ballot marking devices. • Ballot Marking Device BESI 3.0.2 – Application for election software for the ballot marking device. • Ballot Marking Device Management Network (BMG) 3.0.0 - The BMG manages and maintains the BMDs. It allows operators to manage software, configurations, and data. The BMG provides files necessary for BMDs to present election data such as candidate information, multi-lingual audio, and supporting text. The BMG is the manager and custodian of the voting system. • VSAP Ballot Layout (VBL) 2.0.21 - The VBL enables election managers to configure and generate ballot layouts. The VBL subsystem ingests election information files and generates ballot layout files to be used by 2 | Pa ge other components of the system. The VBL makes setting up elections possible. • Enterprise Signing Authority (ESA) 1.0 - The ESA establishes the security root and chain of trust for the VSAP voting solution. This subsystem comprises the following processes: key management, distribution, and authentication. The ESA uses a cryptographic module to generate a public/private key pair, which authenticates devices and transactions. The ESA is the basis of the authorization, authentication, and data integrity for the voting system. • Fujitsu Scanner 1 Small Model fi-7180PR – Small scanner used for disaster recovery scanning of ballots. • Fujitsu Scanner 2 Large Model fi-7800 – Large scanner used for disaster recover scanning of ballots. • IBML Scanner 6400 - High speed scanner used in conjunction with the Tally software. III. TESTING INFORMATION AND RESULTS 1. Background The Secretary of State staff in conjunction with SLI, oversaw all phases of testing of the system, including Functional, Software Testing (Source Code Review), Security and Telecommunications (Red Team Penetration Testing), Volume, Usability, Accessibility and Privacy Testing. 2. Functional Testing Summary System Configuration: The system is self-contained on an air gapped network, per the CVSS requirements. SLI performed the task of creating the Trusted Build of the VSAP 3.0 voting system. The artifacts produced will be kept, and distributed by the Secretary of State. VSAP 3.0 is intended for use solely by Los Angeles County. Functional Testing Phase The Functional Testing consisted of following the Use Procedures to import the following six (6) test elections in Table 2: Test Elections into the testing environment. The vote by mail ballots (VBM) and BMD ballots used for testing were marked using predetermined ballot marking patterns. Each election was tabulated using the IBML high speed scanner. A 1% manual tally of the results was conducted for each election, and the reporting results confirmed as accurate. 3 | Pa ge Table 2: Test Elections Election Number Election Specific Anomaly Resolution Type of Details Identified Ballots Presidential 100 (17 This election None N/A Primary VBM/50 tested the (2020) BMD) limitation of ballot styles that can be used with the system, in addition to language support (audio and visual). Presidential 100 (50 This election Two BMD The ballots General VBM/50 tested a ballots out were remade (2020) BMD) Presidential stacked according to General election because the the Use type. QR code was Procedures, distorted/cutoff using the Adjudication Process. The results were verified and determined to be accurate. Gubernatorial 100 (50 This election None N/A Primary VBM/50 tested a (2018) BMD) Gubernatorial Primary election type. Gubernatorial 100 (50 This election None N/A General VBM/50 tested a (2018) BMD) Gubernatorial General election type. Special Recall 100 (75 This election None N/A Election with VBM/ tested the Recall 25 system’s Question BMD) candidate capacity, with a Recall Question. All supported languages were also tested and verified. The ballot 4 | Pa ge Table 2: Test Elections type had additional specifications of 95 candidates, with an 8-point font size. Fictious 100 (50 This election None N/A Special VBM/50 tested two Election BMD) congressional districts and one municipality. VSAP 3.0 supports the following languages: • English • Bengali • Spanish • Farsi • Gujarati • Hindi • Armenian • Indonesian • Japanese • Khmer • Korean • Mongolian • Burmese • Russian • Telugu • Thai • Tagalog • Vietnamese • Chinese Marginal marks were purposely made to some ballots to test out stacking functionality. The following tools were used: • Yellow highlighter • Pencil • Black ink • Blue ink • Dry erase marker 5 | Pa ge • Black sharpie marker The system is designed to detect marks that encompass at least 50% of the target marking area (circle) on vote by mail ballots. This threshold setting is adjustable. Each writing tool performed as expected. Los Angeles County has added two Fujitsu Scanners to the VSAP environment, Fujitsu Scanner 1 (fi-7180PR) and Fujitsu Scanner 2 (fi-7800). The scanners are solely intended to use for disaster recovery purposes. The scanners capture the ballot images and are imported into the Tally System for tabulation. Each scanner was tested with BMD ballots, vote by mail ballots, and poll pass ballots. The results were verified and accurate. 3. Software Testing (Source Code Review) Summary The review was conducted by SLI. SLI evaluated the security and integrity of the voting system by identifying any security vulnerabilities that could be exploited to: • Alter vote recording, • Alter vote results, • Alter critical data (such as audit logs), or • Conduct a “denial of service” attack on the voting system. SLI’s review of the VSAP 3.0 source code against the applicable standards of the CVSS in sections 5 and 7 determined the following discrepancies were found in the source code Table 3: VSAP 3.0 Source Code Findings: Table 3: VSAP 3.0 Source Code Findings Issue Consultant Assessment Mitigation Known Async issue - Low risk, This issue is mitigated by physical Language presents the potential for a security and strict chain of custody Vulnerability, live lock situation that could procedures. one instance result in data loss or (CVSS corruption, violation of 5.2.8.b.v) Asynchronous Best Coding Practice. Incomplete or The actual outcome for this The county has provided a report Missing Header review was a determination detailing the finding has no impact Comments, that a large number of on the readability/maintainability of multiple file/module header comments the code base. instances were insufficient or missing. (CVSS 5.2.6.a- Header issues - Not a risk h) factor, just violation of the CVSS requirement for all modules with more than 10 6 | Pa ge Table 3: VSAP 3.0 Source Code Findings Issue Consultant Assessment Mitigation executable lines to have an associated header. Dead Code, Commented out code was There is one commented line that one instance found in the source code was classified to be dead code. As (CVSS 5.2.7.e) base. Since it is this is a comment, it is not a comment, it will not be built interpreted in runtime. The into the compiled version of commented line is a constant the definition that is not used in the executable. code that would not cause any security problem. Calico The potential problem with This item is mitigated by physical container this configuration is simply and logical access. The county will security context that the address the finding in the next container is running release. effectively as root. 4. Security and Telecommunications (Red Team Penetration) Testing Security and Telecommunications (Red Team Penetration) testing of the VSAP 3.0 system was conducted in January of 2022, by SLI. The Security and Telecommunications testing resulted in the following findings requiring a resolution, response and/or mitigation. Each is described in Table 4: Security Findings: Table 4: Security Findings Issue Status Consultant Vendor Mitigation Assessment Full Disk Unresolved The functional security The County will submit Encryption: Full review found some an updated plan to disk encryption issues concerning full continue efforts to fully was not fully disk encryption implement full disk deployed allowing not being fully encryption across the for potential implemented, as well entire system. circumvention of as the solution protections which partially implements is considered a and vulnerability. utilizes FIPS compliant cryptography. SSL and Unresolved The solution utilizes The County will submit Cryptographic SSL, and other an updated plan to Algorithms: FIPS cryptographic address FIPS 140 compliance for methods throughout compliance. cryptography used the system. Much of the cryptographic 7 | Pa ge Table 4: Security Findings Issue Status Consultant Vendor Mitigation Assessment within the solution algorithms and not fully deployed. encryption observed is not fully implemented in FIPS 140-2 mode. Shared Secrets Partially It was determined that The County has provided and Full Disk Resolved the systems contain adequate documentation Encryption: shared secrets that regarding its password are utilized across policies and physical multiple systems. security. The County will submit an updated plan to continue efforts to fully implement full disk encryption across the entire system. Access control and Resolved It was determined that The County has provided high dependency the systems contain adequate documentation on root access. shared secrets that regarding its password are utilized across policies and physical multiple systems. security. Open ended Unresolved During the The County will patch all vulnerability vulnerability systems as tested in their (OEVT): Nessus assessment portion of development Scan, multiple the examination, all environment during the findings. components of the next release. It should be solution were noted that because of the examined. This Air-Gap requirement, included server, voting systems are virtualization, and essentially frozen at the networking time of Trusted Build and infrastructure. Some physically isolated from items did not have external connectivity. current security patches. 5. Volume Testing Summary The Volume Test simulates conditions in which the ballot marking devices would be used on Election Day. Fifty (50) BMD units were tested during the volume test, with twenty-two (22) temporary workers marking and casting one hundred (100) ballots per device over 1.5 days. The BMD devices were each loaded with the Los Angeles County’s March 2020 Presidential Primary Election, including all supported languages, with complete audio files for the testers to choose from. The testing resulted in the 8 | Pa ge following findings as described in Table 5: Volume Testing Issue Log: Table 5: Volume Testing Issue Log Issue Description County Response Timid Feeds – Out of the 50 ballot The BMD software has been upgraded marking devices used during testing, two since its early versions to ensure skew- experienced timid feeds or Ballot Page free ballot feeds and good BPM reads. Metadata (BPM) errors warranting the These higher safeguards ensure that ballot to be re-fed into the device. On units voters see no downstream (subsequent) #5 and #48, voters on these devices errors but instead see a routine step (to re- reported having to re-insert the ballot feed the ballot). County staff perform multiple times before being accepted for cleaning of each BMD prior to deployment each voting session. The BMD device by for any election. As noted here, cleaning design gently pulls the ballot into the reduces the incidence of these sorts of device in a timid, push/pull manner. errors occurring. Testers would sometimes be too gentle triggering the rollers, not allowing the ballot to catch. Testers would also sometimes attempt to force feed the ballot or would pull the ballot back after the device began to gently pull the ballot into the device. When the tester would perform one of these three actions, the BMD would appear to pull the ballot in, but immediately eject it and indicate to the voter the ballot would need to be re-inserted. The scanner on device #48 was cleaned which assisted in reducing the number of instances a ballot was rejected due to timid feed though the issue persisted. Clear instructions to voters and poll workers regarding the timid feed will mitigate the chances of this occurring. QR Code Errors: Two BMDs reported an “Unable to Read The BPM reading software is sensitive and Ballot” error when the ballot being cast will seek for the voter to re-insert their was initially inserted into the ballot box. In ballot if there is any problem reading the all instances, the ballots were re-inserted BPM code. on the same device and successfully loaded. SLI inspected the BMDs and found As for ballots missing the BPM code, the no obvious cause for the error and Volume Test decks were prepared via rejection of the ballot. automation, not one-by-one as in a Vote Center. The automation did leave the One BMD unit, #24, rejected both paper BPM off some ballots. This is an artifact of and electronic ballots when attempting to testing and would not occur in an election. 9 | Pa ge Table 5: Volume Testing Issue Log Issue Description County Response obtain the Zero Report during the Opening of the Polls. The machine was rebooted and accepted the ballot for the open polls report. The BMD did not experience any other issues during Volume testing voting sessions. Several ballots provided to voters were missing a QR code with precinct and ballot style information. The voter was displayed with a “Ballot Is Empty” onscreen message. These ballots were able to be manually activated by using the election credentials and entering the precinct number manually. Paper Jams In all cases the ballot was capable of being cast and the BMD did not add that ballot to Unit #1 experienced a paper jam during the ballot accounting totals - CVSS the initial insertion of a blank ballot to required behaviors. The 5/5000 is below begin the voting session. When removed the CVSS required 1/500 mis-feed allowed from the scanner, the ballot was rate. undamaged with no noticeable markings or bends. Unit #9 reported a paper jam to the voter; however, the ballot had not yet been fed into the BMD. The error displayed without any prompt of input from the voter between voting sessions. Unit #15 experienced a paper jam immediately after inserting the first ballot after polls were opened. When removed, the ballot was noticeably damaged along its edge and replaced with a new ballot. Unit #32 experienced a paper jam during the casting of the ballot. When removed from the scanner, the ballot was undamaged with no noticeable marking or bends. It was re-cast without further issues. Unit #33 presented the Error Code 203 to the voter with instructions that a paper jam 10 | Pa ge Table 5: Volume Testing Issue Log Issue Description County Response needed to be cleared. When removed from the scanner, the ballot was undamaged with no noticeable markings or bends. In all cases once the ballot was clear from the scanner/printer and the screen cleared using election worker credentials, jamming did not occur with additional attempts. Error Code - Two devices, #10 and #45, Software in the BMD watches for and experienced error code 901. This occurred prevents memory leaks, race conditions without any interaction from the voter. and similar software conditions. This Error Code 901 states that “There is an software activates at the end of a voter's issue that requires this unit to be session in preparation for the next voter rebooted.” Once rebooted the error was session and is sensitive to a range of cleared and voting resumed without further possible software errors. This error issues. checking and prevention scheme prevents downstream/subsequent errors that would interrupt a voter's session. Language – While casting a ballot in During the test election custom content Indonesian, a voter pointed out that the setup the Indonesian translation text had election definition did not contain a not been entered into VBL. The BMD translation screen for the “Party- correctly defaulted to English. In an Nominated Offices” instructions page and election this would be identified during instead had to display it in English. election set up and proofing and corrected. Frozen Screen – A single device, unit There can be process steps where the #40, was reported by the voter to get hung BMD seems slow to respond; however, up on the “Print Ballot” page for too long testing ensures that no response time is and buttons would be unresponsive. outside of the bounds specified by CVSS. Waiting an additional moment, pressing This reported issue is difficult to the “Print” button an additional time at the investigate since it occurred only one time bottom of the screen more firmly and after and not repeatable. a brief delay the BMD would move on. Overall, the Volume Test resulted in six categories of issues, ranging from timid feeds to a frozen screen. The timid feeds are by design. They are best described as a push/pull action by the device, to aid the voter with feeding the ballot into the BMD. The BMD devices encountered five paper jams, which is within the CVSS allowable rate 0.002% (CVSS 4.1.5.1 f). The error handling is within an acceptable rate per CVSS Section 4. 6. Accessibility, Usability and Privacy Testing Summary 11 | Pa ge The Accessibility, Usability and Privacy testing took place over two days January 20 to 21, 2022. Testing was limited to only two (2) volunteer testers, due to concerns about surging COVID-19 cases during the test period. The volunteers were from the Los Angeles County accessibility community. The BMD devices used for this test were programmed with the Los Angeles County’s March 2020 Presidential Primary Election. Each volunteer tester was asked to complete a ballot on their own, with assistance provided as requested. Upon completion of the session, both volunteer testers were asked to participate in a post-test survey regarding their experience. The survey results are included in Table 6: Accessibility Survey. Table 6: Accessibility Survey Tester Survey Results County Response Tester 1 The tester noted the headset N/A could not adjust to fully fit their head size and recommended headsets that could be adjusted for larger head sizes. Overall, the tester felt the system allowed the tester to mark and cast a ballot independently. Tester 2 The tester identified that when This is true and as programmed. the speech speed was adjusted, But only if the voter presses the the instructions stopped reading volume or rate button enough the current field. This required times to reach the topmost the voter to cycle through the setting. Then the audio plays a entire page again to re-listen to beep and the voter must listen to the current field. the entire string (candidate name, measure text, etc.) at that time. Tester 2 “...two different voices used It is because the recording of between instructions and election data is done by humans candidate names was (primarily from RR/CC staff). distracting…" Because of reliance on human voice, it may differ because the recording takes place over multiple days and with different staff (availability, COVID etc. being the factors). Tester 2 “...the rate of speech was There is no fault with the system. adjusted only one voice sped up Review of the code and listening and slowed down while the other to the audio showed that the rate stayed at the same rate." and volume buttons reliably affect the audio and, in the manner, expected. 12 | Pa ge IV. COMPLIANCE WITH STATE AND FEDERAL LAWS AND REGULATIONS 1. California Elections Code Requirements Six (6) sections of the California Elections Code, Sections 19101, 19203, 19204, 19204.5, 19205, and 19270, describe in detail the requirements any voting system must meet in order to be approved for use in California elections. These sections are described in detail and analyzed for compliance below. a) §19101 (b) (1): The machine or device and its software shall be suitable for the purpose for which it is intended. The system meets this requirement. b) §19101 (b) (2): The system shall preserve the secrecy of the ballot. The system meets this requirement. Vote by mail and BMD ballots can both be secretly cast. c) §19101 (b) (3): The system shall be safe from fraud or manipulation. The system meets this requirement. The tabulation system is wholly contained within an air-gapped environment, in addition to the Use Procedures prescribe strict chain of custody requirement, including the use of tamper evident seals, port security locks, and physical security mitigations/best practices. d) §19101 (b) (4): The system shall be accessible to voters with disabilities pursuant to section 19242 and applicable federal laws. The system meets this requirement. Accessibility testing conducted with members of the accessibility community verified that the system is accessible and voters with accessibility needs can cast a ballot privately and independently. e) §19101 (b) (5): The system shall be accessible to voters who require assistance in a language other than English if the language is one in which a ballot or ballot materials are required to be made available to voters pursuant to Section 14201 and applicable federal laws. VSAP 3.0 supports 14201 languages, as applicable to the County of Los Angeles. The system can add additional languages, to produce ballots or 13 | Pa ge ballot materials, and accessible audio files pursuant to Section 14201, utilizing system functionality and outside translation. f) §19203: The system shall use ballot paper that is of sufficient quality that it maintains its integrity and readability throughout the retention period specified in sections 1700 through 17306. The system meets this requirement. g) §19204: The system shall not include procedures that allow a voter to produce, and leave the polling place with, a copy or facsimile of the ballot cast by that voter at that polling place. The system meets this requirement as the ballot marking devices retain the ballots, in the integrated ballot box, upon casting. h) §19204.5: The Secretary of State shall not certify or conditionally approve a voting system that cannot facilitate the conduct of a ballot level comparison risk-limiting audit. The system meets this requirement. The systems components in addition to processes and procedures, prepare ballots during the tabulation process for a risk-limiting audit. i) §19205 (a): No part of the voting system shall be connected to the internet at any time. The system meets this requirement. No components of the voting system are connected to the internet. The system operates in a wholly contained air-gap environment. j) §19205 (b): No part of the voting system shall electronically receive or transmit election data through an exterior communication network, including the public telephone system, if the communication originates from or terminates at a polling place, satellite location, or counting center. The system meets this requirement. No components of the voting system are connected to the internet. The system operates in a wholly contained air-gap environment. k) §19205 (c): No part of the voting system shall receive or transmit wireless communications or wireless data transfers. The system meets this requirement. No components of the voting system have the capability, including optional capability to communicate 14 | Pa ge wirelessly. The system operates in a wholly contained air-gap environment. l) §19270 (a): The Secretary of State shall not certify or conditionally approve a direct recording electronic voting system unless the system includes an accessible voter verified paper audit trail. The system meets this requirement. 2. Elections Code Review a) §305.5(b): A paper cast vote record is a ballot only if the paper cast vote record is generated on a voting device or machine that complies with ballot layout requirements and is tabulated by a separate device from the device that created the paper cast vote record. The system meets this requirement. b) §15360: During the official canvass of every election in which a voting system is used, the official conducting the election shall conduct a public manual tally of the ballots tabulated by those devices cast in one percent of the precincts chosen at random by the elections official. If one percent of the precincts should be less than one whole precinct, the tally shall be conducted in one precinct chosen at random by the elections official. In addition to the one percent count, the elections official shall, for each race not included in the initial group of precincts, count one additional precinct. The manual tally shall apply only to the race not previously counted. The system fully supports this requirement. c) §19300: A voting machine shall, except at a direct primary election or any election at which a candidate for voter-nominated office is to appear on the ballot, permit the voter to vote for all the candidates of one party or in part for the candidates of one party and in part for the candidates of one or more other parties. The system meets this requirement. d) §19301: A voting machine shall provide in the general election for grouping under the name of the office to be voted on, all the candidates for the office with the designation of the parties, if any, by which they were respectively nominated. The designation may be by usual or reasonable abbreviation of party names. 15 | Pa ge The system meets this requirement. e) §19302: The labels on voting machines and the way in which candidates’ names are grouped shall conform as nearly as possible to the form of ballot provided for in elections where voting machines are not used. The system meets this requirement. f) §19303: If the voting machine is so constructed that a voter can cast a vote in part for presidential electors of one party and in part for those of one or more other parties or those not nominated by any party, it may also be provided with: (a) one device for each party for voting for all the presidential electors of that party by one operation, (b) a ballot label therefore containing only the words “presidential electors” preceded by the name of the party and followed by the names of its candidates for the offices of President and Vice President, and (c) a registering device therefore which shall register the vote cast for the electors when thus voted collectively. If a voting machine is so constructed that a voter can cast a vote in part for delegates to a national party convention of one party and in part for those of one or more other parties or those not nominated by any party, it may be provided with one device for each party for voting by one operation for each group of candidates to national conventions that may be voted for as a group according to the law governing presidential primaries. No straight party voting device shall be used except for delegates to a national convention or for presidential electors. The system meets this requirement. g) §19304: A write-in ballot shall be cast in its appropriate place on the machine, or it shall be void and not counted. The system supports this requirement. h) §19320: Before preparing a voting machine for any general election, the elections official shall mail written notice to the chairperson of the county central committee of at least two of the principal political parties, stating the time and place where machines will be prepared. At the specified time, one representative of each of the political parties shall be afforded an opportunity to see that the machines are in proper condition for use in the election. The party representatives shall be sworn to perform faithfully their duties but shall not interfere with the officials or assume any of their duties. When 16 | Pa ge a machine has been so examined by the representatives, it shall be sealed with a numbered metal seal. The representatives shall certify to the number of the machines, whether all of the counters are set at zero (000), and the number registered on the protective counter and on the seal. The system supports this requirement. i) §19321: The elections official shall affix ballot labels to the machines to correspond with the sample ballot for the election. He or she shall employ competent persons to assist him or her in affixing the labels and in putting the machines in order. Each machine shall be tested to ascertain whether it is operating properly. The system supports this requirement. j) §19322: When a voting machine has been properly prepared for an election, it shall be locked against voting and sealed. After that initial preparation, a member of the precinct board or some duly authorized person, other than the one preparing the machines, shall inspect each machine and submit a written report. The report shall note the following: (1) Whether all of the registering counters are set at zero (000), (2) whether the machine is arranged in all respects in good order for the election, (3) whether the machine is locked, (4) the number on the protective counter, (5) the number on the seal. The keys shall be delivered to the election board together with a copy of the written report, made on the proper blanks, stating that the machine is in every way properly prepared for the election. The system supports this requirement. k) §19340: Any member of a precinct board who has not previously attended a training class in the use of the voting machines and the duties of a board member shall be required to do so, unless appointed to fill an emergency vacancy. The system does not adversely impact this requirement. l) §19341: The precinct board shall consist of one inspector and two judges who shall be appointed and compensated pursuant to the general election laws. One additional inspector or judge shall be appointed for each additional voting machine used in the polling place. The system does not adversely impact this requirement. 17 | Pa ge m) §19360: Before unsealing the envelope containing the keys and opening the doors concealing the counters the precinct board shall determine that the number on the seal on the machine and the number registered on the protective counter correspond to the numbers on the envelope. Each member of the precinct board shall then carefully examine the counters to see that each registers zero (000). If the machine is provided with embossing, printing, or photography devices that record the readings of the counters the board shall, instead of opening the counter compartment, cause a “before election proof sheet” to be produced and determined by it that all counters register zero (000). If any discrepancy is found in the numbers registered on the counters or the “before election proof sheet” the precinct board shall make, sign, and post a written statement attesting to this fact. In filling out the statement of return of votes cast, the precinct board shall subtract any number shown on the counter from the number shown on the counter at the close of the polls. The system supports this requirement. n) §19361: The keys to the voting machines shall be delivered to the precinct board no later than twelve hours before the opening of the polls. They shall be in an envelope upon which is written the designation and location of the election precinct, the number of the voting machine, the number on the seal, and the number registered on the protective counter. The precinct board member receiving the key shall sign a receipt. The envelope shall not be opened until at least two members of the precinct board are present to determine that the envelope has not been opened. At the close of the polls the keys shall be placed in the envelope supplied by the official and the number of the machine, the number written on the envelope. The system supports this requirement. o) §19362: The exterior of the voting machine and every part of the polling place shall be in plain view of the election precinct board and the poll watchers. Each machine shall be at least four feet from the poll clerk’s table. The system supports this requirement. 2. Review of Federal Statutes or Regulations. 18 | Pa ge a) The Voting Rights Act (VRA) of 1965, as amended (42 U.S.C. 1973), requires all elections in certain covered jurisdictions to provide registration and voting materials and oral assistance in the language of a qualified language minority group in addition to English. Currently in California, there are eleven VRA languages (English, Spanish, Cambodian, Chinese, Hindi, Japanese, Khmer, Korean, Tagalog, Thai, and Vietnamese) as prescribed under the law. The system meets this requirement. The system’s paper ballots can be easily printed in these languages, as well as any others. Further, the BMD can be programmed to display the ballot in any of these languages on the touch screen interface and to provide audio instruction in any of these languages. b) The National Voter Registration Act of 1993 (42 U.S.C. 1973gg and 11 CFR 8) allows for the casting of provisional ballots through Fail-Safe Voting procedures. The system meets this requirement. Provisional ballots can easily be cast with this system. The BMD only marks ballots (or verifies the marking of a ballot), it has no impact on provisional voting. c) The Voting Accessibility for the Elderly and Handicapped Act of 1984 (42 U.S.C. 1973ee through 1973ee-6) requires each political subdivision conducting elections within each state to assure that all polling places for federal elections are accessible to elderly and handicapped voters, except in the case of an emergency as determined by the state’s chief election officer or unless the state’s chief election officer: (1) determines, by surveying all potential polling places, that no such place in the area is accessible or can be made temporarily accessible, and (2) assures that any handicapped voter assigned to an inaccessible polling place will, upon advance request under established state procedures, either be assigned to an accessible polling place or be provided an alternative means of casting a ballot on election day. This system supports this requirement. d) The Retention of Voting Documentation (42 U.S.C. 1974 through 1974e) statute applies in all jurisdictions and to all elections in which a federal candidate is on a ballot. It requires elections officials to preserve for 22 19 | Pa ge months all records and papers which came into their possession relating to an application, registration, payment of a poll tax, or other act requisite to voting. Note: The US Department of Justice considers this law to cover all voter registration records, all poll lists and similar documents reflecting the identity of voters casting ballots at the polls, all applications for absentee ballots, all envelopes in which absentee ballots are returned for tabulation, all documents containing oaths of voters, all documents relating to challenges to voters or absentee ballots, all tally sheets and canvass reports, all records reflecting the appointment of persons entitled to act as poll officials or poll watchers, and all computer programs used to tabulate votes electronically. In addition, it is the Department of Justice’s view that the phrase “other act requisite to voting” requires the retention of the ballots themselves, at least in those jurisdictions where a voter’s electoral preference is manifested by marking a piece of paper or by punching holes in a computer card. The system meets this requirement. All votes in this system are recorded on paper ballots that can be easily retained. 3. Help America Vote Act (HAVA) Requirements The Help America Vote Act (HAVA) §301(a) mandates several requirements for voting systems, including: 1) The ability to verify the vote choices on the ballot before that ballot is cast and counted, 2) Notification to the voter of over-votes on a ballot, 3) Auditability with a permanent paper record of votes cast, 4) Accessibility for individuals with disabilities, including nonvisual accessibility for the blind and visually impaired, in a manner that provides the same opportunity for access and participation (including privacy and independence) − This system supports these requirements in the following manner: a) The paper ballots themselves lend themselves to visual inspection and verification. b) The BMD provides its users with a ballot review screen prior to printing the ballot. Further, any voted ballot can be inserted into the unit for review and verification. c) The BMD prevents over-voting a contest. d) Because all ballots in this system are paper based, there is a fully auditable and permanent record of the election. e) Deployment of the BMD in a precinct provides accessibility for persons with disabilities at the polling place. 20 | Pa ge V. CONCLUSION The VSAP 3.0 voting system meets applicable California, HAVA and Federal Elections laws. The system does however have some remaining findings, which the Los Angeles County will address or has addressed in the appropriate mitigation areas of this report. Los Angeles County provided responses and/or mitigations to those findings, which will be evaluated by the California Secretary of State. 21 | Pa ge