Brewer voting action plan

              &
Janice K. Brewer
Secretary of State
Brewer Voting Action Plan
Election Services Division
1700 W. Washington St., 7th Fl.
Phoenix, Arizona 85007
602-542-8683
1-877-THE VOTE
A r i z o n a S e c r e t a r y o f S t a t e ’ s O f f i c e
IMPROVING
December 20, 2004 www.azsos.gov
ELECTION
ADMINISTRATION
MORE
CONFIDENCE
IN ARIZONA
ELECTIONS
INSIDE: Fair & Accurate
Elections
Secure
Elections
Paper
Trails
Shared
Information
Training &
Education
New Standards &
Equipment
BUILDING
Preliminary Plan
JAN BREWER
SECRETARY OF STATE
STATE OF ARIZONA
December 20, 2004
Dear Arizonan:
In December 2003, I announced that I was leading a new effort to formulate a voting system action
plan that would address statewide voting systems and technology issues as part of my ongoing commitment
to ensure integrity in our election process. After a year of collecting data and input from the public and
election administrators, I have completed the Brewer Voting Action Plan, which includes several
comprehensive findings and recommendations. This is another major milestone in my effort to improve
election administration and build even more confidence in the accuracy and reliability of our election
processes here in Arizona.
Over the past two years, my office has moved forward to ensure that all Arizonans are voting on
equipment that minimizes the possibility of accidental overvotes and other voting controversies as discovered
in the 2000 Presidential election in Florida. We adopted new voting system standards for all election
workers to use as part of our State Procedures Manual. We also procured optical scan voting technology for
those nine counties still using punch card voting systems, thus ridding our state of antiquated machines that
previously may have led to “pregnant or hanging chads”. In 2003, my office introduced the first requirement
ever in Arizona Revised Statute that voting equipment receives full testing and certification by a federally
accredited laboratory pursuant to the Help America Vote Act of 2002 (HAVA).
The Brewer Voting Action Plan is the result of a full analysis of Arizona’s current voting technology,
voting security systems, voting system certification procedures, and the general standards and operating
procedures followed by our state and county election officials in administering Arizona’s federal and state
elections. I am proud to present the findings and recommendations from this comprehensive review. The
Brewer Voting Action Plan will be available for public comment for 30 days prior to being finalized.
We have some of the most dedicated and honest election workers who continue to build public
confidence, make certain that votes are properly counted, and ensure integrity in our election process. I
remain highly confident that Arizona’s statewide election process is as accurate and reliable as any
jurisdiction in the country. It is my hope that the Brewer Voting Action Plan will further improve Arizona’s
election process.
Sincerely,
Janice K. Brewer
Arizona Secretary of State
Brewer Voting Action Plan
INTRODUCTION..........................................................................................................................2
BACKGROUND.............................................................................................................................3
EXECUTIVE SUMMARY.............................................................................................................4
RECOMMENDATIONS................................................................................................................9
I. IMPROVE ELECTION PROCEDURES TO ENSURE FAIR AND
ACCURATE ELECTIONS..........................................................................................9
II. INCREASE VOTING SYSTEM SECURITY PROCEDURES TO RAISE
PUBLIC CONFIDENCE IN ELECTIONS ..............................................................12
III. REQUIRE A VOTER VERIFIABLE PAPER BALLOT FOR ALL
TYPES OF VOTING SYSTEMS USED IN ARIZONA..........................................14
IV. INCREASE THE SHARING OF INFORMATION AND LESSONS
LEARNED ...................................................................................................................17
V. PROVIDE FORMAL SECURITY AWARENESS INFORMATION,
TRAINING, EDUCATION, AND PROCEDURES.................................................19
VI. STRENGTHEN CURRENT STATE CERTIFICATION POLICIES AND
STANDARDS FOR VOTING EQUIPMENT AND SOFTWARE TO
INCREASE VERIFIABILITY AND TRANSPARENCY IN THE
ELECTION PROCESS. ............................................................................................21
VII. IMPLEMENT STANDARDS AND RECOMMENDATIONS FROM THE
ELECTION ASSISTANCE COMMISSION............................................................23
VIII. MODERNIZE ELECTION EQUIPMENT AND SOFTWARE...........................24
IX. ENHANCE THE STATEWIDE VOTER REGISTRATION SYSTEM ...............26
APPENDIX - GARTNER ASSESSMENT OF ELECTION SYSTEMS REPORT ...............30
2
INTRODUCTION
On December 12, 2003, Secretary of State Jan Brewer announced the formulation of a new voting
action plan as part of her ongoing commitment to maintain the integrity of Arizona’s election
process. Secretary Brewer is now pleased to present the Brewer Voting Action Plan (Brewer Plan).
The purpose of the plan is to make recommendations to improve election administration in Arizona
and to ensure that the citizens of Arizona have the highest degree of confidence in the accuracy and
reliability of our election process. The scope of the recommendations contained in the plan covers
all federal and state elections under the jurisdiction of the Secretary of State’s Office. Public input
will be sought before this plan is finalized.
The Arizona Secretary of State’s Office conducted an intensive review of Arizona’s election
process in consultation with Gartner Consulting, one of the world’s leading information technology
research and advisory firms. Gartner was chosen because of its vast familiarity with the dynamics
and developments in electronic voting systems and its expertise in election technology and the
election procedures followed by other jurisdictions.
This plan is the result of a full analysis of Arizona’s current voting technology, voting security
systems, voting system certification procedures, and the general standards and operating procedures
followed by our state and county election officials in administering Arizona’s federal and state
elections. The review revealed hundreds of important technical and practical suggestions for the
State of Arizona to improve its voting systems, now and in the future.
Recommendations in the Brewer Plan are based in part on the review of the election system and
processes in Arizona and also incorporate communications from the county election administrators
and the general public. A primary focus of this plan is to address the reliability and security
concerns surrounding electronic or computer-based voting systems, commonly referred to as “touch
screen” or direct recording electronic (DRE) devices.
Formulation of this plan included an analysis of recent studies and articles regarding election
technology and security, correspondence and observations between vendors and staff, site surveys
and focused interviews of county election officials that were conducted throughout the state.
During this process, best practices from around the nation were identified through communication
with other state and local jurisdictions regarding their certification and security processes, and a full
evaluation was made of the hardware and software currently in use throughout Arizona.
The Brewer Voting Action Plan presents the first major review of Arizona’s election processes in
over a decade. The findings and recommendations in the plan represent the primary and most
critical changes from this year long assessment. This plan provides the state and county election
officials with a detailed strategy and focuses on what priorities should be immediately implemented
under the leadership of the Brewer Administration. In addition, the review identified other issues
that will need to be considered and addressed in the future as our state continues to grow.
3
BACKGROUND
As a result of issues raised during the 2000 Federal Election, the processes in each state have been
closely scrutinized. In response, Congress enacted the Help America Vote Act of 2002 (HAVA) on
October 29, 2002. In addition, Arizona made several important changes to its election laws and
procedures to implement HAVA and to assure Arizona’s elections would continue to operate
smoothly in the future. The mandates set forth in HAVA are designed for implementation over a
period of several years. This plan sets forth recommendations that are designed to work in
conjunction with the ongoing implementation of HAVA in addition to improving our state’s overall
voting procedures.
A primary feature of HAVA is the distribution of federal monies to upgrade each state’s voting
equipment. It also sets forth voting system standards to assure accuracy, mandates the creation of a
statewide voter registration system, requires a provisional ballot process so voters can ascertain the
disposition of their ballot, sets a deadline for states to provide independent access and
confidentiality for voters with disabilities to vote on appropriate voting devices, and provides for the
implementation of procedures that will protect each citizen’s right to vote.
Shortly after HAVA was enacted, Secretary of State Jan Brewer published the Arizona HAVA State
Plan that identified the priorities and specific steps the State of Arizona would take to address
election reform and bring Arizona into compliance with HAVA. The HAVA plan was developed in
conjunction with the State Planning Committee and was adopted unanimously from a group of state
officials, legislative representatives, local officials, party representatives and individuals with
special interests in improving access to the disabled. The HAVA plan called for the use of optical
scan voting equipment in all 15 counties because it was proven technology with good audit
capability. Secretary Brewer chose to have these machines ready for use in the 2004 elections
rather than waiting until 2006 as permitted by HAVA. All 15 counties used this voting technology
successfully during the 2004 elections.
Despite this success, perceived security issues surrounding electronic voting and other electoral
processes persist. Under HAVA, every polling site must have a direct recording electronic (DRE)
or other accessible voting device for the disabled in place before the 2006 elections. The Secretary
of State’s Office has begun preliminary preparation to identify the business requirements,
technological needs, and legal requirements of the state in procuring accessible voting devices for
disabled persons by 2006. It is therefore necessary to address the security concerns associated with
this technology as well as other potential security issues surrounding the entire electoral process in
Arizona.
The disabled community was the driving force behind the passage of HAVA and its mandate for
accessible voting machines at each polling site. The primary concern expressed by this community
to Congress was the need to vote in private and without assistance. Some of the enthusiasm for
DRE or “touch screen” voting devices was dampened when computer science experts and others
raised concerns of mechanical failures and potential security threats from computer hackers.
Additional questions also arose over the verifiability of votes cast, leading many states to shy away
from these devices or require them to produce a paper ballot or receipt to allow the voter to verify
his or her selections before the vote is officially cast.
4
Secretary Brewer believes DRE voting systems can be used safely and effectively, but the ongoing
nationwide controversies over this technology could ultimately force changes to existing federal
standards. With so many unknowns in the future for DRE or touch screen systems, Secretary
Brewer urged a cautious approach in meeting the federal mandates for accessibility. The
completion of the year long review, along with the recommendations contained in the Brewer Plan,
are timed to work with the Arizona HAVA State Plan.
The concerns surrounding voting systems and security have not been limited to DRE and touch
screen voting devices. Consequently, this plan presents recommendations regarding other critical
voting processes, including the manner in which the state certifies voting equipment, the procedures
followed at the polling places, the security surrounding the transportation and processing of ballots,
poll worker training, and the statewide voter registration process. The Brewer Voting Action Plan
provides important findings and recommendations to be used in improving these procedures and
accomplishing the mandates set forth in HAVA.
EXECUTIVE SUMMARY
The Brewer Voting Action Plan outlines an overall strategy, identifies specific and important
recommendations, and establishes a basic timeline to ensure proper security requirements for the
entire Arizona electoral process. This plan was developed in response to concerns raised over
security in voting equipment, and with the expectation that an in-depth analysis of current election
procedures will improve our elections and further ensure the integrity of the voting process.
The election review conducted over the past year identified several findings, most of which are not
unique to Arizona. The key findings are as follows:
• The 2000 Presidential Election raised awareness and skepticism of the election process.
• Not all county election procedures are clearly established, which can result in inconsistent
application throughout the state.
• Elections are becoming more reliant on technology.
• The public is distrustful of the manner in which electronic voting machines tabulate and
store votes.
• The public wants a voting system that allows them to verify their selections on paper.
• The disabled community desires to vote privately and without assistance.
• Strengthening the election security procedures will raise public confidence in the election
process.
• The election process improves with the increased sharing of information between election
officials, vendors, and interested parties.
5
• Properly trained poll workers are absolutely critical to the election process.
• The quality of election official training and poll worker training has a tremendous impact on
the quality of the election.
• The policies, procedures and practices of election officials must continue to be evaluated
and improved where necessary.
• State certification procedures for election equipment and software need to be more detailed.
• The Election Assistance Commission needs to provide standards and recommendations to
election officials.
• The state and counties need to standardize and modernize election equipment and software.
• The processing of voter registration information, sharing of data between government
agencies, and the maintenance of accurate voter registration information needs to be
improved over time.
The primary recommendations of the Brewer Voting Action Plan are as follows:
I. Improve election procedures to ensure fair and accurate elections.
1. Implement procedures to verify transmitted election results for all elections once
materials are returned from the precincts.
2. Establish contingency plans in the event that outside contractors are unable to
perform their duties.
3. Establish minimum standards of emergency preparedness for all counties.
4. Strengthen laws, policies, and procedures concerning recounts and contested
elections.
5. Clarify and enhance polling place procedures regarding physical set up, poll workers,
and observers.
II. Increase voting system security procedures to raise public confidence in the elections.
1. Implement minimum statewide standards and procedures for physical storage and
transport of election machines and ballots.
2. Seek legislation to increase penalties for tampering with election equipment or
software.
6
3. Implement minimum polling place security procedures to ensure no malicious
tampering occurs with election equipment or software.
4. Implement procedures to ensure that proper security methods and practices are
applied to all election system software and hardware.
5. Implement procedures to ensure that election systems are not connected to the
Internet and that election equipment is used only for election purposes.
III. Require a voter verifiable paper ballot for all types of voting systems used in Arizona.
1. Optical Scan technology will remain the primary tabulation technology used in
Arizona.
2. Any accessible voting device (DRE or touch screen voting machine) will be required
to have a paper receipt or paper ballot that visually indicates all votes cast.
IV. Increase the sharing of information and lessons learned.
1. Establish semi-annual post election meetings of county and local election officials to
identify and recommend voting system procedure improvements.
2. Increase the sharing of information among election officials using similar equipment
by establishing user groups.
3. Implement a communication schedule with Arizona vendors of election systems to
ensure compliance with Arizona policies and procedures.
V. Provide formal security awareness information, training, education, and procedures.
1. Enhance election official training by expanding election curriculum and offering
training to all county and local election personnel.
2. Enhance poll worker training guidelines.
3. Provide state funding for poll worker training.
4. Increase state funding for voter outreach to ensure the public is informed about
election systems and procedures.
VI. Strengthen current state certification policies and standards for voting equipment and
software to increase verifiability and transparency in the election process.
1. Require software and firmware source code be held in escrow.
2. Require all changes to voting systems used in Arizona be certified by the Secretary
of State and national independent testing authorities for full functional and security
testing.
7
3. Implement certification best practices learned from other states and the EAC.
4. Ensure that only certified software, hardware and firmware are used in Arizona
elections.
5. Seek legislation to allow the Secretary of State to grant conditional emergency
certification when warranted.
VII. Implement standards and recommendations from the Election Assistance Commission.
1. Review and evaluate all recommendations and best practices set forth by the EAC.
VIII. Modernize election equipment and software.
1. Replace antiquated punch card voting machines with optical scan technology.
2. Provide accessible voting devices for voters with disabilities.
3. Continue to monitor the state of the election equipment industry.
4. Develop a statewide election equipment refresh policy.
IX. Enhance the statewide voter registration system.
1. Enhance the statewide voter registration system with improved processes and
technology to ensure accurate voter registration rolls.
2. Enhance the ability of citizens to know the status of their provisional ballot.
3. Improve the accessibility for all citizens to the voter registration process.
4. Ensure that the statewide voter registration database is accessible to county voter
registration officials.
5. Seek legislation to improve the quality of voter registration drives.
Arizona elections have run smoothly in the past. Arizona has also been a leader in implementing
HAVA, and unlike the majority of states, Arizona has not asked for time waivers on the two largest
sections of HAVA, replacing punch card voting machines and building a statewide voter
registration list. Instead, Arizona implemented both of these mandates in time for the 2004
elections. The experiences gained from implementing these sections of HAVA have placed
Arizona in a favorable position to continue to improve the election process throughout the state.
The Brewer Voting Action Plan will require legislative changes, some of which will be introduced
in the 2005 Arizona Legislative session. The timeline for completing most of the recommendations
is the 2006 Federal Elections.
8
The Brewer Plan will be available for public comment for 30 days prior to being finalized. The
public is invited to submit comments in writing to the Secretary of State's Office at 1700 W.
Washington St. 7th Floor, Phoenix, Arizona 85007. The public comment period will end at 5:00
p.m. on January 19, 2005.
9
RECOMMENDATIONS
I. IMPROVE ELECTION PROCEDURES TO ENSURE FAIR AND
ACCURATE ELECTIONS.
Arizona’s election laws and procedures are set forth in Title 16 and 19 of the Arizona Revised
Statutes. In addition, the Secretary of State’s Election Instruction and Procedures Manual
(Procedures Manual) identifies rules for obtaining the “maximum degree of correctness,
impartiality, uniformity and efficiency on the procedures for early voting and voting, and of
producing, distributing, collecting, counting, tabulating and storing ballots.” This section of the
Brewer Plan identifies several steps that should be taken to review Arizona’s election laws and
procedures to ensure that Arizona’s elections continue to be conducted in a fair and accurate
manner.
1. Implement procedures to verify transmitted election results for all elections once materials
are returned from the precincts.
On election night most precinct results are communicated electronically through modems from the
polling location to the counties’ central site where results are tabulated. Computer experts have
speculated that it would be theoretically possible for a hacker to somehow “hijack” this
transmission and send false results. While this is a remote possibility, it is not considered to be a
viable threat for several reasons.
First, the hacker would need to breach the built-in password security of the tabulation machine.
Second, the hacker would need an extreme amount of inside information to accomplish this task,
including information on internal precinct names and election database keys that change whenever
the election database is modified. Third, the hacker would have to time his or her false transmission
perfectly so that it comes before the actual precinct’s transmission. Finally, the central site would
immediately identify the problem when it received two transmissions from a precinct (the false one
and the actual one).
Computer experts suggest that increasing the security and encryption level of the results
transmission is the only way to eliminate this risk. Most of these theories fail to consider all of the
procedures and verification mechanisms already safeguarding elections. Nevertheless, several
additional procedures can be put in place to minimize this potential security vulnerability.
The Secretary of State will incorporate into the Procedures Manual a procedure that clearly defines
the election results transmission process and eliminates any risk in this area. This will be
accomplished by establishing procedures that:
• Make election officials aware of the potential risk;
• Establish rules regarding securing transmission channels when they are not expected to be in
use;
10
• Create guidelines for handling cases where multiple transmissions are received from one
precinct (which could identify a problem); and
• Mandate a policy that requires a double check of all election results by comparing the
precinct paper tape to the transmitted results.
2. Establish contingency plans in the event that outside contractors are unable to perform
their duties.
As a result of size and resource constraints, several counties in Arizona outsource election
related tasks to local vendors. These tasks include ballot design, election programming
services, and ballot printing coordination. Although it is recognized that the counties should
be able to outsource election related functions if necessary, the reliance on a single vendor
raises concerns in the event that the vendor is unable to perform its duties at a critical time
during the election cycle.
Therefore, the Brewer Plan recommends that all counties develop a contingency plan to
assure that critical election tasks will be accomplished. These contingency plans should
include, but are not limited to the following:
• Participation in statewide election equipment user groups;
• Continuous training of key employees to perform the more essential election related
functions currently being outsourced;
• The sharing of knowledge and resources between neighboring counties; and
• Ongoing renewal of maintenance and support contracts with election equipment
vendors.
The Secretary of State’s Office will continue to work with the counties to solidify their
contingency plans for the 2006 Federal Elections.
3. Establish minimum standards of emergency preparedness for all counties.
The increased awareness of homeland security has affected the election process. It is necessary for
election officials to have a complete contingency plan in place in case of an emergency. In
developing this contingency plan, it is necessary to balance polling place security with the need for
voter accessibility.
There is always the possibility of an unforeseen event disrupting the election process. For example,
Arizona polling sites have been moved because of bad weather, toxic spills, and bomb threats.
Fortunately, these events have always been handled without seriously disrupting any election. It is
necessary, however, to ensure that our county election officials are prepared to deal with an
unforeseen event that may arise during an election.
All counties have some level of emergency plans in place. The Secretary of State’s Office has
determined that the level of preparedness in planning for unforeseen events varies among the
11
counties. In addition, homeland security has expanded the types of contingencies for which
planning needs to occur. The Secretary of State will collaborate with the counties to review current
plans and homeland security guidelines, develop revised minimum standard of emergency
preparedness, and implement the revised emergency preparedness plans prior to the 2006 Federal
Elections.
4. Strengthen laws, policies, and procedures concerning recounts and contested elections.
An automatic recount occurs if the margin between two candidates or votes cast for and against a
ballot measure fall within a small margin set by statute. In addition, any elector can file a contest
action within five days after the election is canvassed. A recount and contest proceeding may be
combined into one court proceeding. The statutes establishing recount and contest procedures have
been in existence for decades. It is now time to revisit these statutes in light of the election process
and technology currently in use today.
There are certain known changes that will help improve these laws, policies and procedures. For
example, this past election revealed a discrepancy between the procedures and Arizona Statutes
regarding ballot storage. Legislation will be sought in 2005 to fix that problem and the Procedures
Manual will be revised accordingly.
Other issues surrounding recounts and contested elections need a comprehensive review. Changes
should be proposed if the review reveals any flaws or shortcomings in the current laws, policies, or
procedures including appropriate auditing processes. Because of questions surrounding the
accuracy of manual audits and recounts, there is significant doubt as to whether this is a realistic
solution for Arizona. A comprehensive review should be conducted by a committee appointed by
the Secretary of State, which shall issue a report to the Secretary of State prior to December 1, 2005.
5. Clarify and enhance polling place procedures regarding physical set up, poll workers, and
observers.
To assure uniformity throughout the state, it is recommended that the procedures followed in each
polling place on Election Day be in compliance with the guidelines outlined in the Secretary of
State’s Procedures Manual to the nearest extent possible. Polling locations vary a great deal, but
uniformity in the basic set up and operation of the polling place will help to ensure a more efficient
system for voters on Election Day.
Proper protocol for poll workers and party observers is one area that will be addressed. It is also
recommended that all counties offer Premium Election Board Worker Training. This is voluntary
training that is more intensive and covers more material than the statutory pre-election training
currently required of poll workers. This training is provided for in statute and is currently offered in
several counties. Attendees are tested at the end of an eight-hour training, and receive “certified”
status. Those who do not get a passing score will have an opportunity to attend future classes, or
study the handbook and re-take the test. The Secretary of State will work with county election
officials to establish guidelines and curriculum for these trainings.
12
II. INCREASE VOTING SYSTEM SECURITY PROCEDURES TO RAISE
PUBLIC CONFIDENCE IN ELECTIONS.
It is the role of election officials to protect and promote public trust and confidence in the election
process. The foundation of our democracy is the fundamental faith that our citizens have in the
fairness of our elections. The success of the democratic process depends upon fair, open, and
secure elections, which accurately reflect the intent of the citizens.
Providing secure elections plays a critical role in garnering public confidence in the election
process. Secure elections include maintaining the physical security of the equipment and supplies
and also protecting electronic equipment from unauthorized access or computer attacks.
Election security is of utmost concern to Secretary Brewer. In addition to the recommendations
below, as a member of the EAC Standards Board, the Secretary Brewer will continue to work and
advocate for stricter federal standards for election security.
This section of the Brewer Plan identifies several steps that should be taken to ensure that Arizona's
elections continue to be conducted in a fair, open and secure manner.
1. Implement minimum statewide standards and procedures for physical storage and
transport of election machines and ballots.
Arizona counties vary in size, resources, and facilities and have their own procedures for physical
security when it comes to elections. These include security surrounding the storage of voting
machines and ballots, and the manner in which machines and ballots are transported to and from the
polling locations.
The Secretary of State along with county election officials will set minimum statewide standards
and procedures for physical storage and transport of election machines and ballots. These changes
will be set forth in the Procedures Manual.
2. Seek legislation to increase penalties for tampering with election equipment or software.
The Secretary of State will seek legislation to make it a Class 4 felony to tamper with any
component including software, source code, or hardware used for elections. Election officials will
be asked to post a notice regarding the penalties for tampering with any component of the voting
system in the polling locations.
3. Implement minimum polling place security procedures to ensure no malicious tampering
occurs with election equipment or software.
Election security demands that sound procedures be put in place and followed without variance.
Comprehensive and consistent security procedures at the polling place will help ensure that no
malicious activity can occur with voting equipment and instill public confidence in the process.
13
The Secretary of State along with county election officials will set minimum polling place security
procedures. All counties should be required to develop a physical security plan regarding all of the
components of the voting system, including the details of how the chain of custody of each
component is monitored and documented.
4. Implement procedures to ensure that proper security methods and practices are applied to
all election system software and hardware.
All election tabulation machines depend on hardware and software to operate. Although all
counties have some level of computer security in place, the level of security and practices varies.
The State of Arizona should adopt computer security procedures to assure that all counties follow
uniform standards regarding election system software and hardware. The procedures should cover:
• User ID and password maintenance;
• Security patches to computers;
• Standards for transmitting election results;
• Authorized access to voting equipment; and
• Proper auditing.
5. Implement procedures to ensure that election systems are not connected to the Internet
and that election equipment is used only for election purposes.
The election systems used in Arizona should not be connected to the Internet in any manner. It is
acceptable for election equipment to be networked separately, but that network cannot be connected
to any other network or the Internet. This will eliminate any possibility of an Internet attack.
Some election equipment uses standard computer hardware and software. It is possible for this
equipment to be used for other office related tasks unrelated to the election. New procedures will
require that election hardware and software be used only for election purposes.
14
III. REQUIRE A VOTER VERIFIABLE PAPER BALLOT FOR ALL
TYPES OF VOTING SYSTEMS USED IN ARIZONA.
Many state and local jurisdictions have moved towards direct record electronic (DRE) voting
systems. This technology allows a voter to cast a ballot using a touch screen. The vote is tabulated
electronically and no paper ballot or receipt is generated. These states and jurisdictions have faced
a flurry of criticism and lawsuits by many individuals and groups that believe this technology is
insecure and vulnerable to memory and equipment failures, software corruption, and electrical
component flaws.
With so many unknowns in the future for touch screen systems, Secretary Brewer urged a cautious
approach when choosing which equipment to replace the antiquated punch card voting machines
still being used in Arizona prior to 2004. Instead of choosing to purchase touch screen voting
machines, the decision was made to replace the punch card machines with proven optical scan
voting technology.
The Gartner study concluded that DRE or touch screen technology may be used safely and
effectively and does not require the use of a paper ballot, but that the ongoing nationwide
controversies over this technology could ultimately force changes to existing federal standards.
Although these claims have yet to be substantiated and virtually every legal challenge brought
against this technology to date has failed, public confidence is clearly below what it should be.
Based on this review, new developments in technology, and experience gained from an
experimental pilot project conducted during the 2004 General Election, Secretary Brewer has
concluded that any voting system used in Arizona must have a voter verifiable paper receipt or
ballot that visually indicates all votes cast.
1. Optical Scan technology will remain the primary tabulation technology used in Arizona.
As stated previously, HAVA mandated the replacement of punch card voting machines and also
requires that at least one DRE voting system or other voting system equipped for individuals with
disabilities be placed at each polling site by the 2006 Primary and General Elections. Through the
“Adios Chad” program administered by Secretary Brewer in 2003, all counties in Arizona now
utilize optical scan technology as their main election system. Optical scan technology provides a
voter verifiable paper ballot that visually indicates all votes cast. The optical scan paper ballots are
machine-readable so that, in the event of a recount, they may be quickly and accurately processed.
Optical scan technology is the optimal technology at this time because:
• It relies on a paper ballot that indicates clearly the selections made by the voter and is
machine-readable;
• It is flexible enough to accommodate both onsite voting in the polling place and early or
mail voting;
15
• In the unlikely event of an equipment failure, the ballots are always available for subsequent
review and inspection; and
• It is the optimal technology to handle additional voter volumes at the polling locations.
Each polling location only needs one optical scanning machine, but can set up many voting
booths. No additional electronic equipment is needed to set up additional voting stations.
Consequently, it is recommended that optical scan technology continue to be the primary voting
tabulation technology used in Arizona.
2. Any accessible voting device (DRE or touch screen voting machine) will be required to
have a paper receipt or paper ballot that visually indicates all votes cast.
In 2003, the primary direct recording electronic (DRE) technology was touch screen machines that
tabulated votes, but did not provide any paper record to the voter displaying what the voter selected.
The voter could only review his or her votes on the touch screen before finalizing his or her ballot.
At that time, touch screen technologies that provide a paper receipt to the voter had not gone
through an independent testing authority (ITA) certification as required by Arizona law.
The Secretary of State will issue a Request for Proposal (RFP) in early 2005, inviting vendors to bid
on the contract to place an accessible voting device in each of Arizona’s 2,000 plus polling sites
prior to the 2006 Federal Elections. Initially, the intent was to purchase the original touch screen
system that did not produce any type of paper receipt or ballot. After observing the issues raised in
other jurisdictions using these devices in 2003 and 2004, Secretary Brewer chose to delay the
purchase of these systems until the issues surrounding this technology could be studied further.
Because of the diminished public confidence in DRE or touch screen voting devices that do not
produce a paper receipt, the Secretary of State will specify in the RFP that each accessible voting
device must produce a voter verifiable paper receipt or paper ballot that visually indicates all votes
cast. Vendor selection is expected by mid-year 2005. All polling locations in Arizona will have a
new accessible voting system that produces a paper ballot before the first federal election in 2006.
One such technology came to the attention of Secretary Brewer early in 2004 and through her
efforts Arizona became the first state in the country to participate in a pilot demonstration project of
this technology at the November 2, 2004 General Election. This technology provides an accessible
touch screen voting environment to disabled voters while also producing a standard paper ballot that
can be read by existing optical scan equipment.
This pilot project was broken into two different phases. The first phase included various hands-on
demonstrations of the new technology during the summer and fall with members of the disabled
community, minority groups, and literacy groups. There was significant interest, attendance,
participation, and interaction with the new technology. The second phase involved a limited
experimental use of this equipment as part of the November 2, 2004 General Election. This
experimental use during the election was limited to Maricopa, Cochise and Graham counties in six
different precincts.
16
Voters were given the opportunity to vote on the machines, which marked official ballots. Sixty-five
voters cast their ballots using the system and filled out surveys that will be reviewed by the
Secretary of State’s Office as it determines how best to meet the HAVA 2006 accessibility
requirement. The overall response was very favorable with most participants indicating they would
willingly use this technology again in a future election.
While it is unclear whether this specific technology will be chosen as the final solution for
Arizona’s accessible voting needs in 2006, and all vendors will be required to competitively bid
through the state procurement process, it serves as one example of the type of technology that may
satisfy the requirements of this recommendation.
17
IV. INCREASE THE SHARING OF INFORMATION AND LESSONS
LEARNED.
Each of Arizona’s fifteen counties is primarily responsible for administering the federal and state
elections. These responsibilities are shared by the county board of supervisors and the county
recorders and include preparing, printing and providing sufficient ballots, mailing sample and early
ballots to voters, training poll workers, tabulating and storing ballots. The Procedures Manual sets
forth rules that have the force of law and are followed by the counties in administering these
responsibilities in a correct, impartial, uniform, and efficient manner. Nevertheless, it is impossible
for the Procedures Manual to cover every possible administrative task and function performed by
the counties. Thus, it is important for regular communications to occur to ensure the greatest degree
of uniformity possible. This section sets forth recommendations to accomplish this objective.
1. Establish semi-annual post election meetings of county and local election officials to
identify and recommend voting system procedure improvements.
In order to maximize the potential for conducting fair and accurate elections, it is vital that all
counties follow uniform guidelines. The Procedures Manual is one of the tools used in working
toward the goal of uniformity. The implementation of new voting equipment in Arizona has
resulted in the need for new procedures for the conduct of elections.
The Election Officials of Arizona currently hold post election meetings in April and November each
year to discuss lessons learned in the election process. Discussion points for these meetings include
not only uniform organizational approaches to election management, but also proposed legislation
and changes to the Procedures Manual. It is recommended that election officials seek out public
comment, poll worker input, and poll worker evaluations for further topics of discussion at these
meetings to ensure that the end goal of improving the election process in Arizona is achieved.
2. Increase the sharing of information among election officials using similar equipment by
establishing user groups.
Nine of Arizona’s fifteen counties first began using optical scan voting equipment during the
Presidential Preference Election held on February 3, 2004. These counties all put into use the
Diebold AccuVote optical scan machine purchased through the Secretary of State’s “Adios Chad”
program in 2003. The remaining six counties have been using similar optical scan technology since
as early as 1996. Of these six counties, three use equipment manufactured by ES&S and three use
Diebold equipment. The experiences of these six counties have proven invaluable as the nine
counties transition to the new voting technology.
During the transition, the Secretary of State felt it would be advantageous to form user groups. The
information and experiences shared within these groups has played an integral part in the success of
the “Adios Chad” implementation.
18
Both ES&S and Diebold have been willing participants in the user group meetings. Many of the
concerns and apprehension expressed by the counties have been addressed as a result of the
vendor’s presence. These meetings should continue semi-annually or be held more frequently if the
need arises.
3. Implement a communication schedule with Arizona vendors of election systems to ensure
compliance with Arizona policies and procedures.
As proven with vendor attendance at the Diebold User Group meetings, communication between
the state, counties, and the election equipment vendors is of the utmost importance. The Secretary
of State will meet with existing vendors of both election equipment and voter registration systems
on an annual basis to cover changes in technology and legislation that will affect the voting process
and to ensure that the vendors are complying with Arizona’s election laws and procedures.
19
V. PROVIDE FORMAL SECURITY AWARENESS INFORMATION,
TRAINING, EDUCATION, AND PROCEDURES.
Elections are complex events and require a substantial amount of work to administer successfully.
The changes to election technology and Arizona's tremendous population growth add to the
complexity of planning and executing an election. The keys to success are properly trained
election officials, properly trained poll workers, and an electorate that understands the voting
process. This section of the Brewer Plan sets forth recommendations to provide formal security
awareness information, training, education, and procedures.
1. Enhance election official training by expanding election curriculum and offering training
to all county and local election personnel.
Proper training is a key component to ensure that election officials are properly equipped to perform
their responsibilities. Election official certification training includes such items as education on
new laws, election policies and procedures, real election situations, and hands on experience of
voting system equipment.
It is recommended that election official certification training be made available to city election
officials to help ensure uniform election administration statewide.
2. Enhance poll worker training guidelines.
Poll workers are often the first and only personal contact that citizens have with the election process
and are the backbone of any successful election. Several thousand individuals worked the polls
during the 2004 Primary and General Elections. These individuals often work sixteen or more
hours on Election Day with few breaks. It is imperative that qualified people be recruited to work
the polls and that these individuals be properly trained to assure that the elections are conducted in a
fair and uniform manner.
On Election Day, poll workers welcome voters, facilitate voting, conduct precinct operations in
accordance with election law, instruct voters, and follow carefully defined procedures. Poll workers
are a large part of the goal of providing a satisfactory Election Day experience for all voters.
Poll workers attend mandatory training sessions to prepare them for their responsibilities. The
Procedures Manual provides general guidance to the counties on topics to be covered during the
training. The counties, however, are responsible for performing poll worker training, and the
quality and level of training can differ from county to county.
It is recommended that the Secretary of State's Office enhance existing guidelines regarding the
minimum standards for all counties to follow when performing poll worker training to ensure
statewide uniformity.
20
3. Provide state funding for poll worker training.
Poll workers only work during the four election periods each year. Election officials have
challenges recruiting, retaining, and training poll workers. The Secretary of State's Office will
provide funding to counties to establish more comprehensive poll worker training curriculum,
obtain better training materials, enhanced “Premium Board Worker” training, and assist in
delivering proper poll worker training. The funding cannot be used for poll worker compensation,
as that is the counties’ responsibility.
4. Increase state funding for voter outreach to ensure the public is informed about election
systems and procedures.
The primary purpose of voter outreach is to reach those populations who traditionally have been
under-represented at the polls or who are not informed about the registration and voting process.
Past elections have demonstrated that many voters misunderstand the election process. For
example, it was learned during the 2004 elections that voters who use the wrong type of writing
instrument on their early ballot may not have all of their votes counted accurately. Other potential
voters did not register to vote in time to participate in the 2004 elections because they did not
understand the registration process. Additional voter education is a critical component to increasing
voter participation.
The Secretary of State's Office and the counties take voter outreach seriously. The Secretary of
State's Office purchased advertising statewide to educate voters about the new equipment, published
material in both English and Spanish, and performed nearly 40 town hall meetings prior to the 2004
General Election even though only three were required by law. The counties also engage in
extensive voter outreach, including substantial programs that target Spanish speaking and Native
American voters.
It is recommended that the Secretary of State’s Office increase funding for voter outreach efforts to
continue to make sure voters know how to properly register to vote, educate the electorate on the
voting process from start to finish, and instruct the voter on how to obtain needed information.
Voter outreach should also aggressively reach out to underserved groups to include them in our
democratic process.
21
VI. STRENGTHEN CURRENT STATE CERTIFICATION POLICIES AND
STANDARDS FOR VOTING EQUIPMENT AND SOFTWARE TO
INCREASE VERIFIABILITY AND TRANSPARENCY IN THE
ELECTION PROCESS.
In addition to Federal Voting System Standards established in 1990 and revised in accordance with
HAVA, Arizona law requires state certification of all voting equipment. Under Arizona law, the
Secretary of State is responsible for certifying voting equipment and for establishing practices to
run elections, tally results, and handle ballots.
In accordance with Arizona law, the Secretary of State appoints a three-member committee to
review election equipment and make recommendations to the Secretary of State regarding approval
for use in state and local elections. Although the law requires the panel to test the various
machines, it does not prescribe the manner in which the machines shall be tested.
The certification of voting equipment in Arizona continues to evolve and Secretary Brewer has
made substantial enhancements to the certification process. This section identifies additional
measures that should be taken to improve the certification process.
1. Require software and firmware source code be held in escrow.
Though it has historically been a condition of certification, in 2003 Secretary Brewer successfully
advocated for legislation requiring all voting equipment presented for Arizona certification to first
receive full testing and certification by a laboratory accredited in accordance with HAVA. All
testing laboratories authorized by the EAC have access to the source code of election system
commercial software developers and that code is thoroughly reviewed prior to certification.
There are those who believe open source code review of election system software and firmware
should be required. Open source generally implies that the code is available for review by anyone,
anywhere and that it is typically published on the Internet for such availability. This level of
exposure would permit competitors to ascertain exact methods and techniques of their competition,
thus rendering superior application development no longer a competitive edge. More importantly, it
would make it possible for anyone who understands the system’s vulnerabilities to subvert the
system, there would seem to be little public good gained from such exposure.
It is therefore recommended that vendors must place all application source codes into either public
domain or software escrow, and authorize the state as the recipient of escrow before a voting system
may be used in a state election. This action would allow qualified state staff to review such source
codes if and when it became necessary while also protecting the vendor’s right to keep that code
private. In addition, the Secretary of State will require in its contracts with vendors that all voting
system software and firmware source code be subject to review by experts at the Secretary of State's
discretion.
22
2. Require all changes to voting systems used in Arizona be certified by the Secretary of State
and a national independent testing authorities for full functional and security testing.
There has been voting equipment certification in Arizona since 1985. In the past, modifications
made by vendors to previously certified election equipment resulting in version number changes
have not received any type of scrutiny. In her ongoing effort to increase the security of Arizona’s
election systems, Secretary Brewer began requiring that all modifications made to voting equipment
undergo certification by the national independent testing authorities and the Secretary of State’s
Office prior to use. Certification of all modifications shall continue to be required.
3. Implement certification best practices learned from other states and the Election
Assistance Committee.
It is recommended that the Secretary of State’s office adopt a best practice certification and de-certification
process based upon the recommendations contained in the Gartner study. This process
should include a review and recommendation by the three-member certification committee. In
addition, it should take into account standards established by the EAC, the unique requirements of
voting equipment set forth in Arizona law, and utilize, when possible, the best practices in such
states as California and Louisiana. These processes will also include provisional approvals,
emergency conditional certification, and system upgrades.
4. Ensure that only certified software, hardware and firmware are used in Arizona elections.
In order to ensure that only certified software, hardware, and firmware are used in Arizona
elections, it is recommended that a written communication be sent to all Arizona election system
vendors informing them of the new certification procedures that include configuration management.
Counties, cities and local jurisdictions should also receive additional training about certification
requirements during the biennial election official certification training conducted by the Secretary
of State. The responsibility of assuring that all voting equipment in use is certified falls upon the
vendor and respective county or local jurisdiction. The affected jurisdiction should take steps to
verify the certification status of its voting hardware, software, and firmware, and any modifications
to such prior to its use.
5. Seek legislation to allow the Secretary of State to grant conditional emergency certification
when warranted.
Secretary Brewer has demonstrated her commitment to the voting equipment certification process
by expanding its application as discussed above. All equipment and software modifications and
upgrades must now be approved through the certification process prior to use. Nevertheless, it is
recognized that unforeseen circumstances, though rare, could arise that would call for the
modification of software within days of an election and without the time needed to undergo the
certification process. Therefore, it is recommended that legislation be adopted to enable new
processes and procedures for emergency certification.
23
VII. IMPLEMENT STANDARDS AND RECOMMENDATIONS FROM THE
ELECTION ASSISTANCE COMMISSION.
The Election Assistance Commission (EAC) was created by HAVA. The EAC was established to
assist in the administration of federal elections and to otherwise provide assistance with the
administration of certain federal election laws and programs, to establish minimum election
administration standards for states and units of local government with responsibility for the
administration of federal elections, and for other purposes. Within the scope of this task are voting
systems, voter registration, administration of payments and grants, and research. The work of the
EAC will continue indefinitely and should be continuously followed by our state and local election
officials in accordance with the following recommendations.
1. Review and evaluate all recommendations and best practices set forth by the Election
Assistance Commission.
As Arizona’s Chief Election Official, Secretary Brewer is a member of the EAC Standards Board
composed of 110 members drawn from State and local election officials. The Standards Board
(acting through its Executive Board) and the Board of Advisors review proposed voluntary
voting system guidelines and EAC technical guidance.
Various tools will be used to accomplish the monumental goal of this Commission. One already
in place is the Post General Survey that requires each state to report such statistics as ballots cast,
early ballots requested, equipment failure and handicap accessibility at the polling places. The
state is responsible for collecting and correlating information for this survey that will provide a
benchmark for future development of guidelines and standards for elections and election
equipment.
It is recommended that the Secretary of State’s office continue to review and evaluate all
recommendations and best practices set forth by the EAC. These recommendations should be
incorporated into the Procedures Manual when appropriate.
24
VIII. MODERNIZE ELECTION EQUIPMENT AND SOFTWARE.
As discussed in Section III, it is recommended that optical scan technology continue to be the
primary technology used to conduct Arizona’s elections and that the accessible voting devices
purchased to comply with the 2006 HAVA mandate produce a voter verifiable paper receipt or
paper ballot that visually indicates all votes cast. As we move forward it is also recommended that
Arizona’s current election equipment and software continue to be studied and monitored to assure
that Arizona’s election systems are operating in the best possible manner.
1. Replace antiquated punch card voting machines with optical scan technology.
In 2003, the Secretary of State distributed over three million dollars to replace punch card voting
equipment still in use in nine counties with new optical scan vote tabulation systems and election
management systems. Additionally, Cochise County qualified for federal reimbursement for their
recently purchased optical scan system.
Beginning with the 2004 Presidential Preference Election, all 15 Arizona counties successfully used
optical scan voting systems. There are now only two election system vendors operating in Arizona.
Twelve of the 15 counties use Diebold voting equipment and three counties use Election System
and Software (ES&S) voting equipment.
The replacement of punch card voting technology with optical scan technology was a major step
taken by Arizona to modernize its voting equipment and software.
2. Provide accessible voting devices for voters with disabilities.
The Secretary of State will distribute millions of dollars to Arizona counties in 2005 to purchase
accessible voting systems in time for use in the 2006 Federal Elections. Arizona will purchase one
accessible voting system for each of the 2000 plus precincts as well as a defined percentage of
spares. The purchase of these voting systems will further contribute to the modernization of
Arizona's voting equipment and software.
3. Continue to monitor the state of the election equipment industry.
The Secretary of State takes an active role in defining future standards of election equipment by
participating on the EAC Standards Board. She will work in this capacity to impose additional
federal standards on equipment vendors to improve security, accessibility, and voter confidence.
Several organizations, committees, and boards exist within the election community. The Secretary
of State maintains close ties with the Election Assistance Commission, National Institute for
Standards in Technology, National Association of Secretaries of State, and the National Association
of State Election Directors. She will continue to be updated on industry developments through her
contacts with these organizations.
25
Because the Secretary of State must certify all election equipment before it can be used, she is in an
excellent position to maintain close contact with the vendors doing business in Arizona. The
Secretary of State will work with election equipment vendors to monitor trends in election
equipment and ensure that vendor equipment meets Arizona’s strict certification requirements.
The Secretary of State continues to urge a cautious approach when it comes to implementing new
technologies to assure that the technology is proven, secure, and reliable.
4. Develop a statewide election equipment refresh policy.
Election equipment is a major capital expense for Arizona’s counties. As with any technical
equipment, election equipment eventually wears down, becomes antiquated, may cause problems,
and requires replacement.
A standard equipment refresh policy ensures that all counties have adequate systems to effectively
run accurate elections. It also provides the criteria necessary for counties to properly plan for the
expense of equipment replacement. Therefore, it is recommended that the Procedures Manual
include a policy that defines a statewide election equipment refresh standard.
26
IX. ENHANCE THE STATEWIDE VOTER REGISTRATION SYSTEM.
A voter registration system is intended to protect the integrity of the electoral process by ensuring
the maintenance of an accurate and current voter registration list. A quality voter registration
system will remove ineligible voters and minimize the problem of individuals registering to vote in
multiple jurisdictions, whether intentional, through fraud or unintentional, through relocation and
failure to cancel a previous registration. Having a properly functioning voter registration system is
necessary to increase confidence in the electoral process.
This section of the Brewer Plan identifies several steps that should be taken to improve the quality
of the voter registration processes and data in Arizona.
1. Enhance the statewide voter registration system with improved processes and technology
to ensure accurate voter registration rolls.
The State of Arizona implemented the Voter Registration Arizona (VRAZ) system on January 1,
2004, as mandated by HAVA. Although the majority of states chose to wait until 2006 to
implement their statewide voter registration system, Arizona insisted on pushing forward. The
program was created to help improve the voting process in Arizona by increasing voter registration
and improving the quality of the voter registration roll.
Arizona is one of the fastest growing states in the nation and is culturally and geographically
diverse. The state has 15 counties that prior to VRAZ were each responsible for maintaining
separate voter registration rolls. There was no effective mechanism in place to ensure that someone
was not registered in multiple counties. The checks to determine if someone had died or was
prohibited to vote due to a felony conviction were not performed centrally and methods to do so
varied among counties.
VRAZ addresses these issues to ensure the accuracy, integrity, and uniqueness of the statewide
voter registration list by reducing the amount of duplicate registrations and cleaning the voter
registration rolls. This is accomplished by comparing voter registration records on a statewide basis
against death, felony, and motor vehicle records. The VRAZ system performs statewide
comparisons in four major areas:
27
• Motor Vehicle Records - All new additions to the voter registration database are matched
against the Arizona Motor Vehicle Division (MVD) database. Any changes to a voter's
identifying information in the voter registration system are compared to the driver license or
non-operating identification license database. The voter registration form requires either a
driver license/non-operating identification license number or the last four digits of social
security number be entered. The voter registrant's name, date of birth, driver license/non-operating
identification license number or last four digits of social security number are
compared against the Motor Vehicle Division database. All driver licenses or non-operating
identification licenses in Arizona require a valid social security number that is verified
against the Social Security Administration database. Each day, the VRAZ system notifies
the counties of the results of the MVD matching.
• Duplicate Matching Across Counties - All new additions to the voter registration database
or any voter that moves from one county to another has their record compared with all
records in other counties to determine if it is a duplicate record or not. Each day, the
statewide voter registration system notifies the counties of the results of the duplicate
matching.
• Court Record Matching - The Secretary of State's office sought legislation in 2003 to
allow all court records to be matched with voter registration records at the state level. Since
the legislation passed, all court records for felony and incapacitated cases from the United
States District Court and the Arizona Superior Court received by the Secretary of State's
Office are compared to the entire voter registration database. The statewide voter
registration system notifies the counties daily of the results of the court record matching.
• Death Record Matching - The Secretary of State's office sought legislation in 2003 to
allow all death records to be matched with voter registration records at the state level. Since
the legislation passed, all death notification records from the Arizona Department of Health
Services are received by the Secretary of State's Office and then compared to the entire voter
registration database. The statewide voter registration system notifies the counties of the
results of the death notification matching.
The State of Arizona is in the process of building an improved statewide voter registration database
by implementing Voter Registration Arizona II (VRAZ-II). The new statewide voter registration
system (VRAZ-II) will more tightly integrated and automate the processes and relieve the counties
of some of the current data entry. Any voter registration record added or updated at the county level
will update the statewide voter registration database in real time. In addition, all counties will have
updated software and hardware to improve the voter registration process.
The Secretary of State is also working with the counties to develop uniform and consistent
procedures for processing voter registrations. A citizen's voter registration experience will be
consistent from county to county because Arizona will have uniform and consistent procedures
including common voter registration software.
28
2. Enhance the ability of citizens to know the status of their provisional ballot.
Prior to HAVA Arizona provided all voters the ability to vote a provisional ballot if their name did
not appear on the signature roster. Like Arizona, HAVA now requires all states to have provisional
ballots and for the citizen who votes a provisional ballot to have a cost free way to find out if their
ballot was counted. Arizona's counties have procedures in place to notify voters about their
provisional ballots, but the methods vary among the counties.
The VRAZ-II system, when fully implemented, will allow citizens to access the status of their
provisional ballot the same way in each county. Arizona will provide a toll free number in addition
to Internet access for voters to find out if their ballot was counted. VRAZ-II along with improved
procedures will ensure that citizens can find out the status of their provisional ballot within 10
working days.
3. Improve the accessibility of all citizens to the voter registration process.
Arizona's voter registration system and procedures should facilitate easy access to the electoral
process by its citizens. There are a number of steps that can be taken to increase this accessibility.
• Increase Voter Outreach - Voter outreach efforts by the Secretary of State's Office and the
County Recorders help promote voter registration, encourage underserved groups to register
to vote, and educate all voters on the election process. These efforts should be increased
whenever possible.
• Automate Voter Registration with Driver License Application - National Voter
Registration Act of 1993 (NVRA) requires that individuals be given the opportunity to
register to vote (or to change their voter registration address) in elections for federal office
when applying for or receiving services or assistance at any office in the state that provides
public assistance, including the Motor Vehicle Division. The purpose of the NVRA is to
increase the number of eligible citizens who register to vote. Currently, driver license
applicants are asked to check a box indicating if they would like to vote. The MVD
employee is then supposed to provide the applicant a registration form to fill out. This
system has not worked perfectly in the past and has resulted in confusion when registrants
have not received a form, not returned their filled out form, or mistakenly assumed that they
became registered by simply checking the box.
The Secretary of State has been working with MVD to fully integrate the Arizona driver
license application and the voter registration form so that the same form can accomplish
both purposes. The information obtained at the MVD office would then be electronically
transferred to the Secretary of State’s Office through the EZ Voter program discussed
below. This will eliminate many manual steps and help reduce voter confusion. The offices
should continue to work together to have this completed by January 1, 2006.
• Expand Online Voter Registration - The EZ Voter program enables citizens of Arizona to
easily register to vote online in either English or Spanish. The citizen simply enters in their
unique information to authenticate and provides other voter registration information. The
29
information provided by the citizen is matched instantly with a motor vehicle record. The
demographic information from the MVD record along with the digitized signature from the
driver license or non-operating identification license are passed in real time to the Secretary
of State's Office and become an official voter registration. The EZ Voter Internet
application can be accessed either through the Arizona Secretary of State's or Arizona Motor
Vehicle Division's Web sites.
EZ Voter can be viewed as a natural extension of NVRA. Approximately 30% of the voter
registrations processed during the 2004 election cycle were through the EZ Voter program.
The EZ Voter program should be promoted as the best way to register to vote with a goal of
increasing the total number of registrations through EZ Voter to 50% during the 2006
election cycle.
4. Ensure that the statewide voter registration database is accessible to county voter
registration officials.
Arizona citizens are mobile. It is important that county voter registration officials have current and
quality information available when determining a citizen's voter registration status. The VRAZ-II
statewide voter registration database will have secured access to authorized election officials to
view voter registration information statewide.
5. Seek legislation to improve the quality of voter registration drives.
Some voter registration drives compensate individuals based upon how many voter registration
forms they obtain. This compensation may be based on the party affiliation of the person
registered. Such a compensation scheme is contrary to voluntary spirit of our democratic process.
Moreover, it encourages these drives to solicit registration forms from individuals who are not
qualified to vote or who have already registered. The county recorder offices were inundated in
2004 with thousands of invalid voter registration forms that consumed precious resources at a
critical time in the election cycle.
If compensation paid to the solicitor is based on the party affiliation of the person registered, it
provides a disincentive to the solicitor to seek registration forms from all citizens. The Secretary of
State’s Office has received inquiries from many citizens who attest that they turned in a registration
form to a private get-out-the-vote drive but were never registered to vote. It is difficult to determine
exactly why this occurred or who may have been responsible but the possible link to compensation
for registering voters of a certain party affiliation cannot be overlooked.
To address these issues the Secretary of State will seek legislation to prohibit compensation of voter
registration solicitors based on the number of forms received and the party affiliation of the person
registered.
30
APPENDIX
GARTNER ASSESSMENT OF ELECTION SYSTEMS REPORT
A Report for the
State of Arizona
Assessment of
Election Systems
December 2004
Engagement: 220608071
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page i
Table of Contents
1.0 EXECUTIVE SUMMARY..........................................................................................................................4
1.1 BACKGROUND -------------------------------------------------------------------------------------------------------------4
1.2 RECENT ACTIONS BY SECRETARY OF STATE REGARDING VOTING IN ARIZONA-----------------------------------4
1.3 REPORT SCOPE-------------------------------------------------------------------------------------------------------------5
1.4 REPORT OBJECTIVES------------------------------------------------------------------------------------------------------5
1.5 REPORT METHODOLOGY -------------------------------------------------------------------------------------------------5
1.6 REPORT SUMMARY--------------------------------------------------------------------------------------------------------6
2.0 QUESTIONS REGARDING THE VOTING INDUSTRY........................................................................7
2.1 QUESTIONS REGARDING DIRECT RECORD ELECTRONIC (DRE) VOTING EQUIPMENT ----------------------------7
2.1.1 Can Direct Record Electronic (DRE) Systems Fail and Lose Votes Cast? -------------------------------------7
2.1.2 Is VVPAT Required to Ensure that The Vote Cast Is The Vote Recorded?--------------------------------------9
2.1.3 Are Election System Firms Overcharging to Retrofit for VVPAT?--------------------------------------------- 12
2.2 QUESTIONS REGARDING CERTIFICATION----------------------------------------------------------------------------- 14
2.2.1 Does the Federal Certification Process Adequately Examine System Security? ----------------------------- 14
2.2.2 Do States Need to Conduct Testing Beyond Current Federal Certification Requirements? ---------------- 16
2.3 IS THE ENFRANCHISEMENT OF THE DISABLED BEING DELAYED? ------------------------------------------------- 17
2.3.1 Description ------------------------------------------------------------------------------------------------------------ 17
2.3.2 Analysis ---------------------------------------------------------------------------------------------------------------- 17
2.3.3 Recommendations ---------------------------------------------------------------------------------------------------- 17
2.4 SHOULD ALL SOURCE CODE USED IN ELECTIONS BE “OPEN”? --------------------------------------------------- 18
2.4.1 Description ------------------------------------------------------------------------------------------------------------ 18
2.4.2 Analysis ---------------------------------------------------------------------------------------------------------------- 18
2.4.3 Recommendations ---------------------------------------------------------------------------------------------------- 19
3.0 QUESTIONS REGARDING CURRENT DIEBOLD ELECTION SYSTEMS ....................................20
3.1 DO CURRENT DIEBOLD DRE ELECTION PRODUCTS HAVE SECURITY FLAWS?---------------------------------- 20
3.1.1 Description ------------------------------------------------------------------------------------------------------------ 20
3.1.2 Analysis ---------------------------------------------------------------------------------------------------------------- 20
3.1.3 Recommendations ---------------------------------------------------------------------------------------------------- 25
3.2 ARE DIEBOLD PRODUCTS VULNERABLE TO INTERNET ATTACKS? ------------------------------------------------ 26
3.2.1 Description ------------------------------------------------------------------------------------------------------------ 26
3.2.2 Analysis ---------------------------------------------------------------------------------------------------------------- 26
3.2.3 Recommendations ---------------------------------------------------------------------------------------------------- 27
3.3 DOES DIEBOLD HAVE A QUALITY SOFTWARE DEVELOPMENT METHODOLOGY?------------------------------- 27
3.3.1 Description ------------------------------------------------------------------------------------------------------------ 27
3.3.2 Analysis ---------------------------------------------------------------------------------------------------------------- 27
3.3.3 Recommendations ---------------------------------------------------------------------------------------------------- 28
3.4 DO DIEBOLD PRODUCTS HAVE ADEQUATE CONFIGURATION MANAGEMENT? ---------------------------------- 28
3.4.1 Description ------------------------------------------------------------------------------------------------------------ 28
3.4.2 Analysis ---------------------------------------------------------------------------------------------------------------- 28
3.4.3 Recommendations ---------------------------------------------------------------------------------------------------- 28
3.5 DO DIEBOLD PRODUCTS HAVE ADEQUATE PASSWORD MANAGEMENT? ---------------------------------------- 29
3.5.1 Description ------------------------------------------------------------------------------------------------------------ 29
3.5.2 Analysis ---------------------------------------------------------------------------------------------------------------- 29
3.5.3 Recommendations ---------------------------------------------------------------------------------------------------- 30
3.6 DO DIEBOLD PRODUCTS HAVE ADEQUATE ACCESS MANAGEMENT? -------------------------------------------- 30
3.6.1 Description ------------------------------------------------------------------------------------------------------------ 30
3.6.2 Analysis ---------------------------------------------------------------------------------------------------------------- 31
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page ii
3.6.3 Recommendations ---------------------------------------------------------------------------------------------------- 31
3.7 DO DIEBOLD PRODUCTS HAVE ADEQUATE AUTHENTICATION OF ELECTION REPORTING? -------------------- 31
3.7.1 Description ------------------------------------------------------------------------------------------------------------ 31
3.7.2 Analysis ---------------------------------------------------------------------------------------------------------------- 32
3.7.3 Recommendations ---------------------------------------------------------------------------------------------------- 32
3.8 CAN SMART CARD FRAUD OCCUR WITH DIEBOLD PRODUCTS? -------------------------------------------------- 33
3.8.1 Description ------------------------------------------------------------------------------------------------------------ 33
3.8.2 Analysis ---------------------------------------------------------------------------------------------------------------- 33
3.8.3 Recommendations ---------------------------------------------------------------------------------------------------- 34
3.9 DOES DIEBOLD HAVE ADEQUATE INTERNAL SECURITY? ---------------------------------------------------------- 34
3.9.1 Description ------------------------------------------------------------------------------------------------------------ 34
3.9.2 Analysis ---------------------------------------------------------------------------------------------------------------- 34
3.9.3 Recommendations ---------------------------------------------------------------------------------------------------- 34
3.10 DID DIEBOLD DISREGARD STATE-CERTIFIED CONFIGURATIONS? ------------------------------------------------ 34
3.10.1 Description ------------------------------------------------------------------------------------------------------------ 34
3.10.2 Analysis ---------------------------------------------------------------------------------------------------------------- 35
3.10.3 Recommendations ---------------------------------------------------------------------------------------------------- 35
3.11 IS DIEBOLD AN OBJECTIVE ELECTION PARTNER?------------------------------------------------------------------- 36
3.11.1 Description ------------------------------------------------------------------------------------------------------------ 36
3.11.2 Analysis ---------------------------------------------------------------------------------------------------------------- 36
3.11.3 Recommendations ---------------------------------------------------------------------------------------------------- 36
3.12 RECENT DIEBOLD ACTIONS IN RESPONSE TO CRITICS -------------------------------------------------------------- 37
3.12.1 Some Perspective ----------------------------------------------------------------------------------------------------- 37
3.12.2 In Defense of Diebold Election Systems --------------------------------------------------------------------------- 37
3.12.3 Response to Ohio Compuware Study------------------------------------------------------------------------------- 37
3.12.4 Response to the RABA Study ---------------------------------------------------------------------------------------- 38
3.12.5 Diebold Announces Restructuring of Compliance and Certification Processes------------------------------ 39
3.12.6 Future of Diebold As Election Vendor----------------------------------------------------------------------------- 40
4.0 QUESTIONS REGARDING VOTING IN ARIZONA............................................................................41
4.1 HAS ARIZONA ACQUIRED DIEBOLD VOTING SYSTEMS THAT ARE HAVA COMPLIANT? ---------------------- 41
4.1.1 Description ------------------------------------------------------------------------------------------------------------ 41
4.1.2 Analysis ---------------------------------------------------------------------------------------------------------------- 44
4.1.3 Recommendations ---------------------------------------------------------------------------------------------------- 45
4.2 DOES ARIZONA HAVE AN ADEQUATE VOTING CERTIFICATION PROCESS? -------------------------------------- 45
4.2.1 Description ------------------------------------------------------------------------------------------------------------ 45
4.2.2 Analysis ---------------------------------------------------------------------------------------------------------------- 48
4.2.3 Recommendations ---------------------------------------------------------------------------------------------------- 51
4.3 DOES ARIZONA HAVE SUFFICIENT PROCEDURES TO ENSURE THAT CONFIGURATION CERTIFIED IS
CONFIGURATION USED? -------------------------------------------------------------------------------------------------------- 51
4.3.1 Description ------------------------------------------------------------------------------------------------------------ 51
4.3.2 Analysis ---------------------------------------------------------------------------------------------------------------- 51
4.3.3 Recommendations ---------------------------------------------------------------------------------------------------- 52
4.4 DOES ARIZONA HAVE ADEQUATE VOTING PHYSICAL SECURITY?------------------------------------------------ 53
4.4.1 Does Arizona Have Adequate Physical Security in Storage of Equipment and Ballots?-------------------- 53
4.4.2 Does Arizona Have Adequate Physical Security in Transport of Equipment and Ballots? ----------------- 54
4.4.3 Does Arizona Have Adequate Physical Security at Polling Places?------------------------------------------- 54
4.5 DOES ARIZONA HAVE ADEQUATE POLL WORKER TRAINING? ---------------------------------------------------- 54
4.5.1 Description ------------------------------------------------------------------------------------------------------------ 54
4.5.2 Analysis ---------------------------------------------------------------------------------------------------------------- 55
4.5.3 Recommendations ---------------------------------------------------------------------------------------------------- 55
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page iii
5.0 REVIEW OF SELECTED ARIZONA COUNTY ELECTION SYSTEMS AND PROCESSES ........56
5.1 DESCRIPTION ------------------------------------------------------------------------------------------------------------ 56
5.1.1 Apache County -------------------------------------------------------------------------------------------------------- 58
5.1.2 Pima County----------------------------------------------------------------------------------------------------------- 61
5.1.3 Yavapai County ------------------------------------------------------------------------------------------------------- 65
5.1.4 Maricopa County ----------------------------------------------------------------------------------------------------- 68
5.1.5 Cochise County ------------------------------------------------------------------------------------------------------- 71
5.1.6 Graham County ------------------------------------------------------------------------------------------------------- 73
5.2 ANALYSIS AND RECOMMENDATIONS --------------------------------------------------------------------------------- 75
5.2.1 SOS Public Outreach------------------------------------------------------------------------------------------------- 75
5.2.2 SOS County Training, Certification and Qualifications --------------------------------------------------------- 76
5.2.3 Variations of Election Organizations in Counties---------------------------------------------------------------- 76
5.2.4 Arizona/Wyoming Ballot Rotation---------------------------------------------------------------------------------- 77
5.2.5 Ballot Creation Single Points of Failure -------------------------------------------------------------------------- 77
5.2.6 Languages ------------------------------------------------------------------------------------------------------------- 77
5.2.7 “Bug” in Certified Version------------------------------------------------------------------------------------------ 78
5.2.8 Early Voting ----------------------------------------------------------------------------------------------------------- 78
5.2.9 Election Processing Single Point of Failure ---------------------------------------------------------------------- 78
5.2.10 Flaw in L&A Testing Method --------------------------------------------------------------------------------------- 78
5.2.11 Voter Verifiable Paper Audit Trail (VVPAT) --------------------------------------------------------------------- 79
5.2.12 Short Ballot Window ------------------------------------------------------------------------------------------------- 79
5.2.13 Battery on Card------------------------------------------------------------------------------------------------------- 79
5.2.14 Retention of Memory Card Data------------------------------------------------------------------------------------ 80
5.2.15 Solution for Disability------------------------------------------------------------------------------------------------ 80
5.2.16 Post Election L&A Testing ------------------------------------------------------------------------------------------ 80
5.2.17 Two-Year Retention Requirement ---------------------------------------------------------------------------------- 80
5.2.18 Legal Advice Source-------------------------------------------------------------------------------------------------- 81
5.2.19 SLAs Are Lacking in Vendor Contracts---------------------------------------------------------------------------- 81
5.2.20 Continuity Planning and Disaster Recovery ---------------------------------------------------------------------- 81
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 4
1.0 Executive Summary
1.1 Background
Since the Presidential election of 2000, there has been some concern among the people, the
states and the federal government regarding the accuracy and reliability of voting systems. In
2002, Congress passed, and the President signed into law, the Help America Vote Act (HAVA),
which was intended to address many of the issues surrounding voting and voter registration. In
addition, many activists have raised a number of questions in the press regarding voting
equipment, most notably with regard to Direct Recording Equipment (DRE), a computer-like
technology that displays the ballot and records results on electronic media. Further, much of this
discussion has involved the voting systems vendor, Diebold, Inc. (Diebold), in large part because it
is the market share leader in the voting equipment industry. Questions have also been raised
about voting equipment security, causing some voters to doubt the trustworthiness of systems that
do not provide a hardcopy paper trail of the vote cast. This study was commissioned by the
Arizona Secretary of State, Jan Brewer, to address these concerns.
1.2 Recent Actions by Secretary of State Regarding Voting in Arizona
The State of Arizona is in an exceptionally good position at this time for the following reasons:
1) In 2003, the Secretary of State encouraged the revision of the Arizona law to require (for the
first time ever in Arizona) that all voting equipment to be used in Arizona State and local
elections must receive full testing and certification by a federally accredited laboratory pursuant
to HAVA.
2) In 2003, through the Office of the Secretary of State (SOS), Arizona selected optical scan
voting technology over the then very popular DRE technology and thus avoided most of the
issues that were subsequently raised about DRE voting technology. This was a very prudent
decision in light of subsequent events.
3) In December 2003, the Secretary of State announced an Action Plan to address statewide
voting systems and technology issues. The plan called for new voting system guidelines and
increased sharing of information among election offices and annual reviews to enhance
election certification policies and standards.
4) At the end of 2003, the office of the Secretary of State successfully completed the
implementation of a single statewide voter registration system for Arizona (VRAZ), meeting the
legislative requirements of HAVA. The system enables accurate and consistent management of
voter registration information across all the voting jurisdictions in the state. Arizona was one of
only a few states that did not ask for a waiver for the HAVA Statewide Voter Registration List
requirement.
In January 2004, The Secretary of State retained Gartner to develop this report as a means by
which the SOS can directly take action toward ensuring accuracy and reliability in elections in
Arizona.
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 5
1.3 Report Scope
There are two fundamental aspects to election systems:
1) Voter Registration Systems — Systems that collect, record, verify and track voter registration
and voting history.
2) Voting Systems — Systems that develop ballots, capture votes cast, tally votes and report
them.
This report focuses on voting systems and does not discuss issues regarding voter registration.
1.4 Report Objectives
This report is not an audit. It does not seek to find errors or omissions in the past, but rather is
focused on determining best practices “going forward” that will ensure that Arizona elections are
fair and accurate and preserve the foundations of democracy.
The objectives of this report are to:
1) Review and Analyze Questions Regarding the Election Industry — Review questions voiced in
news media and in election industry literature regarding the reliability, security and sufficiency
of election products and procedures.
2) Review and Analyze Questions Regarding Current Diebold Election Products — Specifically,
review questions related to current Diebold election products.
3) Review and Analyze Questions Regarding Arizona Election Systems and Procedures —
Specifically review questions related to voting system certification, and the security and
accuracy of Arizona election systems and procedures.
4) Make Recommendations — Make recommendations regarding the actions that the State of
Arizona should take regarding these issues.
1.5 Report Methodology
Gartner developed this report based upon the following data gathering efforts:
1) We reviewed Gartner research on election practices and technologies.
2) We reviewed recent reports and articles regarding election technology and security.
3) We interviewed members of the staff of the Arizona SOS.
4) We visited and interviewed election officials and staff of six Arizona counties. These counties
were Maricopa, Yavapai, Cochise, Graham, Apache, and Pima.
5) We reviewed progress in other states and focused attention on the certification processes of
California and Louisiana as representing best practices in certification.
6) We received input from Diebold on the various points concerning their election equipment and
systems.
This report was developed section by section with weekly reviews and suggested revisions by SOS
staff. This was followed by a comprehensive final review and a public review of the report.
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 6
1.6 Report Summary
In keeping with the mission of this report, the main sections of the report focus on the following four
(4) question sets:
1) Questions Regarding the Voting Industry — This section addresses questions that have been
raised in the press regarding voting technologies, need for voter verifiable printouts, the
certification process, needs of disabled voters and whether the source code of voting systems
should be “open.”
2) Questions Regarding Current Diebold Election Systems — This section addresses questions
that have been in the press regarding Diebold election systems.
a) This section was concentrated on Diebold for three reasons:
i) Arizona has acquired Diebold optical scan voting equipment for deployment in twelve
(12) counties to replace their punch card systems.
ii) Diebold is the market share leader among voting system vendors.
iii) In part because of Diebold’s market position, much of the controversy has been focused
on Diebold in the press even though many of the criticisms of them would apply equally
well to most other election system vendors.
b) Questions in this area review security concerns with Diebold voting equipment, Diebold’s
involvement with state certification compliance, questions about Diebold’s objectivity and
Diebold’s responses to these criticisms.
3) Questions Regarding Voting in Arizona — This section addresses questions such as whether
Arizona has acquired Diebold voting equipment that is HAVA compliant; whether Arizona has
an adequate voting certification process; whether Arizona has adequate voting physical
security; and whether Arizona has adequate poll worker training.
4) Review of Selected Arizona County Election Systems and Processes — This section
addresses questions that arose in onsite interviews with the six (6) Arizona counties that were
not involved in replacement of their punch card systems with Diebold optical scan equipment in
2003. These six counties were already utilizing optical scan technology for their voting
systems.
Though Diebold has been in the news as the center of much of the concern regarding new voting
technology and Arizona has purchased voting technology from Diebold, a very fundamental
distinction should be made. The controversy is around DRE technology, while Arizona purchased
optical scan technology as its mainstay voting technology. This was a very prudent decision on the
part of Arizona as many states were acquiring the more attractive DRE technology at that time.
Arizona wisely determined that the less high-tech, paper-based optical scan technology was the
safer, more reliable and more voter-verifiable technology. This has proven to be true. The Arizona
decision-makers in this instance should be recognized for making a wise decision on the selection
of voting technology. This decision has enabled Arizona to largely avoid many of the voting
systems issues that have been in the news and that are discussed in this report regarding
(Diebold) DRE technology.
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 7
2.0 Questions Regarding the Voting Industry
2.1 Questions Regarding Direct Record Electronic (DRE) Voting
Equipment
2.1.1 Can Direct Record Electronic (DRE) Systems Fail and Lose Votes Cast?
2.1.1.1 Description
There is a question as to whether Direct Record Electronic (DRE) systems are vulnerable to failure,
as are other computer equipment, due to causes such as hardware memory failures, disc
“crashes,” software corruption and electrical component flaws. These failures could be caused
intentionally or unintentionally, resulting in the loss of recorded votes with no “artifact” such as a
paper ballot remaining that would enable an accurate recount of votes.
2.1.1.2 Analysis
All electronic equipment is prone to failure due to a wide variety of causes, and DRE voting
systems are electronic equipment. There are five key causes of DRE system failure:
2.1.1.2.1 Power Failures
The equipment can be damaged or rendered unusable due to absence of electrical power, or
power surges or sags that result in data corruption and inaccurate vote recording or tallying.
Simple punch card systems are not electronic and therefore are immune to power conditions1.
Electro-mechanical lever machine voting systems depend on power, but are not electronic and
therefore are not as sensitive to power failures or fluctuations. Systems that use electronic
components2 are sensitive to power fluctuations and can easily be damaged or corrupted by such
fluctuations. The long accepted solution to this is to insert batteries, uninterrupted power supplies
and power generators between these components and the utility company power supply. This
insertion is not always done and batteries fail. Because DREs are more electronic than any other
voting technology (other than Internet voting), they are at greater risk of failure due to power
issues. By comparison, punch-card systems are entirely mechanical and have no power failure
issues for voting. Similarly, optical scan systems also enable voting without the need for electrical
power (i.e., paper optical scan ballots are filled out manually by the voter). There are industry-accepted
practices to mitigate the failure of electronic equipment due to power failures.
2.1.1.2.2 Hardware Failures
The equipment can have defects in design and manufacture that cause the hardware to fail under
use or misuse. DREs are more electronic and as such have more complex and sensitive
1 This also applies to the use of marking pens and optical character recognition (OCR) paper ballots currently used
in Arizona. Optical scan counting equipment is electronic, but the voting process can continue without this
equipment if necessary.
2 Microprocessors, diodes, transistors and related components.
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 8
components than other types of voting technology. Electronic components are susceptible to
environment conditions, such as excessive heat or cold, humidity, impact shock, etc. This makes
DREs more vulnerable than other voting technologies to hardware failures. All these vulnerabilities
can be mitigated with good technical design and equipment maintenance support practices.
2.1.1.2.3 Software Failures
The software may have defects, inadequacies or even intentional inaccuracies. Software is
complex logic that requires rigorous discipline in its creation. Consequently, it is relatively easy for
it to have errors or to encounter unanticipated operation. In addition, software is plastic; it can be
easily altered by knowledgeable persons with access to it. Alterations are only limited by
processor power and programmer imagination. Alterations could include clever disruption or
deception regarding vote recording and vote tallying. This is more true of DREs than of other
(except Internet voting) technologies for voting. There exists a large body of knowledge and best
practices to prevent or address software failures. Implemented rigorously, these practices reduce
the risk of software failure substantially.
2.1.1.2.4 Data Communications Failures
The equipment may have data communications failures, resulting in the inability to report results in
a timely fashion. DRE (and optical scan equipment) can report vote tallies very rapidly via common
dial-up connections. It is possible that without strict security protocols, these connections could be
unreliable.
2.1.1.2.5 Training Failures
As with any technology-based business solution, equipment could fail due to incorrect
configuration and installation due to inadequate staff training. Because DREs are more complex
and more electronic, they have been perceived as more difficult to maintain, configure and install.
The view is that the largely senior voting volunteers may have greater difficulty with these
machines than with more traditional voting equipment. Anecdotal evidence gathered by Gartner,
coupled with secondary research, does not support this. In fact, the County of Los Angeles (among
others) works with the AARP to recruit poll workers from the senior population. The introduction of
any new method will have a learning curve that is not always initially grasped by everyone.
2.1.1.3 Benefits of DRE
In addition to the many types of failures to which DRE systems are vulnerable, they also provide
many advantages that other technologies do not offer or do not offer as well. DREs:
1) Have greater capacity and flexibility for ballot creation and revision
2) Eliminate much of the paper costs of ballot production, distribution, storage and destruction
3) Enable voters with visual impairments to vote a secret ballot
4) Reduce or eliminate the problems of over and under voting
5) Enable faster vote recording and vote tallying
The essential question is whether the overall benefits gained from using DREs outweigh the
probability of failure and the negative consequences of such failure. DRE voting systems can only
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 9
be used appropriately to the extent that the probability of equipment failure can be significantly
diminished, and the negative consequences of such failure quickly mitigated, all the while meeting
high accuracy expectations.
2.1.1.4 Recommendations
Over 99 percent of Arizona voters currently use optical scan technology, not DRE technology to
vote. Thus, this issue is of much less importance to Arizona than it is to many other states that rely
entirely, or almost entirely, on DRE voting equipment. Arizona does have some DRE equipment
currently deployed, and may need to acquire additional DRE equipment to meet accessibility
requirements of visually impaired voters. For that very limited pool of devices, we would make the
following recommendations:
1) Power Failures — The State should provide uninterruptible power supply (UPS) systems with
each DRE device to ensure their continued operation (or safe shutdown) in case of a power
failure.
2) Hardware Failures — The State should ensure appropriate environmental conditions and
treatment for DRE equipment in accordance with their electronic nature.
3) Software Failures — The State should:
a) Apply a stringent certification process to each vendor’s DRE software.
b) Require authentication that software that has been rigorously reviewed has not been
subsequently altered.
c) Pressure DRE vendors to comply with industry best practices regarding software
development, testing, distribution and version control.
4) Data Communications Failures — The State should use a number of transmission security
techniques such as encryption, restricted dial modems, voice confirmation of transmission and
other practices to minimize possible communications failures.
5) Training Failures — The State should ensure adequate training on the use of new DRE
equipment both for poll workers and for voters.
2.1.2 Is VVPAT Required to Ensure that The Vote Cast Is The Vote Recorded?
2.1.2.1 Description
There is a question whether the vote cast with a DRE system may not be the vote that is recorded.
At present, nearly all voting in Arizona is done using optical scan technology, not DRE technology1.
Voter Verifiable Paper Audit Trail (VVPAT) is not an issue for optical scan technology, since the
paper optical scan ballot sheet is considered a reliable VVPAT. VVPAT is only relevant to Arizona
to the degree that it may be necessary to acquire DRE equipment to address the 2006 HAVA
requirement to enable voters with visual impairment to vote a secret ballot.
1 Yavapai County currently has ten (10) DRE machines that are used only for early voting. The early voter has a
choice in Yavapai whether to use the DRE or cast their vote using the traditional optical scan ballot.
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 10
With an electronic process of vote recording, there is no visible means by which the voter can
verify that the vote cast was, in fact, recorded and counted as cast.
One proposed solution to this problem for DRE systems is the simultaneous production of a
VVPAT, which is a print-out of the vote cast, viewable (and therefore verifiable) by the voter, but
stored for counting and later made available as an artifact of the vote should a recount be required.
In such a circumstance, the VVPAT becomes the new “source of truth” document for the recount.
2.1.2.2 Analysis
2.1.2.2.1 What is Accuracy?
The question seeks assurance that every vote cast is counted as cast. Perhaps contrary to
popular belief, there has probably never been a major election in which this has been 100 percent
true in the past. There have always been votes cast that were never counted due to a variety of
reasons. For example, as recently as June 2004, an election audit in Sioux Falls, South Dakota
determined that paper ballots could be lost, stolen, damaged, altered and misread. Thus the
concern is not so much that electronic systems are less accurate or reliable than paper ballots or
punched cards, but simply that there is a goal that vote casting and vote counting be as accurate
as possible. Further, the goal is that voters have confidence that “by and large” votes cast are
votes counted and more importantly, there is no mechanism by which votes can be surreptitiously
altered before counting.
2.1.2.2.2 Two Sources Means Two Counts
There is a maxim in the IT industry that if there are two sources for data, there will inevitably be two
disparate results. Human systems are not perfect. If DRE equipment collects and counts votes and
a VVPAT prints these votes which are then collected manually, it is highly likely that a recount will
reveal a result that is not 100 percent identical to the result tallied electronically. Given this reality,
it is not clear that the addition of a second source (a VVPAT) will improve voter confidence in
election results. Clearly, as with any artifact (i.e., punch cards) the rules regarding a recount of
artifacts must be established before the election and must be agreed upon and applied uniformly in
the process of recount. Even so, a VVPAT does not hold the same promise of accuracy that is
generally attributed to it.
2.1.2.2.3 Paper Costs
One of the reasons many election directors found electronic voting devices (DREs) attractive was
that they eliminated many of the sizeable costs associated with using paper, e.g., printing,
transportation, storage, etc. A VVPAT requirement puts them back in the paper business, though
not to the same level of costs that exist with paper, punch card or optical scan ballots.
2.1.2.2.4 Who Can Verify the Systems?
There are really three questions embedded in this issue.
1. Is It Sufficient If Current Systems Have the Confidence of Informed Persons? Are current
electronic systems designed and built in such a manner that informed people would agree that
they render the vote cast as the vote recorded with a very high probability?
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 11
This is clearly not the case. Most current voting systems do not have the internal logic
safeguards now considered by IT security specialists as sufficient to ensure their reliability and
safety from intended or unintended disruptions.
2. Is It Sufficient if New Systems Could Have the Confidence of Informed Persons? If current
electronic systems are not so designed, can electronic systems be designed in such a manner
that informed people would agree that they render the vote cast as the vote recorded with a
very high probability?
There are a number of security techniques that are routinely applied to modern information
systems. If applied to election equipment, these techniques can ensure that the vote cast is the
vote recorded (with a very high probability). Such techniques include various symmetric and
asymmetric encryption technologies; the use of digital signatures in a public key infrastructure
(PKI); the use of highly structured application development; deployment and maintenance
techniques such as those promulgated by the Capability Maturity Model (CMM) and the
Institute of Electrical and Electronic Engineers (IEEE). Though electronic voting systems are
likely to remain isolated from the Internet, they need to adopt and adapt many of the security
techniques currently employed to manage safely billions of financial and other transactions that
currently transfer across the Internet1. It would appear that this is feasible and even likely to
occur in a decade or two from now. It could not be made universal in time for the 2004
Presidential election.
3. Is It Sufficient Only If Systems Have the Confidence of the Average Person? Even if current
systems were designed or new systems could be designed in such a manner that informed
people would agree that they render the vote cast as the vote recorded with a very high
probability, would that be sufficient? Is it necessary that the average person who is not
informed needs to be convinced from evidence they can see and understand, that the vote cast
is the vote recorded?
When framed in this light, it is clear that the question is not one of technology, but of trust. Can
all of the average persons trust the informed persons? If they can, they must also trust the
mechanisms that determine who the informed persons are. What is at stake, however, is the
ballot, the mechanism by which the democratic process is maintained and by which all public
servants are held accountable.
All of Arizona's 15 counties use optical scan systems as their primary voting technology.
Yavapai County has 10 DREs for early voting. To meet HAVA requirements for 2006, the state
will require that at least a single accessibility device at each voting location will be provided for
the sight- and mobility-impaired to enable these voters to vote a secret ballot. Such units could
also perform “double duty” if they have a VVPAT attached to them. Voters who would like to
use a DRE could do so without concern about its veracity since it would have the VVPAT
feature.
2.1.2.2.5 How Much Confidence Is Enough?
If a VVPAT is required at this time, what level of this verification is necessary to garner the
confidence of the average person?
1 Existing examples include ATMs and electronic gaming (gambling) machines.
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 12
The RABA Study concluded that some degree of VVPAT is required at this time to ensure voter
confidence. The RABA Study further suggested that perhaps 100 percent VVPAT is not
required to establish voter confidence:
Indeed, if all AccuVote-TS terminals are checked to ensure they are functioning
correctly before an election, and if they are loaded with identical, digitally-signed,
software which is checked both before and after an election, one can make the case
that reconciling the results of a single, randomly selected, terminal with its paper
receipts is sufficient to believe that the overall electronic counts in that precinct are
accurate. Thus, if all the terminals are software and hardware enabled for receipts,
one need only provide receipts for a small number of randomly chosen machines.
Voters might even be given the choice of using such a terminal — or not.
Even if RABA is correct, it appears that their observations are being overtaken by events. The
states of California, Nevada and Ohio are requiring that all DRE systems produce a VVPAT. In
addition, there is Federal legislation being crafted that would require a VVPAT nationally.
Despite movement toward VVPAT, it should be recognized that there is no guarantee that what is
printed on the VVPAT is in fact what is recorded in the electronic memory of the DRE. Thus, the
VVPAT is technologically no guarantee of veracity. That guarantee of veracity must come from the
monitored methods and procedures of software development, testing, management, distribution
and acceptance. The source of truth documents for Arizona should be the OCR and mail-in ballots
used for voting (by 99 percent of Arizona voters) and the paper tape required by HAVA that is
stored inside each DRE machine. Accordingly, Arizona should not acquire VVPAT unless required
by law. It should require that all future DREs purchased come equipped with the capability to add
a VVPAT if required.
2.1.2.3 Recommendations
There is no need for a VVPAT with the optical scan systems used by over 99 percent of Arizona
voters, since the paper ballot serves the same purpose and can be hand counted if necessary.
VVPAT usefulness is still being debated. Arizona should not adopt VVPAT for its limited population
of DREs unless required by federal mandate.
2.1.3 Are Election System Firms Overcharging to Retrofit for VVPAT?
2.1.3.1 Description
There is a question whether electronic voting equipment vendors are overcharging their clients in
order for them to meet state requirements for a VVPAT, especially when this involves retrofitting
previously purchased systems.
The State of California requires that, effective July 1, 2005, counties will not be able to purchase
any voting systems that do not produce a paper trail. The State also requires that as of July 2006,
all machines, no matter when they were purchased, must offer a Voter-Verifiable Paper Audit Trail
(VVPAT). This means that machines currently in use by four California counties will have to be
fitted with new printers to meet this requirement.
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 13
2.1.3.2 Analysis
2.1.3.2.1 Cost of Retrofit
It will cost additional money to retrofit currently deployed DRE voting systems with the capacity to
produce a VVPAT. This is especially true for the DREs that were not originally designed to
accommodate printing.
Cost estimates for requiring VVPAT for systems that have been deployed vary. Alfie Charles, a
vice president at Sequoia Voting Systems, estimated that VVPAT printers would add about
15 percent to the cost of voting machines. For California, therefore, this retrofit could be about $60
million of the $400 million California counties are expected to spend to comply with court orders
and new federal requirements1.
Administrator Linda H. Lamone of the State of Maryland Board of Elections told The Gazette that
Diebold had given a preliminary estimate of $1,000 to $1,200 per machine to add printers, or up to
$20 million for the State's more than 16,000 machines. According to the article, “[Lamone] said that
she could not recall whether she got the figure from Diebold or media reports”2.
Palm Beach County, Florida is using Sequoia’s DRE voting systems and will be requiring paper
printouts of votes cast. Since it would cost money to retrofit Palm Beach County's existing
machines to work with the new printers, Charles said, a printer would cost about $600 with
installation — $3.24 million for the County's 5,400 machines. Each touch-screen machine costs
about $3,100.
California has invested more than $139 million on electronic touch-screen technology. Secretary of
State Kevin Shelley estimated the cost of adding capabilities to print a paper receipt from existing
voting machines at $1 million for California counties, except for the four counties which Shelly has
barred from using their existing DRE equipment.
2.1.3.2.2 Impact on Arizona
Should this become a requirement, it will not have the impact on Arizona that it will have on many
other states. All Arizona counties use optical scan for both regular and early voting. Only Yavapai
County has DRE voting machines (10) for early voting. In the last election, 1,500 Yavapai voters
chose to use this equipment. Thus, over 99 percent of voters in Arizona use optical scan
technology to vote. Considering this, the VVPAT issue, is relevant to less than one percent of the
State’s voters. To retrofit these 10 machines with VVPAT (at $600 per machine), would cost about
$6,000.
Beginning in 2006, all Arizona counties will have a requirement to provide systems that enable the
disabled to cast a secret ballot. A very common solution to this problem is the use of DRE
equipment that enables a vision-impaired person to hear contest choices and make a selection and
then hear confirmation of their selection. Should Arizona determine that DREs are the best
alternative for vision-impaired secret ballots, then it is likely that VVPAT would be added to these
1 “State Tells Counties to Establish Paper Trail on Electronic Voting”
http://www.latimes.com/news/local/la-me-shelley21nov21,1,3417363,print.story
2 “E-mail stolen from Diebold is a call to gouge Maryland”
- http://www.gazette.net/200350/montgomerycty/state/191617-1.html
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 14
systems to allow any voter to use them with confidence in the result. It may be possible to address
the concerns of the visually impaired community by allowing voters to turn the VVPAT off while
they cast their ballot. DREs may also be outfitted with VVPAT in accordance with a sampling
confidence approach as discussed elsewhere in this report.
2.1.3.3 Recommendations
1) There is fear, but little evidence, that voting system vendors are “price gouging” because of
emerging requirements for VVPAT. However, there is no specific requirement that the vendor
be the one to add the printer to the equipment. The printer could be added by a third party
under a separate contract.
2) The State should ensure that if a DRE solution is chosen to meet HAVA disability requirements
for 2006, the solution is configured to enable the connection of a printer as necessary to create
a VVPAT.
2.2 Questions Regarding Certification
2.2.1 Does the Federal Certification Process Adequately Examine System Security?
2.2.1.1 Description
Federal testing and certifications were originally focused on the accuracy and reliability of voting
equipment but not as focused on security protection against emerging electronic types of threats. It
appears that there has been no extensive analysis by the federal testing and certification
authorities of the software source-code being used in the newer DRE systems and that software is
not critically examined to find security flaws and potential programming anomalies that could
possibly alter the accurate recording of election counts.
2.2.1.2 Analysis
2.2.1.2.1 Pre-HAVA FEC Voting Standards (2002)
“On April 30, 2002, the Federal Election Commission (FEC) approved new Federal
Voting Systems Standards (FVSS). The Standards are divided into two volumes.
􀂄􈐠 Volume I provides performance standards and functional capabilities for
voting systems that are seeking Federal qualification.
􀂄􈐠 Volume II addresses documentation required to be submitted by the vendor
prior to testing, it defined to be conducted by the Independent Test
Authorities (ITAs), and the products generated by the test process.
The standards include performance standards for security that describe essential
security capabilities for a voting system, encompassing the system’s hardware,
software, communications, and documentation. The objectives of the security
standards for voting systems are:
􀂄􈐠 To establish and maintain controls that can ensure that accidents,
inadvertent mistakes, and errors are minimized;
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 15
􀂄􈐠 To protect the system from intentional manipulation and fraud, and from
malicious mischief;
􀂄􈐠 To identify fraudulent or erroneous changes to the system; and
􀂄􈐠 To protect secrecy in the voting process.
While the testing standards provide standards for examining software source code,
they do not define explicit procedures for testing the security aspects of a vendor’s
source code.”1
Under FVSS, the Federal Elections Commission (FEC) formulates, maintains and revises voting
systems standards to keep changes in technology and testing requirements current. The FEC
coordinates with the National Association of State Election Directors (NASED) to assure that
independent testing can be performed under the standards. No voting system is ever "Federally
Approved" or "FEC Approved."
NASED selects and approves testing laboratories that perform testing related to voting systems to
meet the FVSS. The standards are not NASED standards and NASED does not have authority
over the FVSS. NASED selects and qualifies Independent Test Authorities (ITAs) to perform the
work of professional testing to assure that voting systems manufacturers comply with the FVSS.
NASED has no ability to determine whether a system passes or fails. ITAs operate independently
to determine objectively whether the vendor has met or exceeded the FVSS. When a system
passes testing through a qualified ITA, the ITA informs NASED of its compliance and then NASED
issues one or more numbers which identify to the states that the system has been qualified by
NASED.
Independent Testing Authorities (ITAs) perform professional testing to assure that voting systems
comply with the FVSS.
The Election Center serves as NASED's day-to-day management company for working with the
ITAs, with the FEC and with the states. The Center has no authority to pass or fail any system, but
works with the local jurisdictions in answering questions concerning the manufacturers' products
that have been qualified (or not qualified) under the FVSS. The Center serves as the focal point for
coordination among the FEC, NASED and state and local jurisdictions and the ITAs.
2.2.1.2.2 HAVA Voting Standards (2003)
“In December 2003 the Election Assistance Commission (EAC) was created as a
result of the Help America Vote Act (HAVA) of 2002. The EAC takes over some of
the roles of the FEC and will serve as a national clearinghouse and resource for
gathering information and reviewing procedures with respect to the administration of
Federal elections. In addition to its advisory role, the EAC is responsible for carrying
out duties related to the testing, certification, de-certification, and re-certification of
voting system hardware and software.
Part of the charter of the EAC is to study and report on Electronic Voting. The study
will include an examination of the appropriate security measures required and
1 http://www.nist.gov/public_affairs/factsheet/voting_symposium.htm
State of Arizona
Assessment of
Election Systems
Engagement: 220608071 © 2004 Gartner, Inc. and/or its affiliates.
All Rights Reserved.
—Page 16
minimum standards for certification of systems or technologies to minimize the
potential for fraud in the voting or registration process. Preliminary reports from the
EAC, however, indicate it will not be able to address immediately this part of its
charter due to funding issues.
HAVA also gives the Commerce Department’s National Institute of Standards and
Technology (NIST) a key role in helping realize nationwide improvements in voting
systems by January 2006. NIST is the chair of the Technical Guidelines
Development Commi