California Diebold Certification awaiting DU EMSLTTT Analysis

[Wilms]

Here are excerpts from SoS Certification Testing Reports, the Staff Review and Analysis, and proposed Procedures for the Diebold TSx.

There were a lot of problems, some of which are reported to have been resolved after subsequent testing, and now requiring certification of the final software version.

Reading these documents it seems clear that the SoS is favoring the use of Diebold, but also that he's making them work for it.

Still, a number of problems remain as does the fundamental danger of electronic voting.

Significantly, "In addition to depositing the source code in an approved escrow facility, the vendor must deposit a copy of the system source code and binary executables with the Secretary of State. The Secretary of State reserves the right to perform a full independent review of the source code."

I hope the DU Election Management Systems Legal and Technical Think Tank (EMSLTTT) both can take the time to review the materials and weigh in on their implications.

Analysis of Volume Testing of the AccuVote TSx / AccuView

Matt Bishop, et. al.

October 11, 2005

Executive Summary

In this report we analyze the results of the recent volume testing conducted in Stockton on July 20, 2005 of 96 Diebold AccuVote TSx machines.

34 to 36 failures were recorded during the test. The count is a little ambiguous because at least one printer incident may have been recorded twice, and one incident, the failure of the printer housing to latch the first time, might be considered too minor to include. To be conservative, we have assumed the lower failure count, i.e. 34 incidents (14 printer problems and 20 software crashes). The data from which we worked, derived from the hand written incident reports, is in an associated spreadsheet.

Our analysis suggests that this failure rate could be serious, especially given the preponderance of software crashes. From the data we estimate the Mean Time Between Failures (MTBF) of these machines to be approximately 15 hours under the conditions experienced during volume testing. It is unclear what failure rate this might imply for a real election.

We found the many software failures potentially more troubling than the paper jams. It seems likely that further changes to the AccuVote TSx software will be required. Under one possible interpretation of the standards, the failure rate observed during these tests was more than 10 times higher than permitted by federal standards (which require a 163-hour MTBF). The failure to detect this fact during the ITA’s testing process appears to be due to serious defects in the testing methodology specified by federal standards.

One lesson of this analysis is that the testing performed during the federal qualification process is apparently inadequate to ensure that voting machines will be reliable enough for use in elections.

snip

Analysis of Software Failures

snip

Generally speaking, there were two broad categories of failures. In the first category, the software failure occurred after a ballot was cast. In the second category, the machine froze immediately after a voter activation card was inserted, and the screen continued displaying the same message (indicating successful casting of a ballot) left over from the previous voter.

Risks

In general, we are concerned that the prevalence of software failures during the June 20th test may indicate software quality problems in the TSx. It is possible that these failures are a sign of a large number of other latent software defects. As far as we know,
there has never been another volume test of the TSx that tests the machine under realistic conditions, and generally at best spotty records kept of any failures that may occur during elections, so there is no way to know the extent or magnitude of the software quality
problem.

It is possible that votes could be lost or corrupted by software failures such as those detected in the June 20th test. For instance, there were failures where the TSx crashed or hung when attempting to cast a ballot or to remove the voter smartcard, and these could
easily have led to the ballot going unrecorded or recorded inaccurately. In the worst case, vote files could be corrupted or truncated when software failures happen. We believe that this issue warrants further investigation before any modified versions of the TSx are certified.

The fundamental barrier to analysis of these software errors is the lack of access to source code for the TSx. With access to this material, it would be possible to identify the cause of each software failure, diagnose the defect in the software, and ascertain the magnitude of the defect. Lacking source code, though, we have no way to perform such an independent evaluation. This is a very unsatisfying position to be in.

We believe these failures constitute one of the strongest arguments for the State of California to take possession of, or otherwise arrange for unfettered access to, the full source code and binary executables for all electronic voting machines. In the absence of access to source code, the State may wish to consider demanding from the vendor a comprehensive itemized accounting of the cause of each software failure, complete with enough technical details that independent technical experts can confirm the vendor’s account for each. Even with such an accounting, however, is that there is no way to know whether the defects have been fixed satisfactorily (as opposed to just hidden), or whether they represent symptoms of more serious architectural flaws, without access to the source.

snip/more

http://ss.ca.gov/elections/voting_systems/vstaab_volume_test_report.pdf

This report followed..

GEMS 1.18.24/ACCUVOTE-TSX WITH ACCUVIEW/ACCUVOTE-OS
DIEBOLD ELECTION SYSTEMS, INC.

Staff Review and Analysis

Prepared by: Secretary of State Elections Division

November 14, 2005

snip

III. TESTING INFORMATION AND RESULTS

1. Federal Testing

Wyle Laboratories has successfully completed federal qualification testing of the AccuVote-OS Model D, firmware v. 1.96.6, to the 2002 Federal Voting System Standards. We have received copy of the final report, datedAugust 4, 2005. Wyle Laboratories also successfully completed federal qualification testing of the AccuVote-TSX with AccuView Printer Module, firmware v. 4.6.3, to the 2002 Federal Voting System Standards. We have received a copy of that final report, also dated August 4, 2005. A subsequent modification to the firmware, to address the issues found in volume testing, was designated version 4.6.4. While this version was also tested by Wyle to the 2002 Federal Voting Systems Standards, the final report on testing of this version has not been releases.

Ciber, Inc. successfully completed federal qualification testing of GEMS v. 1.18.24 in conjunction with the remainder of the system to the 2002 Federal Voting Systems Standards. We have received the final copy of this report, dated August 3, 2005, as well as the final copy of an addendum to the report, dated September 30, 2005.

NASED qualified the entire system, with AccuVote-TSX firmware version 4.6.3, to the 2002 Federal Voting System Standards on June 27, 2005 and assigned it system number N-1-06-22-22-001. We are expecting a modification to that qualification to encompass the upgraded AccuVote-TSX firmware, version 4.6.4, discussed below.

snip

On September 15, 2005, Diebold Election Systems, Inc. reported to Secretary of State staff that they believed they had resolved the issues with screen freezes and reduced that incidence of paper jams sufficiently so that they were prepared for a new volume reliability test. Diebold reported that the screen freezes, in all forms, were attributed to a program bug that was triggered when the voter dragged their finger across the screen to select the “cast vote” button at the conclusion of the ballot. This bug was corrected in an upgraded version of the TSX Ballot Station firmware, version 4.6.4. This new version had completed federal testing at both Ciber and Wyle Laboratories. The paper jams were reduced with a combination of modifications, including changes to the paper guide and firmware changes that were included in version 4.6.4.

snip

The remaining ten incidents were related to the TSX/AVPM equipment. In each case, there was a “graceful” recovery without rebooting the DRE. While three of these incidents involved a paper jam, there were no incidents of the “screen freeze” observed in the previous volume test.

None of the errors resulted in a loss of the record of a vote, either in the TSX memory or on the AVPM paper audit trail.

snip

It should be noted that the nature of VC Programmer does not inherently safeguard against programming the voter access card for the wrong precinct. In a normal polling place where the TSX is programmed only for one precinct, this is not a significant problem because the TSX will simply reject a card for the wrong precinct. In an early voting venue, this becomes more critical because the TSX is typically programmed to accept ballots for many or all of the precincts within the jurisdiction. In these settings, extra care should be taken to be sure voters aren’t given cards programmed for the wrong precinct and ballot style.

snip

PUBLIC COMMENT

On October 20, 2005, an “open house” demonstration of this system was held at the Secretary of State headquarters for invited representatives of the accessibility community,as well as county elections officials and members of the VSTAAB to observe and review this system with Secretary of State and vendor staff. Participants included:

• sixteen elections staff representing nine counties,
• four representatives of the accessibility community,
• two representatives of the VSTAAB, and
• various members of the Secretary of State staff.

Several participants in this event have subsequently sent written comments that will be submitted to the Secretary of State with this report. The major issues raised in these comments, as well as by other participants in the “open house” are:
1. People with limited hand dexterity could have difficulty inserting the Voter Access smart card without some form of assistance.
2. There is no “sip-and-puff” capability for people with limited hand dexterity.
3. If the AccuVote-TSx voting tablet is removed from the cradle (i.e., for placement in the voter’s lap or for curbside voting), the AccuView Printer Module does not go with the tablet. People who vote in this mode will not have the opportunity to verify their ballot with the paper trail. In fact, when the tablet is replaced in the stand, the current firmware is not capable of printing to the AccuView any ballots that were cast while the tablet was out of its cradle.
4. The voter verified paper trail cannot be read or verified by someone who is blind.


VI. RECOMMENDATION

Staff recommends the certification of the Diebold Election Systems, Inc. GEMS Version 1.18.24, AccuVote-TSx Ballot Station, firmware version 4.6.4, with AccuView Printer Module hardware, Key Card Tool Version 4.6.1, Spyrus Voter Card Encoder 1.3.2, VC Programmer 4.6,1, AccuVote-OS (model D) firmware 1.96.6, AccuVote-OS firmware
2.0.12 with AccuFeed with the following conditions:

snip

2. No additional software developed by the Vendor other than that specifically listed in this certification shall be installed on a computer running GEMS Version 1.18.24.
3. No substitution or modification of the voting systems shall be made with respect to any component of the voting systems, including the Procedures, until the Secretary of State has been notified in writing and has determined that the proposed change or modification does not impair the accuracy and efficiency of the voting systems sufficient to require a re-examination and approval.
4. The Secretary of State reserves the right, with reasonable notice to Vendor and to the counties using any of the voting systems, to modify the Procedures used with any of the voting systems and to impose additional requirements with respect to the use of any of the systems if the Secretary of State determines that such modifications or additions are necessary to enhance the accuracy, reliability or security of any of the voting systems. Such modifications or additions shall be deemed to be incorporated herein as if set forth in full.

snip

10. In addition to depositing the source code in an approved escrow facility, the vendor must deposit a copy of the system source code and binary executables with the Secretary of State. The Secretary of State reserves the right to perform a full independent review of the source code.

snip

On July 20, 2005, a large scale “volume” test was held at San Joaquin County warehouse facilities. Over a period of approximately six hours, an average of more than 100 votes were cast on ninety six AccuVote-TSX (TSX) machines equipped with the AVPM. During the course of testing, ten machines had incidents of paper jams. Nineteen machines experienced one or another forms of “freezing” that required the TSX to be rebooted. Although these failure rates were determined to be unacceptable, certification testing of the rest of the system was completed over the following two days and DESI was advised that this application for certification was suspended until they had determined the cause of the TSX/AVPM failures and could demonstrate a fix for these failures.

Since that time, DESI has notified the State that they have resolved these issues and are prepared for retesting of the system. Because that resolution involved modifications to the hardware and software, they have completed testing of these modifications at the Federal ITAs.

This paper will, therefore, set forth the conditions for retesting the modified system under consideration.

PRECONDITIONS TO FURTHER TESTING

Prior to scheduling further testing of the system, the following conditions must be satisfied:

• DESI must supply the California Secretary of State (SOS) with an amended application for the system to be certified, indicating the correct version numbers of all components.
• DESI must supply the SOS with detailed change logs identifying all changes to the hardware and software from the versions previously tested.
• DESI must supply a statement identifying the causes for all problems experienced in the volume test and the changes made to resolve those problems. DESI must further provide sufficient details to SOS staff and the State Consultant about the cause and solution of the problems experienced in the previous volume test that they are satisfied they have a clear understanding of the problems and their resolution.
• The California Secretary of State (SOS) must receive notification from the ITAs that federal testing has been successfully completed.
Upon satisfaction of these requirements, SOS and DESI will schedule new testing of the system for a mutually agreeable date. Volume testing will occur at a location in California that is mutually acceptable to SOS and DESI.

snip

APPENDIX B – SUMMARY OF RESULTS FROM VOLUME TEST SEPTEMBER 28, 2005

snip

Election definition/configuration error

- Two incidents were attributed to errors made in the election definition and setup on the GEMS election management software and had nothing to do with the performance of the voting machine.

http://ss.ca.gov/elections/voting_systems/diebold_2005_06_staffreport__final.pdf

Here's the proposed Procedures

State of California

PROCEDURES

Required for Use of the Diebold Election Systems

These procedures are proposed for adoption by the Secretary of State pursuant to Elections Code sections 19200 and 19205 and shall regulate and govern the use of Diebold Election Systems AccuVote-TSx (Touch Screen) Model R7 at all elections governed by the California Elections Code. These procedures shall be effective upon approval by the Secretary of State and shall be used in conjunction with all other statutory and regulatory requirements. Insofar as feasible, all procedures prescribed herein shall be carried out in full view of the public.

http://ss.ca.gov/elections/voting_systems/ca_avtsx_use_procedures_11_14_05.pdf

[Wilms]

1. Raw Story Article

Will California send Diebold packing before Turkey Day?

Miriam Raftery

Recertification hearing draws protest from activists over last-minute changes in procedures

On Monday, November 21st, California’s Voting System Panel (VSP) was slated to hold public hearings on whether to recertify Diebold TSX touchscreen machines. The California Election Protection Network (CEPN) issued a press release inviting concerned citizens to speak at the 10 a.m. hearing and attend a rally at Secretary of State Bruce McPherson’s office to encourage state officials to “send Diebold packing before Turkey Day.”

But when CEPN spokesperson Sherry Healy called to verify the hearing date and time, she received startling news.
Advertisement

“I asked Bruce McDannold in the Secretary of State’s office if the hearing is still on for Monday,” she told Raw Story. “He said, 'You’re half right. The VSP has been disbanded.' I asked why. He said, 'I can’t speak for the Secretary of State.’”

According to Healy, McDannold stated that a stenographer and recording device would be on hand to record any public comments.

snip/more

http://rawstory.com/news/2005/Will_California_send_Diebold_packing_before_1118.html

Thanks to kpete

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=104x5394542

[Einsteinia]

2. Someone sent this to McPherson on this topic

Here's a letter re VSTAB report, Brown Act, etc.

11/17/2005

Mr. Bruce McPherson
Secretary of State
Executive Office
1500 11th St.
Sacramento, CA 95814

Dear Secretary McPherson;

This is a follow-up to my letter of 11/12/2005 regarding the voting system certification hearing on 11/21/2005. It will also serve as my public comments regarding the hearing based on the documents which were posted on 11/14, 7 business days after the hearing notice was posted on your office’s website. These comments will also be submitted via the email link for public comments.

At the time of the posting of some of the documents associated with the testing (consultant, staff, and Voting Systems Technology Assessment Advisory Board (VSTAB) reports), text was also posted stating your intentions and making the statement “As Secretary of State he is the only official given the responsibility by law of approving or rejecting voting systems for use in California.”

While I applaud your willingness to take the responsibility given to you by law, I would hope you consider all the citizen activists, while acting on their acceptance of the need for engagement in meeting their civic responsibilities, as being just as committed to the integrity of the voting process as you or any of your staff is.

And recognize that the sentiments expressed by the preamble of the Ralph Brown Act are the honest reflection of those who are fully committed to the democratic process. “The people of this State do not yield their sovereignty to the agencies which serve them. The people, in delegating authority, do not give their public servants the right to decide what is good for the people to know and what is not good for them to know. The people insist on remaining informed so that they may retain control over the instruments they have created.”

Unfortunately, your staff seems to not be willing to accept that premise. I make this statement given that all the documentation submitted to your office –such as the Independent Testing Authority (ITA) reports, even though not for the system tested, or manuals associated with the system – are not also posted so that the public can be fully informed. This is in contrast to the statement about you posted at the time of the limited documents “He is also committed to maintaining voter confidence in the voting systems used in California.”
This is especially disturbing in view of the caveat issued on the “APPLICATION FOR APPROVAL OF A VOTING SYSTEM OR SYSTEM COMPONENT”, namely “Please note that all information you submit, once received by the Secretary of State’s office, will be considered a public document.” Yet such documents were not provided for the public to examine.

Your office’s website/page: http://www.ss.ca.gov/elections/elections_vs.htm
has an embedded link titled '2002 Federal Voting Systems Standards' that if one clicks on it, one is taken to a page telling you that the page you requested doesn't exist and you'll be redirected in a few moments and you end up on the FEC home page. If you do a search using '2002 Federal Voting Systems Standards' you get 75 hits, but no document spelling out the standards; if you use the " " for 'advanced/specific' search you get 'no results'.
In the meantime, they are easily found on the web using the same search string of '2002 Federal Voting Systems Standards’ (resulting in the number 1 hit on google being http://www.eac.gov/election_resources/vss.html )

My comments begin with the expression of absolute wonderment and consternation that this hearing is being held at all. The VSTAB report focused on hardware failure and came to the conclusion that “Under one possible interpretation of the standards, the failure rate observed
during these tests was more than 10 times higher than permitted by federal standards (which require a 163-hour MTBF). The failure to detect this fact during the ITA’s testing process appears to be due to serious defects in the testing methodology specified by Federal standards.
One lesson of this analysis is that the testing performed during the Federal
Qualification process is apparently inadequate to ensure that voting machines will be reliable enough for use in elections.” And THEN the VSTAB was not permitted or involved at the September “volume testing” in San Diego!!

Further, the 2002 Voting Systems Standards state “A typical system operations scenario consist of approximately 45 hours of equipment operation, consisting of 30 hours of equipment set-up and readiness testing and 15 hours of elections operations. For the purpose of demonstrating compliance with this requirement, a failure is defined as any event which results in either the:
“Loss of one or more functions” or “Degradation of performance such that the device is unable to perform its intended function for longer than 10 seconds.”
BUT NEITHER of the ‘volume tests’ came close to the sustained “15 hours of elections operations”. While the VSTAB report stated “These calculations provide evidence that the failures observed during the July 20th test are serious. It is hard to escape the conclusion that any system with failure rates this high is not ready for use in an election.” But your staff’s report, despite not conforming to the federal standards for ‘volume testing’, judged the system was acceptable.
Yet both the consultant and staff use such Federal testing (the ITA reports previously mentioned) as a significant part of the justification for their recommendation to approve.

And NO ONE tested to see if the voting systems met the Federal error rate standards specified in the 2002 Voting Systems Standards (as developed by the Federal Election Commission), namely “that a voting system have an error rate matching the FEC standards of a target error rate of no more than one in 10,000,000 ballot positions, with a maximum acceptable error rate in the test process of one in 500,000 ballot positions” -http://www.eac.gov/election_resources/vss.html –
which means that in order to properly test this system for 'Logic and Accuracy' a card deck of ballots, using the last 'special' election in San Diego (53 ballot positions) as a template for 'ballot positions', would consist of 187,736 cards; the maximum size card deck used for the Logic and Accuracy tests -in San Diego- per Charles Wallis, It Director for the San Diego Registrar of Voters, is 400 cards. Even the 'acceptable' error rate would indicate that such testing consist of 9,434 cards, over 23 times the maximum number of cards used for Logic and Accuracy testing in San Diego. The ‘volume testing’ performed by your office staff, the consultant, and the VSTAB consisted of a little over 100 ballots with NO mention of ballot positions. But given 100 machines and each machine having 100 ‘ballots’ cast upon it –as specified in the staff report- and each ballot having 20 positions or less (confirmed with a system testing person) would result in 200,000 ballot positions, far less than the number of positions REQUIRED by Federal standards. And given the aforementioned deficiency in the Federal testing process –recently documented in the General Accounting Office (GAO) and NIST reports- the ITA’s also didn’t test to see if this system met the specified standard.
And even though it states on your office’s website “All systems will be subject to volume testing as defined by established Secretary of State standards prior to certification in California.", I cannot find published ANYWHERE such established standards re 'volume testing'.

And given that you are committed to “maintaining voter confidence in the voting systems used in California.”, being put into a position where you could approve a system that does NOT have proof of it’s accuracy by meeting the Federal standards that you said would have to be met back in August, probably is not comfortable. Especially for someone who wants to run for the Secretary of State office in another election.

The issuance of the NASED qualification number prior to reception of the ITA reports also raises questions regarding the Federal qualification process. The NASED number –even though it isn’t the one issued for the system tested and your office is apparently still waiting for such ITA reports- was issued in June but the ITA reports are dated in August. Federal rules indicate that “The certification number must be issued after the ITA report”, so the proper procedures were not followed in the Federal qualification process and one can only speculate in a non-positive manner as towards why such occurred.
Adding ‘fuel to the fire’ is the consultant’s statement "The new NASED number was issued 11/10/05 for these components with BS Firmware 4.6.4. Final test reports for this release version have not been received from either the hardware or the software ITAs." Again, a violation of the associated Federal rules for the qualification process and raising the question of why this hearing is being held.

The APPLICATION FOR APPROVAL OF A VOTING SYSTEM OR SYSTEM COMPONENT” states that "FINAL draft procedures-referencing California Procedures for Use- MUST be received AT LEAST 45 days prior to the VSP Panel meeting in which the item will be considered.

Obviously, since these ‘California Procedures for Use’ are still in ‘draft’ state as indicated by your staff’s report, this is a violation of the application process and by itself argues against any certification of this system at this time. And such were only posted for public review in the latter part of the day on 11/17, 4 days before the hearing. And consisting of 69 pages to be reviewed and commented on.

The VSTAB report also states “Risks. In general, we are concerned that the prevalence of software failures during the June 20th test may indicate software quality problems in the TSx. It is possible that these failures are a sign of a large number of other latent software defects. The fundamental barrier to analysis of these software errors is the lack of access to source
code for the TSx. With access to this material, it would be possible to identify the cause of each software failure, diagnose the defect in the software, and ascertain the magnitude of the defect. Lacking source code, though, we have no way to perform such an independent evaluation. This is a very unsatisfying position to be in.”

That the VSTAB has NOT had the chance to examine the source code, even though depositing it is a pre-requisite to State certification and you having the authority have the VSTAB examine it, just screams of a rush to judgment that is inconsistent with your stated goal of “making certain that only the most reliable, secure, and accessible voting systems are sold for use in California”.

Another aspect that begs the question of why this hearing is being held is the inability of the system to meet HAVA requirements for the disabled. And even though the VSTAB reports ignores such, the consultant reports says to approve the system even though the consultant states “At this time, I do not have sufficient guidance to identify if the system is fully HAVA compliant pending a determination of what levels or types of support are sufficient.”

Your staff report states “Those voters who are blind or so limited in vision that they cannot read the AVPM record essentially cast their ballot without further verification after the audio summary is reviewed. There is no capability to independently read the AVPPM audit record for blind voters.” AND “The magnifying lens may not be practical for users requiring its use.” AND “There are no separate features supporting physically disabled voters other than the ability to remove the screen from the voting booth
configuration and bringing it closer to the voter in different orientations. In this mode, the AVPM is disconnected and no AVVPAT records will be available for audit.”

And then your staff has the incredible gall to suggest –BASED ON THE VENDOR’S RECOMMENDATION- that the physically disabled “may use mouth-sticks, taking advantage of the touchscreen sensitivity.” How about soliciting the input of those that are disabled in such a manner? And it was the ‘touchscreen’ sensitivity that led to the software changes that reduced but did not eliminate the problems associated with the first ‘volume testing’; if usage of such ‘mouth-sticks’ was going to be acceptable to those disabled, it would only make sense to be testing whether or not the usage of such ‘mouth-sticks’ causes an issue with the machines.

The consultant states, “The current suggestion (in addressing the visually impaired but not blind voter) is that commercial full page magnifying sheets may be used, but this was NOT tested. It is not clear whether the magnifying sheets are to be provided as part of the DESI contracts or at the direct expense of the jurisdiction.” And the issue(s) of the cost of the Counties providing election services, using these machines, to the Cities is not even mentioned anywhere. For instance, if it takes an hour to do the Logic and Accuracy testing on one DRE, San Diego County would have to spend 1275 person-days testing before EVERY election in order to comply with California law. And, of course, such costs would be passed onto the Cities as part of the ‘service’; wonder how many voters are in the cities and whether they’d appreciate your approval of a voting system that increases the cities’ costs?

Also, your staff indicates in their report “Two services which were expected to be stopped by the changes were not successfully stopped; DESI needs to provide a further revision to the procedures to complete the requirement.” This references the fact that the system is still in violation of a court order but your staff says go ahead and approve it anyway. (Calif. Superior Court Case No. RG03 128466)

Absentee voting is a significant portion of votes cast in recent elections and is a growing trend that is encouraged by election officials. Yet, absolutely NO testing of the functions associated with such ballot tabulation was done by the VSTAB, consultant or your staff.

In response to Caren Daniels-Meade’s memo “Physical Security and Communication Plan Templates” sent out on 9/23/2005 because “very few of these reports have been filed”(referencing election observer, physical security and communication plans), San Diego responded to “Do vendor employees ever handle voting equipment?” by indicating ‘yes’. The ‘yes’ answer indicated, “vendor employees, under County Supervision, assist in central count tabulation of absentee ballot process”. Given the significant amount of absentee ballots, it is not fathomable why such is allowed as such would present an opportunity to the vendor to alter the machines. How will absentee ballots be handled in this voting system? Will vendor assistance be needed? If so, what protections are offered the public that such employees be completely above reproach? The San Diego ROV doesn’t conduct background checks on poll workers (in an age when employers reject applicant’s because of poor credit) and has no control over whom a vendor employs or dispatches. Additionally, San Diego indicated that vendor employees ‘are allowed to handle voting equipment pre-election’.
This is a violation of the process of ensuring election validity of the worst sort because it is at this point in the election processes that vote results can be most easily manipulated. It is with certainty that I can say the vendors do NOT provide personnel at a loss to themselves. Are these machines so complicated that County or State personnel can’t operate them by themselves? That sounds more like an addiction than a voting system. And perhaps more to the point, why does ANY election official need assistance from someone trying to sell something?

OBVIOUSLY, the system is NOT HAVA compliant; why is your office holding a certification proceeding when the voting system is NOT meeting your publicly announced standards, when the conditions set forth in the Application have NOT been met, when the voting system has yet to comply with a court order almost a year old, when the accuracy of the voting system has NOT been tested to the 2002 Voting System standards, when the public has not had an opportunity to review all the documents associated with the voting system(they are public documents per the Application), when documents listed by the vendor as being associated with the voting system usage are being ‘revised’ and have not been received by your office, when the source code has NOT been examined by the VSTAB to determine if there are issues associated with the program coding that would make their presence felt at a later time, when the maintenance costs associated with such voting systems has NOT been part of the evaluation and what impact that would have on cities, when public comment has ALREADY been voiced regarding the un-satisfactoriness of the thermal printer avvpat, and when the vendor has already demonstrated it’s untrustworthiness and lack of reliability in providing a DRE system?

You indicated in your October 5th press release that you would NOT ‘consider
voting systems unless the vendors or products have” using a past tense verb, (that is further confirmed by the same tense being used in the points raised) yet this hearing is being held DESPITE points 3,4,5 and 10 NOT occurring.

This fact, besides the ongoing willingness by your staff to have the necessary documentation ‘dribble in’ and then come in again and again certainly raises questions of your staff’s commitment to the policies and procedures you have established and their relationship with the vendor community.

I strongly urge you to NOT approve this application and include various statements made in the reports posted on your office’s website and succinct comments below my signature.


Sincerely,



XXXXX


CC: Senator Debra Bowen
Assemblyperson Tom Umberg
Assemblyperson Lori Saldana
Senator Christine Kehoe
Assemblyperson Shirley Horton
Senate President Pro Tem Don Perata
Senator Jackie Speier
Assemblyperson Mark Leno
City Attorney Mike Aguirre
Governor Arnold Schwarzenegger




My comments on statements from the VSTAB, Consultant, and Staff reports:

Two services, which were expected to be stopped by the changes, were not
successfully stopped; DESI needs to provide a further revision to the procedures to complete the requirement.------this means the system is still in violation of a court order but the staff says go ahead and approve it anyway.

The remaining 23 Report files INSTALLED with GEMS 1.18.24 have NOT been validated for use.--------but there’s still a hearing?

NONE of the below documents are posted for public inspection despite it
being very clear in the "Application for approval of a voting system or component" that ALL information submitted will be considered a 'public document'. (This is documentation provided your office but was NOT provided to the public AND also violates the Application AND your October 5th press release:)
1. Freeman, Certification Test for the Diebold Election Systems, Inc. (DESI) GEMS 1.18.22/AV-TSX 4.6.1 Voting System Including the AccuView Printer Module, 15 May 2005
2. Diebold Election Systems, Inc., State of California PROCEDURES
Required for Use of the Diebold Election Systems AccuVote-TSx Electronic Ballot Station , 28 Mar 2005. (More recent draft procedures have been submitted but came in too late to be included in this report.)
3. Ciber Report, Software Functional Test Report Diebold Election System GEMS 1-18-24, Original Report Version 1.0 created 8/03/05, .3 Aug 2005
4. Ciber Draft Report, Software Functional Test Report Diebold Election System GEMS 1-18-24, Addendum 1 for GEMS 1-18-24 created 9/30/05, changed 11/4/05.
5. Wyle Report No. 48619-06, Hardware Qualification Testing of the Diebold Election Systems AccuVote-TSx DRE Voting Machine With AccuView
Printer Module (Firmware Release 4.6.21), May 17, 2005.
6. Wyle Report No. 52501-01, Change Release Report of the Diebold Election Systems AccuVote-TSx DRE Voting Machine With AccuView Printer Module (Firmware Release 4.6.3), November 2, 2005
7. Wyle Preliminary Report No. 52501-01, Preliminary Change Release Report of the Diebold Election Systems AccuVote-TSx DRE Voting Machine With AccuView Printer Module (Firmware Release 4.6.4), November 2, 2005
8. Diebold Draft Instructions, Instructions for Setting GEMS and EMP Server Configuration Pursuant to Paragraph 6.3.y of Superior Court Case No. RG03 128466, 1 Aug 2005.
9. DESI Manual, GEMS_1.18_Election_Administrators_Guide_Revision_9.0
“6. Documentation
a. GEMS 1.18 Users Guide, Revision 12.0
b. GEMS 1.18 Reference Guide, Revision 8.0
c. GEMS 1.18 Election Administrators Guide, Revision 8.0 <9>
d. GEMS 1.18 Server Administration Guide, Revision 3.0.
e. GEMS 1.18 System Administrators Guide, Revision 6.0
f. AccuVote-TSX Hardware Guide, Revision 8.0
g. AccuVote-TSX Pollworkers Guide, Revision 4.0 <5>
h. Key Card Tool 1.0 Users Guide, Revision 2.0 Guide Rev 1.0]
i. Voter Card Encoder 1.3, Users Guide 2.0 <1.0?>
j. VCProgrammer 4.1 Users Guide, Revision 4.0 Guide Revision 1.0]
k. AccuVote-OS Hardware Guide, Revision 6.0
l. AccuVote-OS Pollworkers Guide, Revision 3.0
m. AccuVote-OS 1.96 Precinct Count Users Guide, Revision 3.0
n. AccuFeed 1.0 Hardware Guide, Revision 1.0
are updates that have been listed by DESI but were not provided as part of this test.]”

"which feeds past a view port where the voter can review the printed record of their ballot choices." -------------And what does a blind voter get to verify their vote?

"The VVPAT canister is sealed before the polls are opened and are removed sealed at the end of the election until the VVPAT records are needed to perform an audit." --------------------And what kind of seal is this?

"The new NASED number was issued 11/10/05 for these components with BS
Firmware 4.6.4. Final test reports for this release version have not been received from either the hardware or the software ITAs."--------------- So a NASED number was issued without the reports being recieved?

*AVPM unit revision was not recognized in the hardware or software ITA testing. Discussions with the hardware ITA indicate that the modification was probably tested but does not appear to have been included in the documentation to the hardware ITA as a different model. This revision of the AVPM is critical to this test and certification and needs to be recognized in the final certification." ------------The phraseology indicates the decision to certify has already been made, e.g., "needs to be recognized in the final (I'm not aware of any other certification except 'final') certification."

“4. Magnifying lens. From the report “The magnifying lens may not be practical for users requiring its use. The limited focused field of view in the paper view window left edges and top/bottom elements in the paper view window distorted. Overhead and side lighting created areas of glare and shadow adding to the potentially difficulty for reading the ballot. The magnification level appeared to meet current expectation for the degree of magnification but we do not have a basis for accepting or rejecting the adequacy of this feature except public comment.” -----BUT there has been NO public comment on this because the public has NOT been able to see this voting system in order to make any meaningful judgment.

“13. ABasic Files. AccuBasic report files are used to configure AccuVote-OS and AccuVote-TS report contents and printing in precinct count mode. They are actually loaded into the memory cards for the AV-OS and AV-TS where their logic is executed.”-------This ADMITS the Hursti hack validity !! That the 'Staff' would now admit to such, whereas they wouldn't when certifying the Diebold AccuVote-OS system, firmware 1.96.4, would seem to indicate they are 'learning as they go' (or are intentionally deceptive) and as such, cannot be considered a valid authority for judgment of such systems. Makes a shambles of the idea that there is no "executable on the memory cards".

“At the current time, the Federal testing only uses one of these files and does no source code review, leaving this to the states to verify. Within our state testing, we only verified the reports for the same file, 194US.abo, revision 1.15, and have checked the source files. Since the source file is not reviewed in the Federal testing, we have no absolute verification that the installed file found in the witnessed build (forwarded by Ciber) was
created from these source files but signature information in the .abo file matches what would be expected from the source file.”----------Without such verification, it is nothing but a 'best guess' estimate.

I offer the following suggestion to address this issue:
If an application that includes proof of federal certification, (i.e. copies of the United States Election Assistance Commission approved
Independent Testing Authority reports and certification number
issued by the EAC), then a manifest document can then be created which holds the PCA information. The manifest file must contain the file names, expected file locations, file sizes, CRC-32 values, MD5 fingerprint values, and SHA1 fingerprint values of each executable held in escrow. Executable is defined as any EXE, DLL, COM, OCX, JAR, or ABO file.
A county can create a similar manifest for the county's machine. By comparing the 2 manifests it is possible to state with certainty the system at the county is certified.
This can be presented as a reasonable procedure to insure only certified software is delivered to the counties by a vendor. It is vendor neutral.

This system meets all the HAVA requirements that are defined and testable within the Federal Voting System Standards-2002.----------------This is a completely false statement; just one example is the HAVA requirements that specify that a voting system have an error rate matching the FEC standards of a target error rate of no more than one in 10,000,000 ballot positions, with a maximum acceptable error rate in the test process of one in 500,000 ballot position.

"Throughout the election, the AccuVote-OS tabulates votes on the
memory card as the ballots are fed individually by the voter." -------this means, despite previous staff reports that such cards do NOT need to be retained, that the DOJ definitions regarding devices that tabulate votes and are not ROM based MUST be retained as part of the voting record.

"Wyle Laboratories has successfully completed federal qualification testing of the AccuVote-OS Model D, firmware v. 1.96.6, to the 2002 Federal Voting System Standards. We have received copy of the final report, dated August 4, 2005."-------again, why is this not report posted for public examination given it being very clear in the "application for approval of a voting system or component" that ALL information submitted will be considered a 'public document'. Additionally, this report is NOT what was considered by the consultant in the documents he used.

"Finally, Wyle Laboratories completed federal qualification testing of both Key Card Tool, v. 4.6.1 and VC Programmer, v. 4.6.1, to the 2002 Federal Voting System Standards. We have also received a copy of the final report of that testing, dated August 4, 2005.5. VCProgrammer v. 4.6.1" --------yet the 'staff' states "VCProgrammer is a PC based software application" and Wyle is NOT a NASED approved software Independent Testing Authority; only Ciber and Systest are approved software vendors; Wyle can only evaluate firmware and the VCrogrammer is NOT a rom based 'software'(firmware).
http://www.nased.org/ITA%20Information/NASEDApprovedSystems1.03.pdf

"11. §104 (d): Certification tests shall promote public confidence that the system is easy to use or ‘voter friendly.’
The proposed system is at least as user-friendly as the currently certified Diebold systems." ------BUT that doesn't mean the public thinks that the system is 'user friendly'.

12. §104 (e): Certification testing shall demonstrate that the system creates an audit trail showing both that the voter was able to vote for the candidate or for or against a measure of his or her choice and that the system correctly and consistently interpreted the voter’s votes.
The system meets this requirement. The AccuVote-TSx configured with the AccuView printer module provides an AVVPAT.--------this 'staff' recommendation ignores, completely, the issues brought up by the consultant and Voting Systems Technology Assessment Advisory Board.

The 'staff' report states "A review of the appropriate Elections Code sections was conducted." and goes on to state regarding EC 15360 "The system meets this requirement." --------------This has to do with the 1% manual audit in the official canvas and NO testing or process to address this was done in the procedures documented during the trials of this system. If people can't view the avvpat easily, what is the election official to do? Buy a stronger magnifying glass? How many voters will get tired of waiting to vote because those who have voted are having problems viewing the avvpat?


The staff report mentions EC 19320 but ignores EC 15004.

The staff report mentions EC 19321 which specifies what an election official shall do but then the staff report says that the voting system meets the requirement; this is but one example of the shoddiness of the staff report. The 'staff' report cites at least 12 election codes that are election official/poll worker dependent and says the 'system meets this requirement'.
The staff report cites "The Retention of Voting Documentation (42 U.S.C. 1974 through 1974e) statute applies in all jurisdictions and to all elections in which a federal candidate is on a ballot." -------------yet it does NOT, again, mention the memory cards which are used to tabulate votes; the staff report further quotes "In addition, it is the Department of Justice’s view that the phrase “other act requisite to voting” requires the retention of the ballots themselves, at least in those jurisdictions where a voter’s electoral preference is manifested by marking a piece of paper or by punching holes in a computer card." Given the preponderance of absentee voting on paper card based ballots, it is remarkable that the staff report ignores both the absentee ballot and memory card issue and certainly brings up the issue of why they now want to abide by DOJ guidelines when they didn't before; see the procedures for a component of this system, the AccuVote-OS system firmware 1.96.4.

15. 504 (c): A copy of the approved Qualification Test results released directly to the Secretary of State by a Nationally Recognized Test Laboratory (NRTL).
Draft copies of the ITA reports have been received. Final copies of those reports will be secured before the system is certified. ----------Why is there a hearing when the final reports haven't been received or the public been given the opportunity to exam these reports?

16. §504 (d): A review, if applicable, of transcripts or other materials from prior meetings or hearings on the proposed system, procedure, or modification, either in whole or in part.
The relevant documentation has been reviewed. ----------So why haven't the procedures been revised to reflect the 'new' perspectives?

20. §504 (h): A review of any effect the application will have on the ease and convenience with which voters use the system.
The proposed system is more voter friendly than the currently certified Diebold systems. -----------Says who? What members of the general public were solicited for their input regarding this item?

21. §504 (i): A review of any effect the application will have on the timeliness of vote reporting.
The proposed system will not delay the reporting of election results relative to the currently certified system. -------------This COMPLETELY IGNORES the issue of viewing the avvpat for the 1% manual recount (which is completely invalid statistically for determining if the voting results are reflective of the total vote.)
On October 20, 2005, an “open house” demonstration of this system was held at the Secretary of State headquarters for invited representatives of the accessibility community, as well as county elections officials and members of the VSTAAB to observe and review this system with Secretary of State and vendor staff. Participants included:
• sixteen elections staff representing nine counties,
• four representatives of the accessibility community,
• two representatives of the VSTAAB, and
• various members of the Secretary of State staff.------------and absolutely no one of the general public or voting activist organizations; the arrogance is astounding and the Secretary of State AND his staff need to read the preamble to the Ralph Brown Act before they become so confident in their actions.