This is the accessible text file for GAO report number GAO-04-975T entitled 'Elections: Electronic Voting Offers Opportunities and Presents Challenges' which was released on July 20, 2004. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Testimony: Before the Subommittee on Technology, Information Policy, Intergovernmental Relations and the Census, Committee on Government Reform, House of Representatives: United States Government Accountability Office: GAO: For Release on Delivery Expected at 10: 00 a.m. EDT: Tuesday, July 20, 2004: Elections: Electronic Voting Offers Opportunities and Presents Challenges: Statement of Randolph C. Hite, Director, Information Technology Architecture and Systems: GAO-04-975T: GAO Highlights: Highlights of GAO-04-975T, a testimony before the Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census, Committee on Government Reform, House of Representatives Why GAO Did This Study: The technology used to cast and count votes is one aspect of the multifaceted U.S. election process. GAO examined voting technology, among other things, in a series of reports that it issued in 2001 following the problems encountered in the 2000 election. In October 2002, the Congress enacted the Help America Vote Act, which, among other things, established the Election Assistance Commission (EAC) to assist in the administration of federal elections. The act also established a program to provide funds to states to replace older punch card and lever machine voting equipment. As this older voting equipment has been replaced with newer electronic voting systems over the last 2 years, concerns have been raised about the vulnerabilities associated with certain electronic voting systems. Among other things, GAO’s testimony focuses on attributes on which electronic voting systems can be assessed, as well as design and implementation factors affecting their performance. GAO also describes the immediate and longer term challenges confronting local jurisdictions in using any type of voting equipment, particularly electronic voting systems. What GAO Found: An electronic voting system, like other automated information systems, can be judged on several bases, including how well its design provides for security, accuracy, ease of use, and efficiency, as well as its cost. For example, direct recording electronic systems offer advantages in ease of use because they can have features that accommodate voters with various disabilities, and they protect against common voter errors, such as overvoting (voting for more candidates than is permissible); a disadvantage of such systems is their capital cost and frequent lack of an independent paper audit trail. Advantages of optical scan voting equipment (another type of electronic voting system) include capital cost and the enhanced security associated with having a paper audit trail; disadvantages include lower ease of use, such as limited ability to accommodate voters with disabilities. One important determinant of voting system performance is how it is designed and developed, including the testing that determines whether the developed system performs as designed. In the design and development process, a critical factor is the quality of the specified system requirements as embodied in applicable standards or guidance. For voting technology, these voluntary standards have historically been problematic; the EAC has now been given responsibility for voting system guidelines, and it intends to update them. The EAC also intends to strengthen the process for testing voting system hardware and software. A second determinant of performance is how the system is implemented. In implementing a system, it is critical to have people with the requisite knowledge and skills to operate it according to well-defined and understood processes. The EAC also intends to focus on these people and process factors in its role of assisting in the administration of elections. In the upcoming 2004 national election and beyond, the challenges confronting local jurisdictions in using electronic voting systems are similar to those facing any technology user. These challenges include both immediate and more long term challenges, as shown in the table. Challenges in Using Electronic Voting Systems: [See PDF for image] [End of table] www.gao.gov/cgi-bin/getrpt?GAO-04-975T. To view the full product, including the scope and methodology, click on the link above. For more information, contact Randolph C. Hite at (202) 512-3439 or firstname.lastname@example.org. [End of section] Mr. Chairman and Members of the Subcommittee: I appreciate the opportunity to participate in today's hearing on electronic voting systems.[Footnote 1] In light of concerns associated with the voting systems used in the 2000 election, we produced a series of reports, issued in 2001,[Footnote 2] in which we examined virtually every aspect of the election process, including types of voting technology. As we reported in 2001, the particular technology used to cast and count votes is a critical part of this process, but it is only one facet of a multifaceted election process. Other facets include the people who implement and use the technology and the processes that govern its implementation, among which are the standards used to define the characteristics and performance of the technology. Accordingly, we recognized that no voting technology, however well designed, can be a magic bullet that will solve all the problems that can arise in the election process. At the same time, we also recognized that if not properly managed, this one facet of the election process can significantly undermine the integrity of the whole. As requested, my testimony today will focus on electronic voting systems, and in doing so I will address (1) the role of these systems within the larger election process, (2) attributes that can be used to examine these systems' capabilities, (3) the importance of both system design and implementation to the performance of these systems, and (4) the challenges confronting local jurisdictions in using any type of voting equipment, particularly electronic voting systems. In preparing for this testimony, we drew extensively from our published work on the election process. We augmented this work with reviews of more recent studies of electronic voting systems and other relevant documents. In addition, we interviewed commissioners of the newly appointed Election Assistance Commission (EAC) regarding its efforts to date and its plans, and we attended EAC and other commission hearings on electronic voting systems. Our follow-up work was performed from February to July 2004 in Washington, D.C. All the work on which this testimony is based was performed in accordance with generally accepted government auditing standards. Results in Brief: Electronic voting systems play a vital role in elections, but they are only one component in a multidimensional process. The people, processes, and technology that make up these various dimensions all contribute to the success of the overall election process. From a national perspective, this overall process involves many levels of government, including over 10,000 jurisdictions with widely varying characteristics and requirements. For example, the size of a jurisdiction and the languages spoken by voters are significant variables in local election processes, as is the performance of the particular voting system used. The performance of an electronic voting system, like any type of automated information system, can be judged on several bases, including how well its design provides for security, accuracy, ease of use, and efficiency, as well as cost. For example, direct recording electronic systems have advantages in ease of use because they can have features that accommodate persons with various disabilities, and they provide features that protect against common voter errors; disadvantages of such systems are their cost and their frequent lack of an independent paper audit trail. Advantages of optical scan voting equipment, which is another type of electronic voting system, include cost and the enhanced security associated with having a paper audit trail; disadvantages include lower ease of use, such as their limited ability to accommodate voters with disabilities. Voting system performance is a function of two very important activities: system design and development--including the testing that determines whether the developed system performs as designed--and system implementation. One critical input to the design and development process is the quality of the specified system requirements as embodied in applicable standards. For voting technology, these standards have historically been problematic, and they are now a focus of the EAC. Critical inputs to the system implementation process are having people with the requisite knowledge and skills to operate and use the system, and having well-defined and understood processes governing this operation and use. Both are also areas of focus by the commission. Looking toward to the upcoming 2004 national election and beyond, the challenges confronting local jurisdictions in using electronic voting systems are not unlike those facing any technology user. These challenges include (1) performing those security, testing, and maintenance activities needed to minimize risk and adequately ensure that the system operates as intended; (2) managing the system, the people who interact with the system, and the processes that govern this interaction as interrelated and interdependent parts; (3) having reliable measures and objective data to know whether the system is meeting the needs of the jurisdiction's user community (both the voters and the persons who administer the elections); and (4) making choices about future system changes in light of whether a given system will provide benefits over its useful life commensurate with life-cycle costs, and ensuring that these costs are affordable. Background: Following the 2000 national elections, we performed a comprehensive series of reviews covering our nation's election process, in which we identified a number of challenges. These reviews culminated in a capping report that summarized this work and provided the Congress with a framework for considering options for election administration reform.[Footnote 3] Our reports and framework were among the resources that the Congress drew on in enacting the Help America Vote Act (HAVA) of 2002,[Footnote 4] which provided guidance for fundamental election administration reform. Among other things, the act authorizes $3.86 billion in funding over several fiscal years for programs to replace punch card and mechanical lever voting equipment, improve election administration, improve accessibility, train poll workers, and perform research and pilot studies. It also created the EAC to oversee the election administration reform process. Since the act's passage, a number of voting jurisdictions have replaced their older voting equipment with direct recording electronic systems. At the same time, concerns have been raised about the use of these systems; some have reported that these systems have serious security vulnerabilities and that the embedded controls are not sufficient to ensure the integrity of the election process. The EAC, which began operations in January 2004, held a public hearing in May 2004 at which a major topic was the security and reliability of electronic voting devices. GAO Work Following the 2000 Elections Provided a Framework for Election Administration Reform: At the request of congressional leaders, committees, and members, we conducted an extensive body of work in the wake of the 2000 elections, which culminated in seven reports addressing a range of election- related topics. First, we reviewed the constitutional framework for the administration of elections, as well as major federal statutes enacted in this area.[Footnote 5] We reported that the constitutional framework for elections includes both state and federal roles. States are responsible for the administration of both their own elections and federal elections, but the Congress has enacted laws in several major areas of the voting process, including the timing of federal elections, voter registration, and absentee voting requirements. Congressional authority to legislate in this area derives from various constitutional sources, depending upon the type of election. For federal elections, the Congress has constitutional authority over both congressional and presidential elections. Second, we examined voting assistance for military and overseas voters.[Footnote 6] We reported that although tools are available for such voters, many potential voters were unaware of them, and many military and overseas voters believed it was challenging to understand and comply with state requirements and local procedures for absentee voting. In addition, although information was not readily available on the precise number of military and overseas absentee votes that were disqualified in the 2000 general election and the reasons for disqualification, we found through a national telephone survey that almost two-thirds of the disqualified absentee ballots were rejected because of lateness or errors in completion of the envelope or form accompanying the ballot. We recommended that the Secretaries of Defense and State improve (1) the clarity and completeness of service guidance, (2) voter education and outreach programs, (3) oversight and evaluation of voting assistance efforts, and (4) sharing of best practices. The Departments of Defense and State agreed with our overall findings and recommendations, and as of May 2004, the recommendations had largely been implemented. Third, we investigated whether minorities and disadvantaged voters were more likely to have their votes not counted because the voting method they used was less reliable than that of affluent white voters.[Footnote 7] According to our results, the state in which counties were located had more effect on the number of uncounted presidential votes than did counties' demographic characteristics or voting method. State differences accounted for 26 percent of the total variation in uncounted presidential votes across counties.[Footnote 8] County demographic characteristics accounted for 16 percent of the variation (counties with higher percentages of minority residents tended to have higher percentages of uncounted presidential votes, while counties with higher percentages of younger and more educated residents tended to have lower percentages of uncounted presidential votes), and voting equipment accounted for 2 percent of the variation. Fourth, in a review of voting accessibility for voters with disabilities,[Footnote 9] we found that all states had provisions addressing voting by people with disabilities, but these provisions varied greatly. Federal law requires that voters with disabilities have access to polling places for federal elections, with some exceptions.[Footnote 10] All states provided for one or more alternative voting methods or accommodations intended to facilitate voting by people with disabilities. In addition, states and localities had made several efforts to improve voting accessibility for voters with disabilities, such as modifying polling places, acquiring new voting equipment, and expanding voting options, but state and county election officials surveyed cited various challenges to improving access. We concluded that given the limited availability of accessible polling places, other options that could allow more voters with disabilities to vote at a polling place on election day include reassigning them to other, more accessible polling places or creating accessible superprecincts in which voters from more than one precinct could all vote in the same building. Fifth, we reported on the status and use of voting equipment standards developed by the Federal Election Commission (FEC).[Footnote 11] These standards define minimum functional and performance requirements, as well as minimum life-cycle management processes for voting equipment developers to follow, such as quality assurance. At the time of our review, no federal agency had explicit statutory responsibility for developing the standards; however, the FEC developed voluntary standards for computer-based systems in 1990,[Footnote 12] and the Congress provided funding for this effort. Similarly, no federal agency was responsible for testing voting systems against the federal standards. Instead, the National Association of State Election Directors accredited independent test authorities to test voting systems against the standards. We noted, however, that the FEC standards had not been updated since 1990 and were consequently out of date. We suggested that the Congress consider assigning explicit federal authority, responsibility, and accountability for the standards, including their proactive and continuous update and maintenance; we also suggested that the Congress consider what, if any, federal role is appropriate regarding implementation of the standards, including the accreditation of independent test authorities and the qualification of voting systems. Both of these matters were addressed in the Help America Vote Act, which, among other things, set up the EAC to take responsibility for voluntary voting system guidelines. We also made recommendations to the FEC aimed at improving the guidelines. Before the EAC became operational, the FEC continued to update and maintain the guidelines, issuing a new version in 2002. Sixth, we issued a report on election activities and challenges across the nation.[Footnote 13] In this report, we described the operations and challenges associated with each stage of the election process, including voter registration; absentee and early voting;[Footnote 14] election day administration; and vote counts, certification, and recounts. The report also provided analyses on issues associated with voting systems that were used in the November 2000 elections and the potential use of the Internet for voting. Among other things, we pointed out that each of the major stages of an election depends on the effective interaction of people (the election officials and voters), processes (or internal controls), and technology (registration systems, election management systems, and voting systems). We also enumerated the challenges facing election officials at all stages of the election process. Finally, we issued a capping report that included a framework for evaluating election administration reform proposals.[Footnote 15] Among other things, we observed that the constitutional and operational division of federal and state authority to conduct elections had resulted in great variability in the ways that elections are administered in the United States. We concluded that given the diversity and decentralized nature of election administration, careful consideration needed to be given to the degree of flexibility and the planned time frames for implementing new initiatives. We also concluded that in order for election administration reform to be effective, reform proposals must address all major parts of our election system-- its people, processes, and technology--which are interconnected and significantly affect the election process. And finally, we provided an analytical framework for the Congress to consider in deciding on changes to the overall election process. The Help America Vote Act Was Enacted to Strengthen the Overall Election Process: Enacted by the Congress in October 2002, the Help America Vote Act of 2002 addressed a range of election issues, including the lack of explicit federal (statutory) responsibility for developing and maintaining standards for electronic voting systems and for testing voting systems against standards. With the far-reaching goal of improving the election process in every state, the act affects nearly every aspect of the voting process, from voting technology to provisional ballots, and from voter registration to poll worker training. In particular, the act established a program to provide funds to states to replace punch card and lever machine voting equipment,[Footnote 16] established the EAC to assist in the administration of federal elections and provide assistance with the administration of certain federal election laws and programs, and established minimum election administration standards for the states and units of local government that are responsible for the administration of federal elections. In January 2004, the Congressional Research Service reported that disbursements to states for the replacement of older equipment and election administration improvements totaled $649.5 million.[Footnote 17] The act specifically tasked the EAC to serve as a national clearinghouse and resource for compiling election information and reviewing election procedures; for example, it is to conduct periodic studies of election administration issues to promote methods of voting and administration that are most convenient, accessible, and easy to use for all voters. Other examples of EAC responsibilities include: * developing and adopting voluntary voting system guidelines, and maintaining information on the experiences of states in implementing the guidelines and operating voting systems; * testing, certifying, decertifying, and recertifying voting system hardware and software through accredited laboratories; * making payments to states to help them improve elections in the areas of voting systems standards, provisional voting and voting information requirements, and computerized statewide voter registration lists; and: * making grants for research on voting technology improvements. According to the act, reporting to the EAC will be the Technical Guidelines Development Committee, which will make recommendations on voluntary voting system guidelines. The National Institute of Standards and Technology (NIST) will provide technical support to the development committee, and the NIST Director will serve as its chairman. In December 2003, the EAC commissioners were appointed, and the EAC began operations in January 2004. According to the commission chairman, the EAC's fiscal year 2004 budget is $1.2 million, and its near-term plans focus on complying with requirements established in HAVA. In that regard, the EAC issued its first annual report to the Congress in April of this year on the status of election administration reform. The EAC also plans to issue best practices guidelines in July 2004 to increase the reliability of voting equipment and systems for the November 2004 elections. The guidelines also include guidance on recruiting and training poll workers. The commission's longer term plans include updating the voluntary voting system guidelines and improving the process for independent testing of voting systems. Toward this end, the EAC's Technical Guidelines Development Committee recently held its first meeting to develop a plan to update voluntary voting system guidelines. According to some commissioners, current operations are constrained by a lack of persons in key staff positions, including the Executive Director, General Counsel, and Inspector General. Electronic Voting Systems Fall into Two Primary Categories: In the United States today, most votes are cast and counted by one of two types of electronic voting systems: optical scan and direct recording electronic (DRE). Two older voting technologies were also used in the 2000 elections: punch card equipment (used by about 31 percent of registered voters in 2000 and expected to be used by 19 percent in 2004) and mechanical lever voting machines (used by about 17 percent of registered voters in 2000 and expected to be 13 percent in 2004).[Footnote 18] These equipment types are being replaced as required by provisions established in HAVA.[Footnote 19] In addition, for a small minority of registered voters, votes are cast and counted manually on paper ballots.[Footnote 20] Optical Scan Systems: Optical scan voting systems use electronic technology to tabulate paper ballots. Although optical scan technology has been in use for decades for such tasks as scoring standardized tests, it was not applied to voting until the 1980s. In 2000, about 31 percent of registered voters voted on optical scan systems. In the 2004 election, according to Election Data Services, Inc., about 32 percent of registered voters will use optical scan voting equipment. For voting, an optical scan system is made up of computer-readable ballots, appropriate marking devices, privacy booths, and a computerized tabulation device. The ballot, which can be of various sizes, lists the names of the candidates and the issues. Voters record their choices using an appropriate writing instrument to fill in boxes or ovals, or to complete an arrow next to the candidate's name or the issue. The ballot includes a space for write-ins to be placed directly on the ballot. Optical scan ballots are tabulated by optical-mark-recognition equipment (see fig. 1), which counts the ballots by sensing or reading the marks on the ballot. Ballots can be counted at the polling place-- this is referred to as precinct-count optical scan[Footnote 21]--or at a central location. If ballots are counted at the polling place, voters or election officials put the ballots into the tabulation equipment, which tallies the votes; these tallies can be captured in removable storage media that are transported to a central tally location, or they can be electronically transmitted from the polling place to the central tally location. If ballots are centrally counted, voters drop ballots into sealed boxes, and election officials transfer the sealed boxes to the central location after the polls close, where election officials run the ballots through the tabulation equipment. Figure 1: Precinct-Count Optical Scan Tabulator and Central-Count Optical Scan Tabulator: [See PDF for image] [End of figure] Software instructs the tabulation equipment to assign each vote (i.e., to assign valid marks on the ballot to the proper candidate or issue). In addition to identifying the particular contests and candidates, the software can be configured to capture, for example, straight party voting and vote-for-no-more-than-N contests. Precinct-based optical scanners can also be programmed to detect overvotes (where the voter votes for two candidates for one office, for example, invalidating the vote) and undervotes (where the voter does not vote for all contests or issues on the ballot) and to take some action in response (rejecting the ballot, for instance). In addition, optical scan systems often use vote-tally software to tally the vote totals from one or more vote tabulation devices. If election officials program precinct-based optical scan systems to detect and reject overvotes and undervotes, voters can fix their mistakes before leaving the polling place. However, if voters are unwilling or unable to correct their ballots, a poll worker can manually override the program and accept the ballot, even though it has been overvoted or undervoted. If ballots are tabulated centrally, voters do not have the opportunity to correct mistakes that may have been made. Direct Recording Electronic Systems: First introduced in the 1970s, DREs capture votes electronically, without the use of paper ballots. In the 2000 election, about 12 percent of voters used this type of technology. In the 2004 election, according to Election Data Services, Inc., about 29 percent of registered voters will use this voting technology. DREs come in two basic types, pushbutton or touchscreen, the pushbutton being the older technology; during the 2000 elections, pushbutton DREs were the most prevalent of the two types. The two types vary considerably in appearance (see fig. 2). Pushbutton DREs are larger and heavier than touchscreens. Figure 2: DRE Pushbutton and DRE Touchscreen: [See PDF for image] [End of figure] Pushbutton and touchscreen units also differ significantly in the way they present ballots to the voter. With the pushbutton, all ballot information is presented on a single "full-face" ballot. For example, a ballot may have 50 buttons on a 3 by 3 foot ballot, with a candidate or issue next to each button. In contrast, touchscreen DREs display the ballot information on an electronic display screen. For both pushbutton and touchscreen types, the ballot information is programmed onto an electronic storage medium, which is then uploaded to the machine. For touchscreens, ballot information can be displayed in color and can incorporate pictures of the candidates. Because the ballot space on a touchscreen is much smaller than on a pushbutton machine, voters who use touchscreens must page through the ballot information. Both touchscreen and pushbutton DREs can accommodate multilingual ballots. Despite the differences, the two types have some similarities, such as how the voter interacts with the voting equipment. For pushbuttons, voters press a button next to the candidate or issue, which then lights up to indicate the selection. Similarly, voters using touchscreens make their selections by touching the screen next to the candidate or issue, which is then highlighted. When voters are finished making their selections on a touchscreen or a pushbutton DRE, they cast their votes by pressing a final "vote" button or screen. Until they hit this final button or screen, voters can change their selections. Both types allow voters to write in candidates. While most DREs allow voters to type write-ins on a keyboard, some pushbutton types require voters to write the name on paper tape that is part of the device. Although DREs do not use paper ballots, they do retain permanent electronic images of all the ballots, which can be stored on various media, including internal hard disk drives, flash cards, or memory cartridges. According to vendors, these ballot images, which can be printed, can be used for auditing and recounts. Some of the newer DREs use smart card technology as a security feature. Smart cards are plastic devices--about the size of a credit card--that use integrated circuit chips to store and process data, much like a computer. Smart cards are generally used as a means to open polls and to authorize voter access to ballots. For instance, smart cards on some DREs store program data on the election and are used to help set up the equipment; during setup, election workers verify that the card received is for the proper election. Other DREs are programmed to automatically activate when the voter inserts a smart card; the card brings up the correct ballot onto the screen. In general, the interface with the voter is very similar to that of an automatic teller machine. Like optical scan devices, DREs require the use of software to program the various ballot styles and tally the votes, which is generally done through the use of memory cartridges or other media. The software is used to generate ballots for each precinct within the voting jurisdiction, which includes defining the ballot layout, identifying the contests in each precinct, and assigning candidates to contests. The software is also used to configure any special options, such as straight party voting and vote-for-no-more-than-N contests. In addition, for pushbutton types, the software assigns the buttons to particular candidates and, for touchscreens, the software defines the size and location on the screen where the voter makes the selection. Vote-tally software is often used to tally the vote totals from one or more units. DREs offer various configurations for tallying the votes. Some contain removable storage media that can be taken from the voting device and transported to a central location to be tallied. Others can be configured to electronically transmit the vote totals from the polling place to a central tally location. DREs are designed not to allow overvotes; for example, if a voter selects a second choice in a two-way race, the first choice is deselected. In addition to this standard feature, different types offer a variety of options, including many aimed at voters with disabilities, that jurisdictions may choose to purchase. In our 2001 work, we cited the following features as being offered in some models of DRE: * A "no-vote" option. This option helps avoid unintentional undervotes. This provides the voter with the option to select "no vote (or abstain)" on the display screen if the voter does not want to vote on a particular contest or issue. * A "review" feature. This feature requires voters to review each page of the ballot before pressing the button to cast the vote. * Visual enhancements. Visual enhancements include color highlighting of ballot choices, candidate pictures, etc. * Accommodations for voters with disabilities. Examples of options for voters who are blind include Braille keyboards and audio interfaces.[Footnote 22] At least one vendor reported that its DRE accommodates voters with neurological disabilities by offering head movement switches and "sip and puff" plug-ins.[Footnote 23] Another option is voice recognition capability, which allows voters to make selections orally. * An option to recover spoiled ballots. This feature allows voters to recast their votes after their original ballots are cast. For this option, every DRE at the poll site would be connected to a local area network. A poll official would void the original "spoiled" ballot through the administrative workstation that is also connected to the local area network. The voter could then cast another ballot. * An option to provide printed receipts. In this case, the voter would receive a paper printout or ballot when the vote is cast. This feature is intended to provide voters and/or election officials with an opportunity to check what is printed against what is recorded and displayed. It is envisioned that procedures would be in place to retrieve the paper receipts from the voters so that they could not be used for vote selling. Some DREs also have an infrared "presence sensor" that is used to control the receipt printer in the event the voter is allowed to keep the paper receipt; if the voter leaves without taking the receipt, the receipt is pulled back into the printer. Expanded Use of Electronic Voting Systems Has Raised Concerns: As older voting equipment has been replaced with newer electronic voting systems over the last 2 years, the debate has shifted from hanging chads and butterfly ballots to vulnerabilities associated with DREs. Problems with these devices in recent elections have arisen in various states. For example: * Six DRE units used in two North Carolina counties lost 436 ballots cast in early voting for the 2002 general election because of a software problem, according to a February 9, 2004, report in Wired News. The manufacturer said that problems with the firmware of its touchscreen machines led to the lost ballots. The state was trying out the machines in early voting to determine if it wanted to switch from the optical scan machines it already owned to the new touchscreen systems. * According to a January 2004 report in Wired News, blank ballots were recorded for 134 voters who signed in and cast ballots in Broward County, Florida. These votes represented about 1.3 percent of the more than 10,000 people who voted in the race for a state house representative. * USA Today reported that four California counties suffered from problems with DREs in a March 2004 election, including miscounted ballots, delayed polling place openings, and incorrect ballots. In San Diego County, about one-third of the county's polling places did not open on time because of battery problems caused by a faulty power switch. Additionally, serious questions are being raised about the security of DREs. Some state that their use could compromise the integrity of the election process and that these devices need auditing mechanisms, such as receipt printers that would provide a paper audit trail and allow voters to confirm their choices.[Footnote 24] Among these critics are computer scientists, citizens groups, and legislators. For example, computer scientists from Johns Hopkins and Rice Universities released a security analysis of software from a DRE of a major vendor, concluding that the code had serious security flaws that could permit tampering.[Footnote 25] Other computer scientists, while agreeing that the code contained security flaws, criticized the study for not recognizing how standard election procedures can mitigate these weaknesses. Following the Johns Hopkins and Rice study, the State of Maryland contracted with both SAIC and RABA Technologies to study the same DRE equipment. The SAIC study found that the equipment, as implemented in Maryland, poses a security risk.[Footnote 26] Similarly, RABA identified vulnerabilities associated with the equipment. [Footnote 27] An earlier Caltech/MIT study[Footnote 28] noted that despite security strengths of the election process in the United States,[Footnote 29] current trends in electronic voting are weakening those strengths and introducing risks; according to this study, properly designed and implemented electronic voting systems could actually improve, rather than diminish, security. Citizen advocacy groups are also taking action. For example, according to an April 21, 2004, press release from the Campaign for Verifiable Voting in Maryland, the group filed a lawsuit against the Maryland State Board of Elections to force election officials to decertify the DRE machines used in Maryland until the manufacturer remedies security vulnerabilities and institutes a paper audit trail. Legislators and other officials are also responding to the issues. In at least 20 states, according to the Associated Press, legislation has been introduced requiring a paper record of every vote cast.[Footnote 30] Following the problems in California described above, the California Secretary of State banned the use of one model of touchscreen DREs and conditionally decertified other similar models. According to the New York Times, these models represented 14,000 and 28,000 units, respectively.[Footnote 31] The Secretary recommended that the state Attorney General consider taking civil and criminal action against the manufacturer for "fraudulent actions." The decision followed the recommendations of the state's Voting Systems and Procedures Panel, which urged the Secretary of State to prohibit the four counties that experienced difficulties from using their touchscreen units in the November 2004 election. The panel reported that the manufacturer did not obtain federal approval of the model used in the four affected counties and installed software that had not been approved by the Secretary of State. It also noted that problems with the systems prevented an unspecified number of voters from casting ballots. In addition, two California state senators drafted a bill to prohibit the use of any DRE voting system without a paper trail in the 2004 general election; they planned to introduce the bill if the Secretary of State did not act.[Footnote 32] In June 2004, the Secretary of State proposed standards for the creation and testing of paper trails for electronic voting systems. At the federal level, several bills have been introduced in response to concerns about electronic voting technology. One of the bills,[Footnote 33] the Voter Confidence and Increased Accessibility Act of 2003 (H.R. 2239), if enacted, would require that voting machines used in elections for federal office produce paper audit trails so that voters and election officials can check accuracy.[Footnote 34] Among other provisions, the bill would also ban the use of undisclosed software[Footnote 35] and wireless communications devices in voting systems. Some of the concerns regarding DREs were raised at a public hearing held by the EAC on May 5, 2004. The purpose of the hearing was to permit the EAC to receive information on the use, security, and reliability of electronic voting devices. It included panels of technology and standards experts, vendors of voting systems, state election administrators, and citizen advocacy groups. One expert testified that electronic voting systems are flawed because they do not permit voters to verify that their votes were recorded correctly and they do not permit a public vote count. Others stated that the systems can be made secure only by the addition of a voter-verifiable paper ballot. On the other hand, the election administrators on the panel described positive experiences with DREs, and representatives of voters with disabilities supported the use of DREs because of their accessibility features.[Footnote 36] Despite Their Vital Role, Voting Systems Are Only One Aspect of the Larger Election Process: Electronic voting systems represent one of many important components in the overall election process. This process is made up of several stages, with each stage consisting of key people, process, and technology variables. Many levels of government are involved, including over 10,000 jurisdictions with widely varying characteristics. In the U.S. election process, all levels of government share responsibility. At the federal level, the Congress has authority under the Constitution to regulate presidential and congressional elections and to enforce prohibitions against specific discriminatory practices in all elections--federal, state, and local.[Footnote 37] It has passed legislation affecting the administration of state elections that addresses voter registration,[Footnote 38] absentee voting,[Footnote 39] accessibility provisions for the elderly and handicapped,[Footnote 40] and prohibitions against discriminatory practices.[Footnote 41] The Congress does not have general constitutional authority over the administration of state and local elections. At the state level, the states are responsible for the administration of both their own elections and federal elections. States regulate the election process, including, for example, adoption of voluntary voting system guidelines, testing of voting systems, ballot access, registration procedures, absentee voting requirements, establishment of voting places, provision of election day workers, and counting and certification of the vote. In fact, the U.S. election process can be seen as an assemblage of 51 somewhat distinct election systems--those of the 50 states and the District of Columbia. Further, although election policy and procedures are legislated primarily at the state level, states typically have decentralized this process so that the details of administering elections are carried out at the city or county levels, and voting is done at the local level. As we reported in 2001, local election jurisdictions number more than 10,000, and their size varies enormously--from a rural county with about 200 voters to a large urban county such as Los Angeles County, where the total number of registered voters for the 2000 elections exceeded the registered voter totals in 41 states. The size of a voting jurisdiction significantly affects the complexity of planning and conducting the election, as well as the method used to cast and count votes. In our 2001 work, we quoted the chief election official in a very large voting jurisdiction: "the logistics of preparing and delivering voting supplies and equipment to the county's 4,963 voting precincts, recruiting and training 25,000 election day poll workers, preparing and mailing tens of thousands of absentee ballot packets daily and later signature verifying, opening and sorting 521,180 absentee ballots, and finally, counting 2.7 million ballots is extremely challenging." The specific nature of these challenges is affected by the voting technology that the jurisdiction uses. For example, jurisdictions using DRE systems may need to manage the electronic transmission of votes or vote counts; jurisdictions using optical scan technology need to manage the paper ballots that this technology reads and tabulates. Jurisdictions using optical scan technology may also need to manage electronic transmissions if votes are counted at various locations and totals are electronically transmitted to a central tally point. Another variable is the diversity of languages within a jurisdiction. In November 2000, Los Angeles County, for instance, provided ballots in Spanish, Chinese, Korean, Vietnamese, Japanese, and Tagalog, as well as English. No matter what technology is used, jurisdictions may need to provide ballot translations; however, the logistics of printing paper materials in a range of languages, as would be required for optical scan technology, is different from the logistics of programming translations into DRE units. Some states do have statewide election systems so that every voting jurisdiction uses similar processes and equipment, but others do not. For instance, we reported in 2001 that in Pennsylvania, local election officials told us that there were 67 counties and consequently 67 different ways of handling elections.[Footnote 42] In some states, state law prescribes the use of common voting technology throughout the state, while in other states local election officials generally choose the voting technology to be used in their precincts, often from a list of state-certified options. Whatever the jurisdiction and its specific characteristics, administering an election is a year-round activity, involving varying sets of people to carry out processes at different stages. These stages generally consist of the following: * Voter registration. Among other things, local election officials register eligible voters and maintain voter registration lists, including updates to registrants' information and deletions of the names of registrants who are no longer eligible to vote. * Absentee and early voting. This type of voting allows eligible persons to vote in person or by mail before election day. Election officials must design ballots and other systems to permit this type of voting, as well as educating voters on how to vote by these methods. * The conduct of an election. Election administration includes preparation before election day, such as local election officials arranging for polling places, recruiting and training poll workers, designing ballots, and preparing and testing voting equipment for use in casting and tabulating votes, as well as election day activities, such as opening and closing polling places and assisting voters to cast votes. * Vote counting. At this stage, election officials tabulate the cast ballots; determine whether and how to count ballots that cannot be read by the vote counting equipment; certify the final vote counts; and perform recounts, if required. As shown in figure 3, each stage of an election involves people, processes, and technology. Figure 3: Stages of Election Process: [See PDF for image] [End of figure] Electronic voting systems are primarily involved in the last two stages, during which votes are cast and counted. However, the type of system that a jurisdiction uses may affect earlier stages. For example, in a jurisdiction that uses optical scan systems, paper ballots like those used on election day may be mailed in the absentee voting stage. On the other hand, a jurisdiction that uses DRE technology would have to make a different provision for absentee voting. Electronic Voting Systems' Performance Can Be Judged on Several Attributes: Although the current debate concerning electronic voting systems primarily relates to security, other factors affecting election administration are also relevant in evaluating these systems. Ensuring the security of elections is essential to public confidence and election integrity, but officials choosing a voting system must also consider other performance factors, such as accuracy, ease of use, and efficiency, as well as cost. Accuracy refers to how frequently the equipment completely and correctly records and counts votes; ease of use refers to how understandable and accessible the equipment is to a diverse group of voters and to election workers; and efficiency refers to how quickly a given vote can be cast and counted. Finally, equipment's life-cycle cost versus benefits is an overriding practical consideration. Security: In conducting elections, officials must be able to assure the public that the confidentiality of the ballot is maintained and fraud prevented. In providing this assurance, the people, processes, and technology involved in the election system all play a role: the security procedures and practices that jurisdictions implement, the security awareness and training of the election workers who execute them, and the security features provided by the systems. Election officials are responsible for establishing and managing privacy and security procedures to protect against threats to the integrity of elections.[Footnote 43] These security threats include potential modification or loss of electronic voting data; loss, theft, or modification of physical ballots; and unauthorized access to software and electronic equipment. Physical access controls are required for securing voting equipment, vote tabulation equipment, and ballots; software access controls (such as passwords and firewalls[Footnote 44]) are required to limit the number of people who can access and operate voting devices, election management software, and vote tabulation software. In addition, election processes are designed to ensure privacy by protecting the confidentiality of the vote: physical screens are used around voting stations, and poll workers are present to prevent voters from being watched or coerced while voting. Examples of security controls that are embedded in the technology include the following: * Access controls. Election workers may have to enter user names and passwords to access voting systems and software, so that only authorized users can make modifications. On election day, voters may need to provide a smart card or token[Footnote 45] to DRE units. * Encryption. To protect the confidentiality of the vote, DREs use encryption technology to scramble the votes cast so that the votes are not stored in the same order in which they were cast. In addition, if vote totals are electronically transmitted, encryption is used to protect the vote count from compromise by scrambling it before it is transmitted over telephone wires and unscrambling it once it is received. * Physical controls. Hardware locks and seals protect against unauthorized access to the voting device once it has been prepared for the election (e.g., once the vote counter is reset, the unit is tested, and ballots are prepared). * Audit trails. Audit trails provide documentary evidence to recreate election day activity, such as the number of ballots cast (by each ballot configuration or type) and candidate vote totals for each contest. Audit trails are used for verification purposes, particularly in the event that a recount is demanded. With optical scan systems, the paper ballots provide an audit trail. Since not all DREs provide a paper record of the votes, election officials may rely on the information that is collected by the DRE's electronic memory. Part of the debate over the assurance of integrity that DREs provide revolves around the reliability of this information. * Redundant storage. Redundant storage media in DREs provide backup storage of votes cast or vote counts to facilitate recovery of voter data in the event of power or system failure. The particular features offered by DRE and optical scan equipment differ by vendor make and model as well as the nature of the technology. DREs generally offer most of the features, but there is debate about the implementation of these features and the adequacy of the access controls and audit trails that this technology provides. If DREs use tokens or smart cards to authenticate voters, these tokens must also be physically protected and may require software security protection. For optical scan systems, redundant storage media may not be required, but software and physical access controls may be associated with tabulation equipment and software, and if vote tallies are transmitted electronically, encryption may also be used. In addition, since these systems use paper ballots, the audit trail is clearer, but physical access to ballots after they are cast must be controlled. The physical and process controls used to protect paper ballots include ballot boxes as well as the procedures implemented to protect the boxes if they need to be transported, to tabulate ballots, and to store counted ballots for later auditing and possible recounts. Accuracy: Ensuring that votes are accurately recorded and tallied is an essential attribute of any voting equipment. Without such assurance, both voter confidence in the election and the integrity and legitimacy of the outcome of the election are at risk. The importance of an accurate vote count increases with the closeness of the election. Both optical scan and DRE systems are claimed to be highly accurate. In 2001, our vendor survey showed virtually no differences in vendor representations of the accuracy of DRE and optical scan voting equipment, measured in terms of how accurately the equipment counted recorded votes.[Footnote 46] Vendors of optical scan equipment reported accuracy rates of between 99 and 100 percent, with vendors of DREs reporting 100 percent accuracy. As we reported in 2001, although 96 percent of local election jurisdictions were satisfied with the performance of their voting equipment during the 2000 election, according to our mail survey, only about 48 percent of jurisdictions nationwide collected data on the accuracy of their voting equipment for the election.[Footnote 47] Further, it was unclear whether jurisdictions actually had meaningful performance data. Of those local election jurisdictions that we visited that stated that their voting equipment was 100 percent accurate, none was able to provide actual data to substantiate these statements. Similarly, according to our mail survey, only about 51 percent of jurisdictions collected data on undervotes, and about 47 percent collected data on overvotes for the November 2000 election.[Footnote 48] Although voting equipment may be designed to count votes as recorded with 100 percent accuracy, how frequently the equipment counts votes as intended by voters is a function not only of equipment design, but also of the interaction of people and processes. These people and process factors include whether, for example, * technicians have followed proper procedures in testing and maintaining the system, * voters followed proper procedures when using the system, * election officials have provided voters with understandable procedures to follow, and: * poll workers properly instructed and guided voters. As indicated earlier, various kinds of errors can lead to voter intentions not being captured when ballots are counted. Avoiding or compensating for these errors may involve solutions based on technology, processes, or both. For example, DREs are designed to prevent overvoting; however, overvoting can also be prevented by a procedure to check optical scan ballots for overvotes before the voter leaves the polls, which can be accomplished by a precinct-based tabulator or by other means. Ease of Use: Like accuracy, ease of use (or user friendliness) largely depends on how voters interact with the voting system, physically and intellectually. This interaction, commonly referred to as the human/ machine interface, is a function of the system design, the processes established for its use, and user education and training. Among other things, how well jurisdictions design ballots and educate voters on the use of voting equipment affects how easy voters find the system to use. In the 2000 elections, for example, ballots for some optical scan systems were printed on both sides, so that some voters failed to vote one of the sides. This risk could be mitigated by clear ballot design and by explicit instructions, whether provided by poll workers or voter education materials. Thus, ease of use affects accuracy (i.e., whether the voter's intent is captured), and it can also affect the efficiency of the voting process (confused voters take longer to vote). Accessibility to diverse types of voters, including those with disabilities, is a further aspect of ease of use. As described earlier, DREs offer more options for voters with disabilities, as they can be equipped with a number of aids to voters with disabilities. However, these options increase the expense of the units, and not all jurisdictions are likely to opt for them. Instead of technological solutions, jurisdictions may establish special processes for voters with disabilities, such as allowing them to be assisted to cast their votes; this workaround can, however, affect the confidentiality of the vote. Efficiency: Efficiency--the speed of casting and tallying votes--is an important consideration for jurisdictions not only because it influences voter waiting time and thus potentially voter turnout, but also because it affects the number of voting systems that a jurisdiction needs to acquire and maintain, and thus the cost. Efficiency can be measured in terms of the number of people that the equipment can accommodate within a given time, how quickly the equipment can count votes, and the length of time that voters need to wait. With DREs, the vote casting and counting functions are virtually inseparable, because the ballot is embedded in the voting equipment. Accordingly, for DREs efficiency is generally measured in terms of the number of voters that each machine accommodates on election day. In 2001, vendors reported that the number of voters accommodated per DRE ranges from 200 to 1,000 voters per system per election day. With optical scan systems, in contrast, vote casting and counting are separate activities, since the ballot is a separate medium--a sheet of paper or a computer card--which once completed is put into the vote tabulator. As a result, the efficiency of optical scan equipment is generally measured in terms of the speed of count (i.e., how quickly the equipment counts the votes on completed ballots). Complicating this measurement is the fact that efficiency differs depending on whether central-count or precinct-based tabulators are used. Central-count equipment generally counts more ballots per hour because it is used to count the ballots for an entire jurisdiction, rather than an individual polling site. For central-count optical scan equipment, 10 vendors reported speed of count ranges from 9,000 to 24,000 ballots per hour. For precinct-count optical scan equipment, vendors generally did not provide specific speed of count data, but they stated that one machine is generally used per polling site. Generalizations about the effect of technology on wait times are difficult. In 2001, our mail survey found that 84 percent of jurisdictions nationwide were satisfied with the amount of voter wait time at the polling place during the November 2000 election, but that 13 percent of jurisdictions considered long lines at the polling places to be a major problem.[Footnote 49] However, we estimated that only 10 percent of jurisdictions nationwide collected information on the average amount of time that it took voters to vote. We were told by some jurisdictions that the length of time voters must wait is affected by ballots that include many races and issues. Some jurisdictions reported that their ballots were so long that it took voters a long time in the voting booth to read them and vote. As a result, lines backed up, and some voters had to wait for over an hour to cast their votes. Officials in one jurisdiction said that their voters experienced long wait times in part because redistricting caused confusion among voters, who often turned up at the wrong polling places. As these examples show, the voting system used is not always a major factor in voter wait times. However, processes that do depend on the system may affect the time that a voter must spend voting. For example, in precincts that use precinct-level counting technology for optical scan ballots, voters may place their ballots in the automatic feed slot of the tabulator. This process can add to voting time if the tabulator is designed to reject ballots that are undervoted, overvoted, or damaged, and the voter is given the opportunity to correct the ballot. Cost: Generally, buying DRE units is more expensive than buying optical scan systems. For a broad picture, consider the comparison that we made in 2001 of the costs of purchasing new voting equipment for local election jurisdictions based on three types of equipment: central-count optical scan equipment, precinct-count optical scan equipment, and touchscreen DRE units.[Footnote 50] Based on equipment cost information available in August 2001, we estimated that purchasing optical scan equipment that counted ballots at a central location would cost about $191 million.[Footnote 51] Purchasing an optical scan counter for each precinct that could notify voters of errors on their ballots would cost about $1.3 billion. Purchasing touchscreen DRE units for each precinct, including at least one unit per precinct that could accommodate blind, deaf, and paraplegic voters, would cost about $3 billion. For a given jurisdiction, the particular cost involved will depend on the requirements of the jurisdiction, as well as the particular equipment chosen. Voting equipment costs vary among types of voting equipment and among different manufacturers and models of the same type of equipment. For example, in 2001, DRE touchscreen unit costs ranged from $575 to $4,500. Similarly, unit costs for precinct-count optical scan equipment ranged from $4,500 to $7,500. Among other things, these differences can be attributed to differences in what is included in the unit cost as well as differences in the characteristics of the equipment. In addition to the equipment unit cost, an additional cost for jurisdictions is the software that operates the equipment, prepares the ballots, and tallies the votes (and in some cases, prepares the election results reports). Our vendor survey showed that although some vendors included the software cost in the unit cost of the voting equipment, most priced the software separately. Software costs for DRE and optical scan equipment could run as high as $300,000 per jurisdiction. The higher costs were generally for the more sophisticated software associated with election management systems. Because the software generally supported numerous equipment units, the software unit cost varied depending on the number of units purchased or the size of the jurisdiction. Other factors affecting the acquisition cost of voting equipment are the number and types of peripherals required. In general, DREs require more peripherals than do optical scan systems, which adds to their expense. For example, some DREs require smart cards, smart card readers, memory cartridges and cartridge readers, administrative workstations, and plug-in devices (for increasing accessibility for voters with disabilities). Touchscreen DREs may also offer options that affect the cost of the equipment, such as color versus black and white screens. In addition, most DREs and all optical scan units require voting booths, and most DREs and some precinct-based optical scan tabulators offer options for modems. Precinct-based optical scan tabulators also require ballot boxes to capture the ballots after they are scanned. Once jurisdictions acquire the voting equipment, they must also incur the cost to operate and maintain it, which can vary considerably. For example, in 2001, jurisdictions that used DREs reported a range of costs from about $2,000 to $27,000. Similarly, most jurisdictions that used optical scan equipment reported that operations and maintenance costs ranged from about $1,300 to $90,000. The higher ends of these cost ranges generally related to the larger jurisdictions. In fact, one large jurisdiction that used optical scan equipment reported that its operating costs were $545,000. In addition, the jurisdictions reported that these costs generally included software licensing and upgrades, maintenance contracts with vendors, equipment replacement parts, and supply costs. For decisions on whether to invest in new voting equipment, both initial capital costs (i.e., cost to acquire the equipment) and long- term support costs (i.e., operation and maintenance costs) are relevant. Moreover, these collective costs (i.e., life-cycle costs) need to be viewed in the context of the benefits the equipment will provide over its useful life. It is advisable to link these benefits directly to the performance characteristics of the equipment and the needs of the jurisdiction. Electronic Voting System Performance Depends on System Design and Implementation: The performance of any information technology system, including electronic voting systems, is heavily influenced by a number of factors, not the least of which is the quality of the system's design and the effectiveness with which the system is implemented in an operational setting. System design and implementation, in turn, are a function of such things as how well the system's requirements are defined, how well the system is tested, and how well the people that operate and use the system understand and follow the procedures that govern their interaction with it. Our work in 2001 raised concerns about the FEC's voting system standards, and showed that practices relative to testing and implementation of voting systems varied across states and local jurisdictions. Voting Systems Should Be Designed, Built, and Tested against Well- Defined Standards: Like that of any information technology product, the design of a voting system starts with the explicit definition of what the system is to do and how well it is to do it. These requirements are then translated into design specifications that are used to develop the system. Organizations such as the Department of Defense and the Institute of Electrical and Electronics Engineers have developed guidelines for various types of systems requirements and for the processes that are important to managing the development of any system throughout its life cycle. These guidelines address types of product requirements (e.g., functional and performance), as well as documentation and process requirements governing the production of the system. In the case of voting systems, the FEC had assumed responsibility for issuing standards that embodied these requirements, a responsibility that HAVA has since assigned to the EAC. The FEC standards are nevertheless still the operative standards until the EAC updates them. These FEC-issued standards apply to system hardware, software, firmware, and documentation,[Footnote 52] and they span prevoting,[Footnote 53] voting,[Footnote 54] and postvoting activities.[Footnote 55] They also address, for example, requirements relating to system security; system accuracy and integrity; system auditability; system storage and maintenance; and data retention and transportation. In addition to these standards, some states and local jurisdictions have specified their own voting system requirements. In 2001, we cited a number of problems with the FEC-issued voting system standards, including missing elements of the standards. Accordingly, we made recommendations to improve the standards. Subsequently, the FEC approved the revised voting system standards on April 30, 2002. According to EAC commissioners with whom we spoke, the commission has inherited the FEC standards, but it plans to work with NIST to revise and strengthen them. To ensure that systems are designed and built in conformance with applicable standards, our work in 2001 found that three levels of tests are generally performed: qualification tests, certification tests, and acceptance tests. For voting systems, the FEC-issued standards called for qualification testing to be performed by independent testing authorities. According to the standards, this testing is to ensure that voting systems comply with both the FEC standards and the systems' own design specifications. State standards define certification tests, which the states generally perform to determine how well the systems conform to individual state laws, requirements, and practice.[Footnote 56] Finally, state and local standards define acceptance testing, performed by the local jurisdictions procuring the voting systems. This testing is to determine whether the equipment, as delivered and installed, satisfies all the jurisdiction's functional and performance requirements. Beyond these levels of testing, jurisdictions also perform routine maintenance and diagnostic activities to further ensure proper system performance on election day. Our 2001 work found that the majority of states (38) had adopted the FEC standards then in place,[Footnote 57] and thus these states required that the voting systems used in their jurisdictions passed qualification testing.[Footnote 58] In addition, we reported that qualified voting equipment had been used in about 49 percent (±7 percentage points) of jurisdictions nationwide that used DREs and about 46 percent (±7 percentage points) of jurisdictions nationwide that used optical scan technology. However, about 46 percent (±5 percentage points) reported that they did not know whether their equipment had been qualified. As we reported in 2001, 45 states and the District of Columbia told us that they had certification testing programs, and we estimate from our mail survey that about 90 percent of jurisdictions used state-certified voting equipment in the 2000 national election.[Footnote 59] In addition, we reported that most of the jurisdictions that had recently bought new voting equipment had conducted some form of acceptance testing. However, the processes and steps performed and the people who performed them varied. For example, in one jurisdiction that purchased DREs, election officials stated that testing consisted of a visual inspection, power-up, opening of polls, activation and verification of ballots, and closing of polls. In contrast, officials in another jurisdiction stated that they relied entirely on the vendor to test their DREs. In jurisdictions that used optical scan equipment, acceptance testing generally consisted of running decks of test cards. For example, officials from one jurisdiction stated that they tested each unit with the assistance of the vendor using a vendor-supplied test deck. Our 2001 work found that the processes and people involved in routine system maintenance, diagnostic, and pre-election day checkout activities varied from jurisdiction to jurisdiction. For example, about 90 percent of jurisdictions nationwide using DRE and optical scan technology had performed routine or manufacturer-suggested maintenance and checkout before the 2000 national election. However, our visits to 27 local election jurisdictions revealed variations in the frequency with which jurisdictions performed such routine maintenance. For example, some performed maintenance right before an election, while others performed maintenance regularly throughout the year. For example, officials in one jurisdiction that used DREs stated that they tested the batteries monthly. Voting Systems Should Be Properly Implemented: Proper implementation of voting systems is a matter of people knowing how to carry out appropriately designed processes to ensure that the technology performs as intended in an operational setting. According to the EAC commissioners, one of their areas of focus will be election administration processes and the people who carry out these processes. Examples include ballot preparation, voter education, recruiting and training poll workers, setting up the polls, running the election, and counting the votes. Ballot preparation. Whether ballots are electronic or paper, they need to be designed in a way that promotes voter understanding when they are actually used. Designing both optical scan and DRE ballots requires consideration of the different types of human interaction entailed and the application of some human factors expertise. For DREs, programming skills need to be applied to create the ballot and enter the ballot information onto an electronic storage medium, which is then uploaded to the unit. For optical scan systems, paper ballots need to be designed and printed in specified numbers for distribution to polling places; they may also be used for absentee balloting, usually in combination with printed mailing envelopes. Electronic "ballots" in DRE units do not require distribution separate from the distribution of the voting equipment itself; however, the use of DREs means that a separate technique is necessary for absentee ballots--generally paper ballots. Thus, the use of these units generally requires a mixed election system. Voter education. Implementation of any voting method requires that voters understand how to vote--that is, what conventions are followed. For optical scan systems, voters need to understand how to mark the ballots, they need to know what kinds of marker (type of pen or pencil) can be used, they need to be informed if a ballot must be marked on both sides, and so on. For DRE systems, voters need to understand how to select candidates or issues and understand that their votes are not cast until the cast vote button is pressed; for touchscreens, they need to know how to navigate the various screens presented to them. Voters also need to understand the procedure for write-in votes. In 2001, one jurisdiction had an almost 5 percent overvote rate because voters did not understand the purpose of the ballot section permitting write-in votes. Voters selected a candidate on the ballot and then wrote the candidate's name in the write-in section of the ballot, thus overvoting and spoiling the ballot. In addition to voter education, how the system is programmed to operate can also address this issue. For example, precinct-count optical scan equipment can be programmed to return a voter's ballot if the ballot is overvoted or undervoted and allow the voter to make changes. Poll worker recruitment and training. Poll workers need implementation training. They need to be trained not only in how to assist voters to use the voting system, but also in how to use the technology for the tasks poll workers need to perform. These tasks can vary greatly from jurisdiction to jurisdiction. When more sophisticated voting systems are used at polling sites, jurisdictions may find it challenging to find poll workers with the skills to implement and use newer technologies. In 2001, we quoted one election official who said that "it is increasingly difficult to find folks to work for $6 an hour. We are relying on older retired persons--many who can't/won't keep up with changes in the technology or laws. Many of our workers are 70+." Setting up the polls. Proper setup of polling places raises a number of implementation issues related to the people, processes, and technology involved. For DREs, the need for appropriate power outlets and possibly network connections limits the sites that can be used as polling places. In addition, setting up, initializing, and sometimes networking DRE units are technically challenging tasks. Technicians and vendor representatives may be needed to perform these tasks or to assist poll workers with them. In addition, with DREs, computer security issues come into play that are different from those associated with the paper and pencil tools that voters use in optical scan systems. Besides the units themselves, many DRE systems use cards or tokens that must be physically secured. With optical scan equipment, the ballots must be physically secured. Further, if precinct-based tabulation is used with an optical scan system, the tabulation equipment must be protected from tampering. Running the election. Many implementation issues associated with running the election are associated with the interaction of voters with the technology. Although both DREs and optical scan systems are based on technologies that most voters will have encountered before, general familiarity is not enough to avoid voter errors. With optical scan, voter errors are generally related to improperly marked ballots: the wrong marking device, stray marks, too many marks (overvotes), and so on. As described already, DRE equipment is designed to minimize voter error (by preventing overvotes, for example), but problems can also occur with this voting method. For example, many DREs require the voter to push a cast vote button to record the vote. However, some voters forget to push this button and leave the polling place without doing so. Similarly, after pressing the final cast vote button, voters cannot alter their votes. In some cases, this button may be pressed by mistake--for example, a small child being held by a parent may knock or kick the final vote button before the parent has completed the ballot. The technology is not the only factor determining the outcome in these situations, as different jurisdictions have different rules and processes concerning such problems. In 2001, we reported that when voters forgot to press the cast vote button, one jurisdiction required that an election official reach under the voting booth curtain and push the cast vote button without looking at the ballot. However, another jurisdiction required that an election official invalidate the ballot and reset the machine for a new voter. Counting the votes. Finally, implementation of the processes for counting votes is affected both by the technology used and by local requirements. With DREs, votes are collected within each unit. Some contain removable storage media that can be taken from the voting unit and transported to a central location to be tallied. Others can be configured to electronically transmit the vote totals from the polling place to a central tally location. As described earlier, optical scan systems also vary in the way votes are counted, depending on whether precinct-based or centralized tabulation equipment is used. For optical scan systems, officials follow state and local regulations and processes to determine whether and how to count ballots that cannot be read by the tabulation equipment. Counting such ballots may involve decisions on how to judge voter intent, which are also generally governed by state and local regulations and processes. In addition, depending on the type of voting technology used, ways to perform recounts may differ. For optical scan devices, recounts can be both automatic and manual; as in the original vote counting, officials make decisions on counting ballots that cannot be read by the tabulation equipment and on voter intent. With DREs there is no separate paper ballot or record of the voter's intention, and therefore election officials rely on the information recorded in the machine's memory: that is, permanent (read only) electronic images of each of the "marked" ballots. The assurance that these images are an accurate record of the vote depends on several things, including the proper implementation of the processes involved in designing, maintaining, setting up, and using the technology. Jurisdictions Face Immediate and Longer Term Challenges in Leveraging Voting Technologies: In 2001, we identified four key challenges confronting local jurisdictions in effectively using and replacing voting technologies. These challenges are not dissimilar to those faced by any organization seeking to leverage modern technology to support mission operations. The first two challenges are particularly relevant in the near term, as jurisdictions look to position themselves for this year's national elections. The latter two are more relevant to jurisdictions' strategic acquisition and use of modern voting systems. Ensuring that Necessary Security, Testing, and Maintenance Activities Are Performed: Maximizing the performance of the voting systems that jurisdictions have and plan to use in November 2004 means taking proactive steps between now and then to best ensure that systems perform as intended. These steps include activities aimed at securing, testing, and maintaining these systems. We reported in 2001 that although the vast majority of jurisdictions performed security, testing, and maintenance activities in one form or another, the extent and nature of these activities varied among jurisdictions and depended on the availability of resources (financial and human capital) committed to them. The challenge facing all voting jurisdictions will be to ensure that these activities are fully and properly performed, particularly in light of the serious security concerns that have been reported with DREs. Managing the People, Processes, and Technology as Components of the Overall Process: As previously discussed in this testimony, jurisdictions need to manage the triad of people, processes, and technology as interrelated and interdependent parts of the total voting process. Given the amount of time that remains between now and the November 2004 elections, jurisdictions' voting system performance is more likely to be influenced by improvements in poll worker system operation training, voter education about system use, and vote casting procedures than by changes to the systems themselves.[Footnote 60] The challenge for voting jurisdictions is thus to ensure that these people and process issues are dealt with effectively. Having Reliable System Performance Measures and Objective Data: Reliable measures and objective data are needed for jurisdictions to know whether the technology being used is meeting the needs of the user communities (both the voters and the officials who administer the elections). In 2001, we reported that the vast majority of jurisdictions were satisfied with the performance of their respective technologies in the November 2000 elections. However, this satisfaction was mostly based not on objective data measuring performance, but rather on the subjective impressions of election officials. Although these impressions should not be discounted, informed decisionmaking on voting technology investment requires more objective data. The challenge for jurisdictions is to define measures and begin collecting data so that they can definitely know how their systems are performing. Ensuring That Technology Cost Is Commensurate with Benefits: Jurisdictions must be able to ensure that the technology will provide benefits over its useful life that are commensurate with life-cycle costs (acquisition as well as operations and maintenance) and that these collective costs are affordable and sustainable. In 2001, we reported that the technology type and configuration that jurisdictions employed varied depending on each jurisdiction's unique circumstances, such as size and resource constraints, and that reliable data on life- cycle costs and benefits were not available. The challenge for jurisdictions is to view and treat voting systems as capital investments and to manage them as such, including basing decisions on technology investments on clearly defined requirements and reliable analyses of quantitative and qualitative return on investment. In closing, I would like to say again that electronic voting systems are an undeniably critical link in the overall election chain. While this link alone cannot make an election, it can break one. The problems that some jurisdictions have experienced and the serious concerns being surfaced by security experts and others highlight the potential for difficulties in the upcoming 2004 national elections if the challenges that we cited in 2001 and reiterate in this testimony are not effectively addressed. Although the EAC only recently began operations and is not yet at full strength, it needs to remain vigilant in its efforts to ensure that jurisdictions and voters are educated and well- informed about the proper implementation and use of electronic voting systems, and to ensure that jurisdictions take the appropriate steps-- related to people, process, and technology--that are needed regarding security, testing, and maintenance. More strategically, the EAC needs to move swiftly to strengthen the voluntary voting system guidelines and the testing associated with enforcing these guidelines. Critical to the commission's ability to do this will be the adequacy of resources at its disposal and the degree of cooperation it receives from entities at all levels of government. Mr. Chairman, this concludes my statement. I would be pleased to answer any questions that you or other Members of the Subcommittee may have at this time. Contact and Acknowledgements: For further information, please contact Randolph C. Hite at (202) 512- 6256 or by e-mail at email@example.com. Other key contributors to this testimony were Barbara S. Collier, Deborah A. Davis, Richard B. Hung, John M. Ortiz, Jr., Maria J. Santos, and Linda R. Watson. FOOTNOTES  In this testimony, the term electronic voting system is used generically, to refer both to optical scan systems and direct recording electronic systems, both of which depend on electronic technology. Each type of system is described more fully in the Background section of this testimony.  For example, U.S. General Accounting Office, Elections: Perspectives on Activities and Challenges across the Nation, GAO-02-3 (Washington, D.C.: Oct. 15, 2001); Elections: Status and Use of Federal Voting Equipment Standards, GAO-02-52 (Washington, D.C.: Oct. 15, 2001); and Elections: A Framework for Evaluating Reform Proposals, GAO- 02-90 (Washington, D.C.: Oct. 15, 2001).  U.S. General Accounting Office, Elections: A Framework for Evaluating Reform Proposals, GAO-02-90 (Washington, D.C.: Oct. 15, 2001).  Pub. L. No. 107-252.  U.S. General Accounting Office, Elections: The Scope of Congressional Authority in Election Administration, GAO-01-470 (Washington, D.C.: Mar. 13, 2001).  U.S. General Accounting Office, Elections: Voting Assistance to Military and Overseas Citizens Should Be Improved, GAO-01-1026 (Washington, D.C.: Sept. 28, 2001).  U.S. General Accounting Office, Elections: Statistical Analysis of Factors That Affected Uncounted Votes in the 2000 Presidential Election, GAO-02-122 (Washington, D.C.: Oct. 15, 2001).  State differences may have included such factors as statewide voter education efforts, state standards for determining what is a valid vote, the use of straight party ballots, the number of candidates on the ballot, the use of provisional ballots, and the extent to which absentee or early voting occurred.  U.S. General Accounting Office, Voters with Disabilities: Access to Polling Places and Alternative Voting Methods, GAO-02-107 (Washington, D.C.: Oct. 15, 2001).  42 U.S.C. Sec. 1973ee-1.  U.S. General Accounting Office, Elections: Status and Use of Federal Voting Equipment Standards, GAO-02-52 (Washington, D.C.: Oct. 15, 2001).  Performance and Test Standards for Punchcard, Marksense, and Direct Recording Electronic Voting Systems (January 1990).  U.S. General Accounting Office, Elections: Perspectives on Activities and Challenges across the Nation, GAO-02-3 (Washington, D.C.: Oct. 15, 2001);  Absentee and early voting allows eligible persons to vote in person or by mail before election day.  U.S. General Accounting Office, Elections: A Framework for Evaluating Reform Proposals, GAO-02-90 (Washington, D.C.: Oct. 15, 2001).  The General Services Administration (GSA) is responsible for administering grants to the states to replace punch card systems and lever machines in qualifying states, including providing payments for general election administration improvements to states that apply for funds to replace voting equipment.  Kevin J. Coleman and Eric A. Fischer, Elections Reform: Overview and Issues, Congressional Research Service RS20898 (Washington, D.C.: Jan. 21, 2004).  Figures for the 2000 and 2004 elections are according to Election Data Services, Inc. Election Data Services, Inc., is a political consulting firm specializing in redistricting, election administration, and the analysis and presentation of census and political data.  Pub. L. 107-252, Sec. 102, provides federal funds to states for the systematic removal and replacement of punch card voting systems and lever voting systems in time for the regularly scheduled general election for federal offices to be held in November 2004; states that receive a certified waiver may extend their replacement time frame until the first election for federal office after January 1, 2006.  We reported that about 1 percent of registered voters used manually counted paper ballots in the 2000 elections. Election Data Services, Inc., reports that about 0.6 percent will use this method in the 2004 elections.  Precinct-count optical scan equipment sits on a ballot box with two compartments for scanned ballots--one for accepted ballots (i.e., those that are properly filled out) and one for rejected ballots (i.e., blank ballots, ballots with write-ins, or those accepted because of a forced override). In addition, an auxiliary compartment in the ballot box is used for storing ballots if an emergency arises (e.g., loss of power or machine failure) that prevents the ballots from being scanned.  According to spokespersons for national advocacy groups for people with disabilities, only a small percentage of blind people have the Braille proficiency needed to vote using a Braille ballot.  Using a mouth-held straw, the voter issues switch commands--hard puff, hard sip, soft puff, and soft sip--to provide signals or instructions to the voting machine.  Stanford University computer science professor David Dill was reported as saying "All of this just underscores the need for voting machines to have a paper trail." Dill runs Verified Voting, a group that is urging election officials and legislators to mandate voter- verified paper ballots as audit tools.  Tadayoshi Kohno, Adam Stubblefield, Aviel D. Rubin, and Dan S. Wallach, Analysis of an Electronic Voting System, Johns Hopkins University Information Security Institute, TR-2003-19 (July 2003).  Science Applications International Corporation, Risk Assessment Report, SAIC-6099-2003-261 (Sept. 2, 2003).  RABA Technologies, LLC, Trusted Agent Report (Jan. 20, 2004).  Caltech/MIT Voting Technology Project, Voting: What Is, What Could Be (July 2001). (http://www.vote.caltech.edu/Reports/2001report.html)  These strengths include the openness of the election process, which permits observation of counting and other aspects of election procedure; the decentralization of elections and the division among different levels of government and groups of people; equipment that produces "redundant trusted recordings" of votes; and the public nature and control of the election process.  Rachel Konrad, Legislators Wary of Electronic Voting, The Associated Press (Apr. 24, 2004).  John Schwartz, "High-Tech Voting Is Banned in California," New York Times (May 1, 2004).  Tim Reiterman, Stuart Pfeifer, and Jean O. Pasco, "State Is Urged to Ban Vote Machine," Los Angeles Times (Apr. 24, 2004).  Other related measures include S 1986, Protecting American Democracy Act of 2003; S 2045, Secure and Verifiable Electronic Voting Act of 2004; S2313, Restore Elector Confidence in Our Representative Democracy Act of 2004; and S 2437, Voting Integrity and Verification Act of 2004.  A companion to this bill in the Senate is S 1980.  The bill states that any voting system containing or using software shall disclose the source code of that software to the EAC, and the EAC shall make that source code available for inspection, upon request, to any citizen.  Following this hearing, which focused on DRE voting systems, the EAC held a second hearing on June 3, 2004, to focus on three other voting technologies: punch card and lever machines and optical scan voting equipment. The hearing addressed best practices, problems, and transitional issues associated with these systems. A major emphasis of the hearing was to identify practices that could be published and used by local election officials in preparation for the election of November 2, 2004.  For more information on the role of the federal government in the administration of elections, see U.S. General Accounting Office, Elections: The Scope of Congressional Authority in Election Administration, GAO-01-470 (Washington, D.C.: Mar. 13, 2001).  National Voter Registration Act of 1993, commonly known as the "Motor Voter" Act; 42 U.S.C. 1973gg to 1973gg-10.  Uniformed and Overseas Citizens Absentee Voting Act (1986); 42 U.S.C. 1973ff to 1973ff-6.  Voting Accessibility for the Elderly and Handicapped Act (1984); 42 U.S.C. 1973ee to 1973ee-6.  Voting Rights Act of 1965, 42 U.S.C. 1973 to 1973bb-1.  GAO-02-3.  We have described an effective security program as including, at a minimum, (1) assigning responsibility for security, (2) assessing security risks and vulnerabilities and implementing both manual and technology-based security measures to prevent or counter these risks, and (3) periodically reviewing the controls to ensure their appropriateness. For more information, see U.S. General Accounting Office, Executive Guide: Information Security Management, GAO/AIMD-98- 68 (Washington, D.C.: May 1998).  A firewall is a hardware or software component that protects computers or networks from attacks by outside network users by blocking and checking all incoming traffic.  In security systems, a token is small device that displays a constantly changing identification code; smart cards may perform a similar function.  GAO-02-3.  GAO-02-3. Confidence intervals were calculated at the 95 percent confidence level. Unless otherwise noted, all estimates from GAO's mail survey have a confidence interval of plus or minus 4 percentage points or less; all estimates from GAO's telephone survey have a confidence interval of plus or minus 11 percentage points or less.  DREs do not allow overvotes, so the figure for overvotes does not include jurisdictions that used DREs.  GAO-02-3.  GAO-02-3.  Cost estimates include capital costs only.  Systems are all those intended for preparing the voting system for use in an election; producing the appropriate ballot formats; testing that the voting system and ballot materials have been properly prepared and are ready for use; recording and counting votes; consolidating and reporting results; displaying results on site or remotely; and maintaining and producing audit trail information.  Prevoting operations include ballot preparation; the preparation of election-specific software or firmware; the production of ballots or ballot pages; the installation of ballots and ballot counting software or firmware; and system and equipment tests.  Voting operations include all operations conducted at the polling place by voters and officials, including the generation of status messages.  Postvoting operations include closing the polling place; obtaining reports by voting machine, polling place, and precinct (for central- count systems); obtaining consolidated reports; and obtaining reports of audit trails.  States and local jurisdictions may use the standards to baseline the minimum functional and performance requirements but may also impose other requirements to meet their needs (such as the type and number of languages that equipment should support, how a ballot needs to appear on a DRE screen, or options that allow persons with various types of disabilities to vote).  As of April 2004, the District of Columbia and 42 out of 50 states have regulations that require voting systems to meet federal standards, according to the Election Reform Information Project of the University of Richmond.  However, because the standards were not published until 1990 and the qualification testing program was not established until 1994, we judged in 2001 that many jurisdictions were probably using voting equipment that did not undergo qualification testing.  GAO-02-3.  Some system changes may be feasible, such as connecting DREs to printers.