Election Advisory No. 2012-03

Electronic Voting System Procedures

Pursuant to Section 122.001(c) of the Texas Election Code, the Office of the Secretary of State prescribes the following procedures for use of Electronic Voting Systems.

Acceptance Testing (Reference: Texas Election Code (TEC), Chapter 129.021).
1. The following tests should be performed at the local jurisdiction level upon voting system delivery from the vendor:
  1. Confirm that the system delivered is certified by the Texas Secretary of State Office;
    1. Verify model number and/or name of system;
    2. Verify software and/or firmware version;
  2. Perform a hardware diagnostic test of all equipment received; and
  3. Perform a Logic and Accuracy Test simulating a mock election for your jurisdiction, if this is a system your jurisdiction has never used.
Election Set-up and Definition (Reference: TEC, § 125).
1. Program and configure election management system software, direct recording electronic (DRE) voting machine, electronic ballot marker, optical scan, and any other devices used in an election, as applicable to your jurisdiction.
  1. Set different passwords for each election, as applicable;
  2. Replace and/or recharge batteries, if necessary.
2. Proofing the programming of your election for accuracy shall include, but not be limited to, the following:
  1. Verify races within each precinct;
  2. Verify precincts included in each ballot style;
  3. Verify candidates associated in each race;
  4. Verify party affiliation with candidates;
  5. Check for all contests on ballot and verify that candidate/proposition spelling is correct;
  6. Check contest order;
  7. Verify the correct number of votes allowed for each race;
  8. Verify that write-in positions are correct;
  9. If available, verify the audio ballot; and
  10. Verify straight-party associations to appropriate candidates in applicable elections.
3. As part of a Business Continuity and Disaster Recovery Plan, back-up your election programming at various stages of the election definition process.
  1. At a minimum, as soon as you finish the programming of your election and it’s been locked down, create a back-up copy for storage at a secure off-site location.
  2. If another entity does your programming, keep your own back-up copy at a secure off-site location that is in your control, not the programming entity’s control.
4. Election setup materials shall be secured by limiting access to the person or persons so authorized in writing by the county clerk and/or election official.
5. Any audit logs and ballot definition files created shall be included with retention material for that election.
Voting System Testing (Reference: TEC, Chapters 125, 127 and 129).
1. Three types of voting system testing shall be performed for each election within a jurisdiction. The three tests are:
  - A Hardware Diagnostic Test;
  - A Logic and Accuracy Test; and
  - A Post-Election Audit Test.
2. Hardware Diagnostic Test (Reference: TEC § 129.022).
  1. The general custodian of election records shall commence the Hardware Diagnostic Test prior to the election and allow time for each electronic voting device to be deployed, tested, repaired and/or replaced, if necessary. Each device shall be tested to verify that mechanical components are working correctly. This test shall include, but not be limited to, the following:
    1. All input and output devices;
    2. Communications ports;
    3. System printers;
    4. System modems, when applicable;
    5. System screen displays;
    6. Boot performance and initializations;
    7. Firmware and/or software loads;
    8. Confirmation that screen displays are functioning;
    9. Verify and adjust to correct date and time, if necessary;
    10. Verify and adjust calibration, if applicable;
    11. Confirm that the unit is cleared of votes;
    12. Confirm that it is configured for the current election; and
    13. Confirm that physical security devices are in working order (locks, seal hasps, etc.)
3. Logic and Accuracy Test (Reference: TEC, § 129.023)
  1. The designated general custodian of election records shall conduct a Logic and Accuracy Test according to the following requirements:
    1. The designated general custodian of election records shall create a Testing Board consisting of at least two persons. The general custodian of election records shall make every reasonable effort to ensure that the testing board consists of at least one person from each political party that holds a primary election.
    2. Prior to the commencement of voting and no later then 48 hours before voting begins on the equipment, the designated general custodian of election records shall conduct the public Logic and Accuracy Test. A public notice must be published at least 48 hours prior to the testing. (An internal L&A test should be done soon after the programming and proofing of your election is complete. This will provide you time to make corrections as necessary and be better prepared for the public L&A test.)
    3. The Public Logic and Accuracy Test shall be open to representatives of the press and the public. (Reference: TEC, § 129.023(b)).
    4. Test Ballots – In preparation for the Logic and Accuracy Test, the designated general custodian of election records shall design a method which directs the Testing Board to cast votes which will verify that each precinct, ballot style, and contest position on the ballot can be voted and is accurately counted.
      1. This can be done by marking test ballots or providing the Testing Board with some other form identifying how each test vote shall be cast. (We strongly recommend that you devise your own test ballots, rather than using the test deck provided by the vendor.)
      2. Optical scan test ballots must be prepared on the same ballot stock as the official ballots.
      3. The testing shall include overvotes and undervotes for each race and write-in votes, when applicable.
      4. The testing shall include straight party votes and crossover votes, as applicable.
      5. The testing shall include electronic processing of provisional votes, if applicable to the system being used.
      6. The testing shall be designed in a manner which provides a different number of vote totals for at least three candidates in races with more than two candidates, or each candidate in races with exactly two candidates.
      7. The predetermined results must be pre-calculated from the Test Ballots to allow comparison after the votes are tallied. (Reference: TEC, § 129.023(c)(10)).
    5. An appropriate number of voting devices will be available and the testing board may witness the necessary programming and/or downloading of memory devices necessary to test the specific precincts.
    6. Prior to the start of testing, all devices used will have the public counter reset to zero and presented to the testing board for verification.
    7. Conducting the Test.
      1. (DRE and AutoMARK Only) Manual vote choices are made by entering the votes indicated on the Test Ballot or designed form as stated above. To help prevent human error, all entries are made by a team of two people. One person calls out the votes and one person enters. Both team members verify the votes on the summary screen before the ballot is cast or printed.
      2. (DRE and AutoMARK Only) To test the audio, at a minimum, one set of vote choices will be entered using the audio feature. Both team members listen to the summary prior to casting or printing the ballot.
      3. (AutoMARK Only) Verify that the printed ballot reflects the choices entered on the AutoMARK. Also, if applicable, process the AutoMARK ballots with the optical scan equipment.
      4. (Optical Scan Only) Optical Scan Equipment must be tested as prescribed in TEC Ch. 127, Subchapters D and F. Pursuant to TEC § 127.094(e) the design of the test ballots must also include the design in Section 3(c)(i)(4) of this advisory.
      5. (Precinct Optical Scan and DRE Only) The Secretary Of State has determined that it is not feasible to conduct the 2nd and 3rd test on precinct tabulators as described in TEC § 127.152(b).
      6. For each feature of the system that allows disabled voters to cast a ballot, at least one vote must be cast and verified by a two-person testing board team using that feature; this includes, but is not limited to all audio functions, large font functionality, and sip-and-puff functionality. As a reminder, all components should be checked during the Hardware Diagnostic Test as well.
      7. Test the transmission of results by modem, if applicable.
      8. When all votes are cast, the designated general custodian of election records and Testing Board shall observe the tabulation of all test ballots and compare the results to the predetermined results.
      9. A test is successful if the results report of the electronic voting system matches the predetermined results. Best Practices Recommendation: The voting system should otherwise function properly during the counting of the test ballots.
      10. If the initial test is unsuccessful, the general custodian of election records shall prepare a written record of what caused the discrepancy and what actions have been taken to achieve a successful test. The record shall be retained with the test materials.
      11. The Testing Board and the general custodian of election records shall (i) sign a written statement attesting to the qualification of each device that was successfully tested, any problems discovered, and the cause of any problem if it can be identified, and (ii) provide any other documentation as necessary to provide a full and accurate account of the condition of a given device. We recommend that the number/characters of the seal attached to the voting device at the end of the test should be included in the written statement.
      12. Upon completion of the testing, the Testing Board shall witness and document all steps taken to reset, seal, and secure any equipment or test materials, as appropriate; and the general custodian of election records shall preserve a copy of the programming data used during the testing at a secure location that is outside the administrator’s and programming entity’s control until at least 22 months after election day.
    8. All test materials, when not in use, shall be kept in a container with a uniquely identified tamper-resistant or tamper-evident seal. The general custodian of election records and at least two members of the Testing Board shall sign the seal. (Reference: TEC § 129.024).
      1. The designated general custodian of election records shall be the custodian of the container.
      2. The container may not be unsealed unless the contents are necessary to conduct a test under Ch. 129, Subchapter B or a criminal investigation, election contest, or other official proceeding under the Election Code. If the container is unsealed, the general custodian of election records shall reseal the contents when not in use.(Reference: TEC § 129.024(c)).
      3. The test materials shall remain sealed for the period for preserving the precinct election records. (Reference: TEC § 129.024(b)).
4. Post-Election Audit (Partial Manual Count) (Reference: TEC, Chapter 127).
  1. This section does not apply to the tabulation of electronic voting system results for a voting system that uses direct recording electronic (DRE) voting machines.
  2. To ensure the accuracy of the tabulation of electronic voting system results, the general custodian of election records shall conduct a manual count of all the races in at least one percent of the election precincts or in three precincts, whichever is greater, in which the electronic voting system was used. The custodian shall select the precincts at random and shall begin the count not later than 72 hours after the polls close. The count shall be completed no later than the 21st day after Election Day. (TEC § 127.201(a)) (TEC § 127.201(b) supersedes this section to the extent of a conflict).\
  3. In a general election for state and county officers, primary election, or election on a proposed amendment to the state constitution or other statewide measure submitted by the legislature, the Secretary of State shall notify the election official, on the day after the election, of the selected precincts that must be manually counted. The election official shall begin the manual count within seventy-two (72) hours after the polls close. (TEC § 127.201(b)).
  4. On selection or notification, as applicable, of the precincts to be counted, the general custodian of election records shall post in the custodian’s office a notice of the date, hour, and place of the count. (TEC § 127.201(c)).
  5. The general custodian of election records is authorized to enter into the ballot box or container containing election records for the purpose of the partial manual count. When the count has been completed, the records shall be restored to their secured condition for the preservation period. (TEC § 213.007).
  6. Each candidate in the election is entitled to be present and to have a representative present. A representative must deliver a certificate of appointment to the general custodian at the time the representative reports for service. The certificate must be in writing and must include:
    1. The printed name and signature of the representative:
    2. The election subject to the count;
    3. The printed name and signature of the candidate making the appointment. (TEC § 127.201(d))
  7. At all times relevant to the count, the designated election official shall take every precaution necessary to protect the confidentiality and security of the ballots cast by the voters.
  8. Not later than the third day after the date the count is completed, the general custodian of election records shall deliver a written report of the results to the Secretary of State’s Office. (TEC § 127.201(e)) The report shall contain:
    1. The count of the specific race or races as provided on the summary report printed at the close of polls or the report generated for the audit;
    2. The count of the specific race as manually-verified;
    3. An explanation of any discrepancy found; and
    4. The signature of the general custodian of election records.
  9. The Secretary of State at any time may waive or reinstate the requirements of this section for a particular political subdivision.
  10. Conduct of Partial Manual Count for Optical Scan Equipment. The actual paper ballot will be hand counted for optical scan systems and verified to see if it matches the election results reported for that precinct.
  11. If there are discrepancies in the audit, the election official shall continue its audit until it determines the cause of the discrepancy.
Central Accumulator System Procedures, if applicable.
1. Testing Central Accumulator System (Reference: TEC, Chapter 127).
2. Election Night Verification when central accumulator system is used to consolidate the vote results.
  After uploading the precinct results to the central accumulator system, the election official must verify and document that the central accumulator’s record of number of votes cast matches the number of signatures on the combination form. If there is a discrepancy, the Presiding Judge of the Counting Station determines if a further audit is necessary.
3. Post-Election Verification when central accumulator system is used to consolidate the vote results.
  1. Prior to the canvass, the election official must verify that the vote total(s) printed at the precinct match the reports generated by the central accumulating system, for one percent of the election precincts or three election precincts, whichever is greater;
    1. The general custodian of election records has the discretion to verify a greater number of precincts than specified above; and
    2. The reconciliation shall consist of a race-by-race comparison by precinct of the number of votes reported on the precinct results tape to the central accumulator’s tabulation report.
  2. If there is any discrepancy in the comparison, the results tape from the precinct level shall constitute the official results.
  3. Any political subdivision that utilizes modem transfer of election results for the purpose of being combined with other such tabulations to produce complete returns shall establish procedures to reconcile received tabulations to transmitted tabulations so that no deviation can go undetected.
Voting System Security.
1. Personnel Security (Reference: TEC § 129.051(g)).
  1. Employees authorized by the county clerk or election official to prepare or maintain the voting system or election setup materials shall be deputized by the county clerk or election official for this specific purpose and so sworn, with the following oaths, prior to the first election of the calendar year in which they will be performing one or more of these activities.
    “I swear (or affirm) that I will faithfully perform my duty as an officer of the election and guard the purity of the election.” (Section 62.003 of TEC)
  2. The general custodian of election records shall conduct a criminal background check for relevant election officials, staff, and temporary workers upon hiring. For further information on this process, please see Election Advisory No. 2012-02.
2. Pre-election Security Procedure.
  1. All electronic media (e.g., memory cards, compact flash card, PCMCIA card, PEBs, voter card encoders, supervisor cards, and key cards) shall have an external permanent unique identifier (e.g., numbers, letters, or combination of numbers and letters). The identifier can be either etched or printed on a tamper resistant label. (Recommendation: include a barcode on the label, which will make it more efficient to inventory). (Reference: TEC § 129.051).
    1. The general custodian of election records shall create and maintain an inventory of all electronic information storage media.
    2. The general custodian of election records shall create a process and maintain a procedure for tracking the custody of electronic information storage media from their storage location, through election coding, through the election process, to their final post-election disposition and return to storage.
    3. The chain of custody must utilize two or more individuals to perform a check and verification check whenever a transfer of custody takes place.
  2. The general custodian of election records shall create and maintain a secured location for storing the electronic information storage media when not in use, for coding a medium for an election, for transferring and installing the medium into the voting system equipment, and for storing the voting system equipment once the election parameters are loaded.
    1. An election information storage medium shall be kept in the presence of an election official or in a secured location once the medium has been coded for an election.
    2. For each election, the general custodian of election records or their assigned staff shall seal each election information storage medium in its relevant voting device or container utilizing one or more uniquely identified tamper-resistant or tamper-evident seals.
      1. A combined master identification of the voting device equipment, the election information storage medium, and the seal(s) must be created and maintained.
      2. For election information storage medium that are device independent (e.g., PEBs, voter card encoders), these devices should be stored in a secured, sealed container and must also be identified on a master log.
    3. The general custodian of election records shall create a process and maintain a procedure for tracking the custody of the voting device equipment once the equipment is loaded with an election definition.
    4. The chain of custody must utilize two or more individuals to perform a check and verification check whenever a transfer of custody takes place.
  3. The general custodian of election records shall have in place a recovery plan that is to be followed should there be an indication of a security breach in the accountability and chain of custody procedures. The plan must include notifying the Secretary of State’s office immediately. Any indication of a security breach must be confirmed by more than one individual.
  4. The general custodian of election records shall have a training plan for relevant election officials and staff that addresses these security procedures and the relevant work instructions.
3. Storage and Transport of Voting System Equipment (Reference: TEC § 129.052).
  1. The general custodian of election records shall adopt procedures for securely storing and a secure method for transporting voting device equipment. This shall include procedures that are to be used at locations outside the direct control of the general custodian of election records, such as overnight storage at a polling location.
    1. Secure storage must employ the use of uniquely identified tamper-resistant or tamper-evident seals and logs, or other security measures that will detect any unauthorized access.
    2. For each election, the general custodian of election records shall create and maintain an inventory of these items for each storage location.
    3. The chain of custody must utilize two or more individuals to perform a check and verification check whenever a transfer of custody takes place or where the voting devices have been left unattended for any length of time. Particular attention must be given to the integrity of the tamper-resistant or tamper-evident seals.
    4. The general custodian of election records shall have a method of recording the names of the individuals who transport the voting system equipment and materials from one site to another and the time they left the sending site; and
    5. A method of recording the time the equipment transporters arrived at the receiving site and the name of the individual(s) at the receiving site who accepted the election equipment and material.
  2. The general custodian of election records shall have in place a written recovery plan that is to be followed should there be any indication of a security breach in the accountability and chain of custody procedures. The plan shall include immediately notifying the Secretary of State’s office. The plan must also address inadvertent damage to any seals or accountability/chain of custody documentation errors. These plans must be developed in a manner that enhances public confidence in the security and integrity of the election. Any indication of a security breach, documentation errors, or seal damage must be confirmed by more than one individual.
  3. The general custodian of election records shall have a training plan for relevant election officials, staff, and temporary workers that address these security procedures and the relevant work instructions.
4. Restrict Access to Voting Systems (Reference: TEC § 129.053).
  1. The general custodian of election records shall secure access control keys or passwords to voting system equipment. Use of access control keys or passwords must be witnessed by one or more individuals authorized to use that information. The use of an access control key or password must be documented and witnessed in a log dedicated for that purpose that is retained until the political subdivision disposes of the equipment.
    1. The general custodian of election records must maintain these access control keys/passwords in a secured and controlled environment. The persons with access to these items must be delineated in the relevant position descriptions.
    2. Changes to the encryption keys and passwords are at the discretion of the general custodian of election records, but it is advisable that this discretionary authority should not be delegated. However, the individuals(s) that implement the change must have this “authorization to change” responsibility delineated within their position descriptions(s). (Note the distinction relative to describing who may authorize a change, who implements a change, and who has access but cannot change the passwords and encryption keys.)
    3. Where appropriate, the degree of access should be defined within each relevant position description and maintained at that level within the election management system and/or equipment. This applies where a voting system can limit an individual’s access to certain menus, software modules, etc.
  2. An access log should be developed and utilized to document access to any device, election media, or election management system that requires the use of a password and/or encryption tool. If possible, access should be witnessed by one or more individuals authorized to use such information.
  3. The log should be retained throughout the life of the device or election management system.
  4. The general custodian of election records shall ensure the protection of the election tabulation process by securing the premises where the vote tabulation is being conducted and not allowing unauthorized and unescorted personnel to be in contact with tabulation equipment.
  5. The general custodian of election records shall have a training plan for relevant election officials, and staff that address these security procedures and the relevant work instructions.
5. Prohibit the Use of Network Connections and Restrictions on Wireless Technology (Reference: TEC § 129.054).
  1. No voting system shall be connected to any exterior communications network, including no connection to the Internet.
  2. A voting system may not have the capability of permitting wireless communication unless the system uses line-of-sight infrared technology that shields the transmitter and receiver from external infrared transmissions and the system can only accept transmissions generated by the system.
  3. The log should be retained throughout the life of the device or election management system.
6. Restrict Usage of Voting System Computers (Reference: TEC § 129.055).
  1. All voting system computer(s)/server(s) shall be restricted to the sole purpose of election administration, and not used for other purposes.
  2. Only the applicable operating system, commercial off-the-shelf software (COTS) needed for the election process, and the certified voting software shall be loaded on a voting system computer/server.
  3. Remote Access to a voting system computer/server is not allowed.
7. Plan for Machine Failure (Reference: TEC § 129.056).
  The general custodian of election records shall create a contingency plan for addressing direct recording electronic voting machine failure. This plan must include timely notification to the Secretary of State’s office.
Polling Place Preparation and Procedures.
1. Arrange the polling place to allow full view by presiding election judge and election clerks of voting and voter activity to guard against unauthorized access while protecting voter privacy.
2. The voting equipment must be in sight of the presiding election judge and/or an election clerk at all times while the election is being conducted.
3. Periodically check for evidence of tampering on voting equipment during the election. For example, make sure the uniquely identified tamper-resistant or tamper-evident seal is still intact. (Reference: TEC § 125.005).
4. Restrict/monitor physical access to equipment when the presiding election judge and election clerks are not present.
5. Secure Early Voting location and equipment to prevent theft or tampering after hours.
6. Equipment Failure during Voting.
  1. Procedures and plans shall be written for handling Election Day equipment failure, including backup and contingency plans. (See TEC § 125.006 for further details).
  2. If a DRE malfunctions during voting and there have been votes cast on that machine, extra precaution should be taken to protect the cast vote records (ballot images) and audit logs stored on that DRE. Secure the equipment and document the chain of custody when transporting the equipment to another location. (Reference: TEC § 125.006).
7. Opening the Polls.
  1. The presiding election judge shall verify and document the unique identifier (e.g., serial number) of the equipment delivered to the polling site.
  2. Look for evidence of tampering and document the time this was done.
  3. Verify that the Public Count is “0” on each applicable device.
  4. Check the accuracy of the date and time on applicable equipment.
  5. Confirm that all units are open for voting, as applicable; and
  6. At a minimum, print one zero tape from each applicable device, as follows:
    1. The presiding election judge, an election clerk, and not more than two watchers, if one or more watchers are present, shall sign the zero tape.
    2. Maintain zero tapes in a secure location to be returned with election materials (i.e., Ballot Box #4 or other secure means designated by the general custodian of election records).
8. Fleeing Voter.
  1. When a voter begins the process of making ballot selections but leaves without casting a vote on a DRE, a polling place official must cancel the electronic ballot and document the cancellation.
  2. When a voter leaves without fully depositing their paper ballot into the optical scanner or ballot box, this ballot must be treated as a spoiled ballot, and the presiding election judge or an election clerk shall cancel the ballot and document the cancellation.
9. Provisional Voter.
  1. Provisional votes may be cast electronically on a direct recording electronic voting system only if the system segregates provisional votes from regularly-cast votes on the election day precinct returns. Verify that no conditions are listed on the Secretary of State certification document for your system that would restrict the use of electronic provisional voting. (TAC § 81.176).
10. Curbside Voter.
  1. If the voter is physically unable to enter the polling place without assistance or likelihood of injury to the voter’s health, then the voter may vote at the curbside.
  2. A presiding election judge or election clerk shall deliver the voting device to the curbside voter.
  3. Make sure to allow the curbside voter the same privacy as a voter in the polling place.
11. Closing the Polls.
  1. Verify and document the Public Count on applicable devices.
  2. Verify that the public count(s) match the number of voters on the register.
  3. After the polls have been closed on Election Day, the precinct election officials shall print out, at a minimum, two copies of the results tape from each applicable device, and secure the voting device against further use. (WARNING: Do not print out the results tape during Early Voting; this includes the last day of Early Voting).
    1. The presiding election judge, an election clerk, and not more than two watchers, if one or more watchers are present, shall sign the results tape(s).
    2. The copies of the results tape(s) shall be distributed as follows:
      1. Envelope #3 that is delivered to the presiding election judge; and
      2. Ballot Box #4 (or other secure means designated) that is delivered to the general custodian of election records, along with other election media and materials.
    3. Lock and secure the voting equipment and other election material from any physical access to prepare for transport.
12. Early Voting Procedures.
  1. Opening the polls procedures above also apply to the 1st day of early voting.
  2. Opening the polls on the 2nd thru last day of early voting shall be handled as follows:
    1. Look for evidence of tampering and document the time this was done;
    2. Verify and document that the numbers on the public counter match the number of voters documented on the early voting by personal appearance roster at the close of polls on the previous day; and
    3. Confirm that all units are open for voting.
  3. Suspending and securing the Polls during Early Voting by personal appearance, except for the last day:
    1. Verify and document that the numbers on the public counter match the number of voters documented on the early voting by personal appearance roster at the close of polls on the previous day;
    2. Lock and secure voting equipment, so no additional votes may be cast on the voting equipment; and
    3. Restrict physical access to voting equipment.
  4. If the early voting device is being moved to another temporary location, the instructions listed in Sec. 5) c) of this document should be followed.
    1. Verify and document that the numbers on the public counter match the number of voters documented on the early voting by personal appearance roster at the close of polls on the previous day;
    2. Look for evidence of tampering and document the time this was done;
    3. DO NOT PRINT THE RESULTS TAPE; and
    4. Lock and secure the voting equipment and other election material from any physical access to prepare for transport.
Automatic Recount (Reference: TEC, Chapter 216).
1. An automatic recount must be conducted in an election requiring a plurality vote when two or more candidates for the same office tie for the number of votes required to be elected, unless the tying candidates cast lots to resolve the tie or one of them decides to withdraw.
2. An automatic recount must also be conducted in an election requiring a majority vote if more than two candidates tie for the highest number of votes or if two or more candidates tie for the second highest number of votes to determine who will be the runoff candidates before resorting to casting lots in order to resolve the tie.
3. An automatic recount must be held if the candidates in a runoff election tie before the tying candidates can cast lots to determine the winner.
4. The method of counting votes in an automatic recount is the same method of counting used in the election that resulted in the tie vote.
5. In order to initiate an automatic recount, the presiding officer of the canvassing authority shall request the recount in writing in the same manner as a recount petitioner, except that no deposit is filed with the request, and the cost of the recount is covered by the political subdivision.
Requested Recount on DRE Voting Systems (Pursuant to TEC § 214.071).
1. The candidate requesting a recount may request that the recount be done electronically or manually.
2. For an electronic recount, the persons specifically permitted by law to be present at the recount are also authorized to be present as the election media are reloaded into the central accumulator system.
3. For a manual recount of a DRE election, the Recount Coordinator shall organize the printing of cast vote records (ballot images) for the affected race or issue.
  1. The Recount Coordinator shall notify the parties in the recount of the date, place, and time the printing of cast vote records (ballot images) will take place.
  2. The full recount committee is not required to be present at the printing of cast vote records (ballot images) and the Recount Chair shall determine how many members should be present. The persons specifically permitted by law to be present at the recount are entitled to be present as the cast vote records (ballot images) are printed and to have the same number of representatives as allowed for the recount.
  3. If the manual recount does not take place immediately after the printing of the cast vote records (ballot images), the printed cast vote records (ballot images) shall be locked and secured until the recount takes place.
  4. A manual count of the printed cast vote records (ballot images) shall be conducted in the same manner as a recount of hand-counted paper ballots.
  5. After the recount is complete, the printed cast vote records (ballot images) shall be secured and preserved for the appropriate preservation period for maintaining election records.
Requested Recount on Optical Scan Voting Systems (See TEC, Chapter 214, Subchapter C).
Retention of election material.
1. Records created as part of an election must be retained for twenty-two months in a federal election (six months in a non-federal election). In addition to the instructions provided in TEC § 66.058, electronic records shall be secured in a locked container sealed with one or more uniquely identified tamper-resistant or tamper-evident seals that is logged. This includes, but is not limited to the following:
  1. Logic and Accuracy Test and results;
  2. Printed audits (Real-time audit log);
  3. Forms;
  4. Zero tapes;
  5. Results tapes; and
  6. Electronic Records:
    1. Ballot definitions;
    2. Cast vote records (ballot images), as applicable;
    3. Audit logs; and
    4. Election results.
2. The electronic files can be duplicated to another storage medium to meet the retention requirement and allow for the external memory store (compact flash card) to be reused in the next election. It is preferable that data be written to a read only Compact Disc (CD-R) rather than a read/write Compact Disc (CD-RW). A CD-R can only be written-to once and then you can only read from it. A CD-RW is a readable/writable disk and can be written-to more than once.
3. A minimum of two duplicates of the electronic data must be retained, labeled and stored in a secure manner where any opening could be detected, and each placed in a different locked area with restricted access.
4. An optical scanner used in early voting may be deployed for use on Election Day only if the system provides the capability to retain a copy of the audit log(s) showing the activity during early voting.
5. The optical scanner system must provide the capability to view and print the audit log(s) as needed to retain the records listed above.
6. A DRE used in early voting may not be re-deployed for use on Election Day.
7. Electronic data on a DRE, a DRE component and any external memory storage device used in conjunction with a DRE shall not be cleared until a backup of the electronic records has been performed. Also, the electronic data on a DRE and any external memory store shall be preserved for 10 days after Election Day unless the DRE is required for another election before that time expires. In that case, the results shall be preserved until the local canvass of the returns containing the election results from the DRE is complete and a backup of the electronic records has been done.
8. A DRE shall remain secure if, before the security period prescribed above expires, the DRE’s custodian receives a request to maintain security of the DRE for an extended period. This request must be in writing and signed by: (1) a person eligible to contest the election or obtain a recount; or (2) a public authority authorized to conduct a criminal investigation involving use of the DRE in the election or a person designated by the public authority to make the request.

Below are descriptions on how to backup electronic data from the various vendor products. Warning: When using a modem to send precinct results to the central counting station, only the results are transferred and not the cast vote records.

ES&S (Premier equipment only)

After tabulating and consolidating results, the central counting station manager shall prepare a CD-R which contains cast vote records, as well as vote totals, and a copy of the consolidated returns from election management system (GEMS). Open the election database in GEMS, click on Election in the menu bar and then click Backup. Follow the steps to create a unique file name for your backup, save and then copy the file to a CD.

ES&S

After the election, first backup all your election results by selecting Copy Results on the Miscellaneous menu in Election Reporting Manager (ERM). Select Copy All Results and click OK to continue. Select the letter for your floppy drive from the Output drive Letter list.

Enter the number of the reporting group from which you want to copy results in the Copy group box and merge it to group box, enter the number of the group with which you want to merge your copied results and click OK. Insert a blank disk in your floppy drive and click OK to copy your election results.

Additional steps to backup iVotronic data:

After you have completed the above steps, you are now ready to collect and import the cast vote records, audit log records and ballot definition files from each iVotronic to ERM by using the following steps (Reminder: PEBs used to upload results do not contain the cast vote record or other audit data needed for a complete backup):

Collect audit data from the iVotronic(s)

Refer to the Post-Election Tasks of your iVotronic operator’s manual for specific instructions on either “Collecting Audit Data to the Compact Flash Card with a Prepared PEB” or “Collecting Audit Data to the Compact Flash Card with the Upload option.” (Note: One compact flash card can hold data from multiple iVotronics)

Collecting audit data from an iVotronic compact flash card

In ERM point to Tabulators; then point to iVotronic – DRE. Point to Collect Audit Data on the submenu and select From Specified Drive. The Collect Audit Data Window appears.
Enter the drive letter of the compact flash card reader and specify the \ADT directory.
Click OK to transfer your results.
Insert your first compact flash card and click OK.
Select all the files listed and click OK to start the transfer.
Right-click the confirmation window and click the Eject icon that appears in order to safely remove the compact flash card.
Insert another compact flash card and continue or click Cancel after all cards have been transferred.

Backup of all the election files to a CD-R

Boot your computer into Windows and copy all files stored under \elecdata\<Election Name> directory to a CD-R.

Hart Voting System

In order to create a complete archive of the election that can be transferred to a CD-R, you must use SERVO to back up the cast vote records and internal audit logs from the JBCs, eSlates and eScans.

Before backing up, disconnect all eSlate batteries and verify that JBCs and eScans have no MBBs inserted.

– JBC backup
From SERVO’s “Backup and Reset Menu,” select “JBC” and the event associated with the data to be backed up. Using the Quatech or parallel cable, connect the SERVO computer to the JBC, and then power on the JBC. Click once on the box to the left of Download Logs under Backup Data. Wait ten seconds after you hear the “ding” to uncheck Download Logs, and then disconnect the cable from the JBC. Repeat for all JBCs. This process also stores the public serial number and the firmware version of the JBC in the SERVO database if it has not already been stored.

– eSlate backup
From SERVO’s “Backup and Reset Menu,” select “eSlate” and the event associated with the data to be backed up. Using the Quatech or parallel cable, connect the SERVO computer to a JBC, and then power on the JBC. Connect the JBC’s gray serial cable to the eSlate to be backed up; wait 12 seconds for the eSlate to fully power on, and then click once on the box to the left of Download Logs. Wait ten seconds after you hear the “ding” to uncheck Download Logs, and then disconnect the cable from the back of the eSlate. Repeat for all eSlates. This process also stores the public serial number and the firmware version of the eSlate in the SERVO database if it has not already been stored.

eScan backup
From SERVO’s “Backup and Reset Menu,” select “eScan” and the event associated with the data to be backed up. Using a crossover cable, connect the SERVO computer to the eScan’s “data” port, and then power on the eScan. Click once on the box to the left of Download Logs under Backup Data. Wait ten seconds after you hear the “ding” to uncheck Download Logs, and then disconnect the cable from the eScan. Repeat for all JBCs. This process also stores the public serial number and the firmware version of the eScan in the SERVO database if it has not already been stored.

Backup of all the election files to a CD-R
Follow instructions in your Hart Voting System Management & Tasks Training Manual or the Election Event User Guide to back up the SERVO database and other applicable databases, depending on the Hart Voting System features used.

Glossary
Audit Logs	Recorded information that allows election officials to view the steps that occurred on the equipment included in an election to verify or reconstruct the steps followed without compromising the ballot or voter secrecy.
Ballot Image	Electronically produced record of all votes cast by a single voter.
Cast Vote Record	Permanent record of all votes produced by a single voter whether in electronic or paper copy form. Used for counting votes. Also referred to as ballot image when used to refer to electronic ballots.
Central Accumulator System	Part of an Election Management System that tabulates and/or consolidates the vote totals for multiple precincts/devices.
Commercial Off-The-Shelf (COTS)	Commercial, readily available hardware devices (which may be electrical, electronic, mechanical, etc.; such as card readers, printers, or personal computers) or software products (such as operating systems, programming language compilers, database management systems, subsystems, components; software, etc.).
Data Storage Device	A device for storing data. It usually refers to permanent (non-volatile) storage, that is, the data will remain stored when power is removed from the device; unlike semiconductor RAM. Recording can be done mechanically, magnetically, or optically.
Direct Recording Electronic (DRE)	Voting system that records votes by means of a ballot display provided with mechanical or electro-optical components that can be actuated by the voter, that processes the data by means of a computer program, and that records voting data and cast vote records in internal and/or external memory components. It produces a tabulation of the voting data stored in a removable memory component and/or imprinted copy.
Election Management System	Set of processing functions and databases within a voting system that define, develop and maintain election databases, perform election definition and setup functions, format ballots, count votes, consolidate and report results, and maintain audit trails.
Firmware	Computer programs (software) stored in read-only memory (ROM) devices embedded in the system and not capable of being altered during system operation.
Logic and Accuracy Test	Testing of the tabulator setups of a new election definition to ensure that the content correctly reflects the election being held (i.e., contests, candidates, number to be elected, ballot styles, etc.) and that all voting positions can be voted for the maximum number of eligible candidates and that results are accurately tabulated and reported.
PCMCIA	Personal Computer Memory Card International Association – a portable computer card.
Public Counter	Counter in a voting device that counts the votes cast in a single election.
Results Tape	A Results Tape is the tape that is printed when the polls close. It is called a Results Tape since all contests and propositions are listed and have the resulting votes next to each name or question.
Voting Device	Any apparatus by which votes are registered electronically.
Voting System	The integrated mechanical, electromechanical, or electronic equipment and software required to program, control, and support the equipment that is used to define ballots; to cast and count votes; to report and/or display election results; and to maintain and produce all audit log information.
Zero Tape	A Zero Tape is the tape that is printed when the voting machine is first set up at the polls. It is called a Zero Tape since all contests or propositions should have zero votes next to each name or question.

KI:JW:id

Election Advisory No. 2012-03

Electronic Voting System Procedures

Acceptance Testing (Reference: Texas Election Code (TEC), Chapter 129.021).

Election Set-up and Definition (Reference: TEC, § 125).

Voting System Testing (Reference: TEC, Chapters 125, 127 and 129).

Central Accumulator System Procedures, if applicable.

Voting System Security.

Polling Place Preparation and Procedures.

Automatic Recount (Reference: TEC, Chapter 216).

Requested Recount on DRE Voting Systems (Pursuant to TEC § 214.071).

Requested Recount on Optical Scan Voting Systems (See TEC, Chapter 214, Subchapter C).

Retention of election material.

Below are descriptions on how to backup electronic data from the various vendor products. Warning: When using a modem to send precinct results to the central counting station, only the results are transferred and not the cast vote records.

ES&S (Premier equipment only)

ES&S

Hart Voting System