office of the secretary of state - new mexico secretary of state
TRANSCRIPT
Office of the Secretary of State
Report on ES&S Voting System Comprised of Unity 3.4.0.0 software, combined with existing M100 and M650
tabulators, as well as the newer model DS200 and DS850 tabulators Overview
Election Systems and Software (ES&S) applied to the State of New Mexico for certification of its Unity 3.4.0.0 software, to be operated in conjunction with New Mexico's existing inventory of M100 and M650 optical scan tabulators. Unity 3.4.0.0 is also proposed to operate with ES&S's newer generation of optical scan tabulators, the DS200 and the DS850. At the meeting of the Voting System Certification Committee (VSCC) held on June 24, 2013, the VSCC acknowledged receipt of the reports from the Federal Election Assistance Commission (EAC), which demonstrate that Unity 3.4.0.0, combined with the M100, M650, DS200 and DS850, meet the most recent Voluntary Voting System Guidelines (VVSG) issued by the EAC, as required by NMSA 1978, §1-9-14(A).
Although the M100’s and the M650’s were initially tested under the 2002 VVSG, it is important to note that these units were tested under the 2005 VVSG in conjunction with the certification of Unity 3.4.0.0, as shown by the Voting System Testing Lab report on file with the EAC. The VSCC has determined that the independent testing conducted through the EAC meets the requirement for independent testing set forth in NMSA 1978, §1-9-14(B). Those reports are posted on the Secretary of State's website. Additionally, the VSCC has been provided with all technical specifications, operating manuals and training manuals submitted by the vendor for these products. The following report provides information for the VSCC's consideration as to whether the ES&S Unity 3.4.0.0 software, in combination with ES&S's DS200 and DS850 optical scan tabulators, and New Mexico's existing inventory of ES&S M100 and M650 tabulators, conforms to the New Mexico Election Code, as required by NMSA 1978, §1-9-14(A).
The requirements of the New Mexico Election Code are as follows: 1-9-7.7. Voting systems; technical requirements.
2 |Unity 3.4.0.0
New Mexico requirement: Have a unique embedded internal serial number for audit purposes. Relationship to 2005 VVSG: This New Mexico requirement conforms to 2005 VVSG, 4.3.6 Product Marking, which requires that "All voting systems shall identify all devices by means of a permanently affixed nameplate or label containing the name of the manufacturer or vendor, the name of the device, its part or model number, its revision letter, its serial number, and if applicable, its power requirements. Response: This requirement applies to the M100, M650, DS200 and DS850. Each optical scan tabulator has a unique serial number given at the time of manufacture. (Please refer to the Unity 3.4.0.0 Voting System Training Lab (VSTL) Report). New Mexico requirement: Be supplied with a dust-and moisture-proof cover for transportation and storage purposes. Relationship to 2005 VVSG: This specific requirement is not contained in the 2005 VVSG. The guidelines provide in § 4.2.3 that voting systems shall "be capable of using, or be provided with, a protective enclosure rendering the equipment capable of withstanding (1) impact, shock and vibration loads associated with surface and air transportation, and (2) stacking loads associated with storage." Response: The M100, M650, DS200 and DS850 meet this requirement. (Please refer to the System Operating Procedures for each tabulator). New Mexico requirement: If the net weight of the system, or aggregate of voting device parts, is over twenty pounds, have self-contained wheels so that the system can be easily rolled by one person on rough pavement and can roll through a standard thirty-inch door frame. Relationship to 2005 VVSG: This requirement is more restrictive than the VVSG, which provides in §4.2.2 "There is no numerical limitation on the weight of any voting equipment, but the weight of each voting machine should be compatible with its intended use and the location at which the equipment is to be used.” Response: The M100, M650, DS200 and DS850 meet this requirement. (Please refer to the System Operating Procedures for each tabulator). The M100 ballot box contains wheels and the M650 cart has wheels. Both are designed to be easily moved and fit through a 30 inch door. The DS200 offers two ballot bin combinations. The DS200 plastic ballot bin is a configured two- piece unit where a poll worker places the DS200’s carrying case directly on top of a secure ballot bin to configure the system for voting. On the other hand, the DS200 metal ballot bin
3 |Unity 3.4.0.0
contains two independent ballot compartments for separating counted ballots and ballots including write-in votes. Both combinations include locking wheels. The weight of the DS200 is about 25 pounds. The weight of the carrying case is about 10 pounds. The weight of the plastic ballot box is 37 pounds. The weight of the metal ballot box without a ballot diverter is 103 pounds. The weight of the metal ballot box with a diverter is 107 pounds. New Mexico requirement: Be a stand-alone, non-networked election system such that all pre- election, Election Day and post-election events and activities can be recorded and retained in each device. Relationship to 2005 VVSG: Section 7.9.4 of the VVSG provides that "the printer shall not be permitted to communicate with any system or machine other than the voting machine to which it is connected. The printer shall only be able to function as a printer; it shall not contain any other services (e.g., provide copier or fax functions) or network capability. Response: Unity 3.4.0.0 software is configured in the stand-alone configuration and the M100, M650, DS200 and DS850 are stand-alone tabulators, such that all events and activities are recorded on the removable storage media resident on the tabulator. (Please refer to System Overview). New Mexico requirement: Employ scalable technology allowing easy enhancements that meet United States election assistance commission standards and state law. Relationship to 2005 VVSG: This requirement is not specifically found in the VVSG. Response: Unity 3.4.0.0 software and tabulators meet this requirement. (Please refer to the Unity 3.4.0.0 Voting System Testing lab (VSTL) Test Report). New Mexico requirement: Have ancillary equipment, such as printers, power sources, microprocessors and switch, and indicator matrices that are installed internally or are modular and transportable. Relationship to the 2005 VVSG: This requirement is not specifically found in the VVSG. Response: The M100, M650, DS200 and DS850 meet this requirement. (Please refer to the System Overview). The DS850 includes the following components:
Tabulator
Report Printer
Audit Printer The DS200 includes a 12-inch touch screen, providing voter and poll worker feedback, an internal thermal printer for generating machine totals and log reports, and a USB thumb drive for loading the election definitions and storing results. The M100 and M650 meet this requirement. All ancillary equipment is installed internally or is modular and transportable. New Mexico requirement: Display publicly the number of ballots processed. Relationship to 2005 VVSG: The 2005 VVSG, §2.1.8 Ballot Counter, requires for all voting systems that each piece of voting equipment that tabulates ballots shall provide a counter that:
A. can be set to zero before any ballots are submitted for tally; B. records the number of ballots cast during a particular test cycle or election; C. increases the count only by the input of a ballot; D. prevents or disables the resetting of the counter by any person other than authorized persons at authorized points; E. is visible to designated election officials.
Response: The M100, M650, DS200 and DS850 meet this requirement. (Please refer to the System Operating Procedures for each tabulator and the VSTL report). New Mexico Requirement: Be able to print. (1) an alphanumeric printout of the contests, candidates and vote totals when the polls are opened so that the poll workers can verify that the counters for each candidate are on zero. Relationship to 2005 VVSG: The 2005 VVSG, §5.4.3 In-process Audit Records, requires: "Critical system status messages other than informational messages displayed by the system during the course of normal operations. These items include, but are not limited to:
ii. The “zero totals” check conducted before opening the polling place or counting a precinct centrally."
Response: In regard to the M100, the certification report, or zero report, prints automatically when the polls are opened for voting on the machine. The zero report lists the date and time the polls open, followed by the vote count for all contests and blank signature lines for poll worker certification. The Model 100 allows for printing an additional certification report immediately after printing a results report.
5 |Unity 3.4.0.0
In regard to the M650, the System Operating Manual instructs poll workers to run a zero report. "Zero the scanner before you run Election Day ballots, and check your reports to ensure that all totals equal zero. The DS200 System Operating Manual gives instruction on how to print a zero tape. "Press Zero Report to reprint your zero report". The DS850 manual states that the Zero Report, which is printed before polls are open on Election Day, is used to indicate the vote totals have not been tampered with. New Mexico Requirement: An alphanumeric printout of the contests, candidates and vote totals at the close of the polls, which printouts shall contain the system serial number and public counter total. Relationship to the 2005 VVSG: The 2005 VVSG, §5.4.4 Vote Tally Data, provides that voting systems shall meet these reporting requirements by providing software capable of obtaining data concerning various aspects of vote counting and producing printed reports. At a minimum, vote tally data shall include:
A. Number of ballots cast, using each ballot configuration, by tabulator, by precinct, and by political subdivision;
B. candidate and measure vote totals for each contest, by tabulator; C. the number of ballots read within each precinct and for additional jurisdictional levels,
by configuration, including separate totals for each party in primary elections; D. separate accumulation of over votes and under votes for each contest, by tabulator,
precinct and for additional jurisdictional levels (no over votes would be indicated for DRE voting devices);
E. for paper-based systems only, the total number of ballots both able to be processed and unable to be processed; and if there are multiple card ballots, the total number of cards read.
In regard to systems that produce an electronic file containing vote tally data, the contents of the file shall include the same minimum data cited above for printed vote tally reports. Response: The M100, M650, DS200 and DS850 meet the above requirements. (Please refer to the System Operating Procedures for each tabulator and the Voting System Testing Lab (VSTL) report). New Mexico Requirement: Print as many copies of the alphanumeric printouts as necessary to satisfy state law.
6 |Unity 3.4.0.0
Relationship to the 2005 VVSG: This requirement is specific to state law and expressly stated in the 2005 VVSG. Response: The M100, M650, DS200 and DS850 meet the above requirements. (Please refer to the System Operating Procedures for each tabulator). The DS200 and DS850 operating manuals provide instructions on multiple print outs. These systems meet these requirements. The M100 and M650 meet the above requirements. Each has the capability to produce as many zero reports and results reports necessary to satisfy state law. New Mexico Requirement: Include a feature to allow reports to be sent to an electronic data file. Relationship to 2005 VVSG: The 2005 VVSG, Section 4.1.7.1, provides, "in voting systems that use storage media that can be removed from the system and transported to another location for readout and report generation, these media shall use devices with demonstrated error-free retention for a period of 22 months under the environmental conditions for operation and non- operation contained in Subsection 4.1.2.” Response: Unity 3.4.0.0 meets this requirement. (Please refer to Election Reporting Module (ERM) System Operating Procedures). The Operating Procedures instruct election officials on the process to export election results to ASCII format for export to UNIX or DOS based operating systems. 1-9-7.8. Voting systems; operational requirements. New Mexico requirement: Have internal application software that is specifically designed and engineered for the election application. Relationship to 2005 VVSG: This requirement is not specifically found in the 2005 VVSG. The VVSG provides: "7.4.4 Software Distribution, the vendor shall document all software including voting system software, third party software (such as operating systems and drivers) to be installed on the certified voting system, and installation programs. i) The documentation shall have a unique identifier (such as a serial number or part number) for the following set of information: documentation, software vendor name, product name, version, the certification application number of the voting system, file names and paths or other location information (such as storage addresses) of the software.” Response: Unity 3.4.0.0 software and tabulators are designed specifically for elections and meet this requirement. (Please refer to System Overview).
7 |Unity 3.4.0.0
New Mexico requirement: Include comprehensive diagnostics designed to ensure that failures do not go undetected. Relationship to the 2005 VVSG: Section 2.1.4 of the 2005 VVSG, provides: “To ensure system integrity, all systems shall: j. Include built-in measurement, self-test, and diagnostic software and hardware for detecting and reporting the system's status and degree of operability.” Response: Unity 3.4.0.0 software and tabulators have audit logs and meet this requirement. (Please refer to System Operating Procedures). In regard to the M100, the audit log lists all of the tabulator events that occur from the time the election definition PC card is loaded into the tabulator until the time it is removed after the polls close. The audit log also displays the total number of write-in votes counted by the tabulator as well as the number of accepted and rejected blank ballots, the number of over voted ballots and the number of crossover ballots scanned. In regard to the M650, the scanner generates reports to show up-to-the-minute totals by individual precinct, city, or by county. Final reports serve as unofficial election night results. The scanner also generates a time/date stamped audit log of scanner activities on a separate printer. In regard to the DS200, the Operating Manual instructs poll workers to press Event Log Report to print an audit log of the activity that has occurred on the scanner. Information such as the date and times when the system is initialized and when it prints reports appears on this report. The DS850 records errors and major events and tags these incidents with the date and time the incident occurred based on the DS850’s realtime clock settings. Audit log information can be exported to a USB flash drive inserted into a USB port on the DS850. New Mexico requirement: Have a real-time clock capable of recording and documenting the total time polls are opened. Relationship to the VVSG: The 2005 VVSG, § 2.1.5.1, requires “All systems shall include a real- time clock as part of the system’s hardware. The system shall maintain an absolute record of the time and date or a record relative to some event whose time and data are known and recorded." Response: The M100 and DS200 tabulators have a real-time clock and meet this requirement. The M650 and DS850 have real-time audit logs and met the requirement of the VVSG described above. (Please refer to System Operating Procedures and Voting System Testing Lab (VSTL) report).
8 |Unity 3.4.0.0
The M650 scanner generates reports to show up-to-the-minute totals by individual precinct, city, or by county. Final reports serve as unofficial election night results. The scanner also generates a time/date stamped audit log of scanner activities on a separate printer. The DS200 prints an audit log of the activity that has occurred on the scanner. Information such as the date and times when the system is initialized and when it prints reports appears on this report. The DS850 records errors and major events and tags these incidents with the date and time the incident occurred based on the DS850’s realtime clock settings. Audit log information can be exported to a USB flash drive inserted into a USB port on the DS850. New Mexico requirement: Have a self-contained, internal backup battery that powers all components of the system that are powered by alternating current power; and, in the event of a power outage in the polling place:
(1) the self-contained, internal backup battery power shall engage with no disruption of operation for at least two hours and with no loss of data; and
Relationship to the 2005 VVSG: Section 4.1.2.4 of the 2005 VVSG provides:
c. All voting machines shall also be capable of operating for a period of at least 2 hours on backup power, such that no voting data is lost or corrupted nor normal operations interrupted. When backup power is exhausted the voting machine shall retain the contents of all memories intact.
Response: The M100, M650, DS200 and DS850 meet this requirement. The M100 contains a standard 120-volt AC power cord to supply electricity to the tabulator. If a power outage occurs, the M100 contains an internal back-up battery that can run the tabulator for one to three hours, depending on tabulator activity. The tabulator stores accumulated totals to internal tabulator memory (DRAM) and to a removable PC card. The M650 contains a 3.6Vdc high energy lithium battery connected to the program card cage. The DS200 contains an external DC power supply, which plugs into a standard 120volt AC outlet and supplies power to the scanner. If a power outage occurs, the DS200 contains an internal backup battery that can run the scanner for a minimum of two hours, depending on scanner activity. For the DS850: To ensure 2 hours of uninterruptible power, election officials must use an Uninterruptible Power Supply (UPS) with the DS850. This will provide continuous power to the
9 |Unity 3.4.0.0
machine and to prevent the DS850 and the attached printers from being damaged in case of a power surge. New Mexico requirement: (2) the system shall maintain all vote totals, public counter totals and the internal clock time in the event that the main power and battery backup power fail. Relationship to the 2005 VVSG: Section 4.1.2.4 of the 2005 VVSG provides: “All voting machines shall also be capable of operating for a period of at least 2 hours on backup power, such that no voting data is lost or corrupted nor normal operations interrupted. When backup power is exhausted the voting machine shall retain the contents of all memories intact.” Response: All tabulators have backup batteries tested to maintain at least two hours of operation and meet the above requirements. (Please refer to System Operating Procedures for each tabulator). The M100 stores accumulated totals to internal tabulator memory (DRAM) and to a removable PC card so that it maintains all vote totals, public counter totals and internal clock time in the event of a complete power failure. The M650 backup and recovery system automatically saves vote totals in case of a power failure or machine failure. The M650 requires a backup generator at the central count location to continue scanning if a power failure occurs. The DS200 uses a USB flash drive to store the scanner’s election definition, audit log and other electionspecific information. Data on the USB flash drive is updated each time the DS200 scans a ballot. The USB flash drive maintains all vote totals, public counter totals, and internal clock time in the event of a complete power failure. The DS850 records errors and major events and tags these incidents with the date and time the incident occurred based on the DS850’s realtime clock settings. Audit log information can be exported to a USB flash drive inserted into a USB port on the DS850. 1-9-7.9. Voting systems; memory; removable storage media device; requirements. New Mexico requirement: Be programmable with removable storage media devices. Relationship to the 2005 VVSG: Section 4.1.7.1 Removable Storage Media provides: "In voting systems that use storage media that can be removed from the system and transported to another location for readout and report generation, these media shall use devices with demonstrated error-free retention for a period of 22 months under the environmental conditions for operation and non-operation contained in Subsection 4.1.2.
10 |Unity 3.4.0.0
Examples of removable storage media include: programmable read-only memory (PROM), random access memory (RAM) with battery backup, magnetic media or optical media." Response: All tabulators meet the above requirements. (Please refer to System Operating Procedures for each tabulator). The M100 uses PCMCIA cards to store the tabulator’s election definition, audit log and other election-specific information. Data on the PC card exists in one sequential block, which is updated each time the M100 scans a ballot. The M650 utilizes a zip drive to provide for removable media storage. The DS200 stores election results on a removable USB flash drive that is used to transfer scanner results to Election Reporting Manager after the polls close. The DS850 allows for the use of a removable USB flash drive to transfer scanner results. New Mexico requirement: Contain ballot control information, summary vote totals, maintenance logs and operator logs on the removable storage media device. Response: All tabulators meet the above requirements. (Please refer to System Operating Procedures for each tabulator). The removable media storage devices described above all contain ballot control information, summary vote totals, maintenance logs and operator logs. New Mexico requirement: Ensure that the votes stored on the removable storage media device accurately represent the actual votes cast. Relationship to the 2005 VVSG: Section 2.1.2 Accuracy, requires: “Memory hardware, such as semiconductor devices and magnetic storage media, must be accurate. The design of equipment in all voting systems shall provide for the highest possible levels of protection against mechanical, thermal, and electromagnetic stresses that impact system accuracy. Section 4 provides additional information on susceptibility requirements. To ensure vote accuracy, all systems shall:
A. Record the election contests, candidates, and issues exactly as defined by election officials;
B. record the appropriate options for casting and recording votes; C. record each vote precisely as indicated by the voter and produce an accurate report
of all votes cast; D. include control logic and data processing methods incorporating parity and
11 |Unity 3.4.0.0
checksums (or equivalent error detection and correction methods) to demonstrate that the system has been designed for accuracy; E. provide software that monitors the overall quality of data read-write and transfer quality status, checking the number and types of errors that occur in any of the relevant operations on data and how they were corrected.”
Response: All tabulators meet the above requirements. (Please refer to System Operating Procedures and VSTL for each tabulator). New Mexico Requirement: Be designed so that no executable code can be launched from random access memory. Relationship to the 2005 VVSG: Section 5.2.2 Software Integrity provides: "Self-modifying, dynamically loaded or interpreted code is prohibited, except under the security provisions outlined in Subsection 7.4. This prohibition is to ensure that the software tested and approved during the certification process remains unchanged and retains its integrity. External modification of code during execution shall be prohibited. Where the development environment (programming language and development tools) includes the following features, the software shall provide controls to prevent accidental or deliberate attempts to replace executable code:
a. unbounded arrays or strings (includes buffers used to move data); b. pointer variables; c. dynamic memory allocation and management.”
Response: All tabulators meet this requirement. The data is binary and the vendor uses Checksum to verify the data has not been modified. In addition, there is a check for authorized/certified USB media that will detect if an unauthorized stick is attempted to be used. (Please refer to Unity 3.4.0.0 VSTL Test Report). New Mexico requirement: Have any operating system software stored in nonvolatile memory, which shall include internal quality checks such as parity or error detection and correction codes, and which software shall include comprehensive diagnostics to ensure that failures do not go undetected. Relationship to the 2005 VVSG: Section 2.1.4 of the 2005 VVSG, provides: “To ensure system integrity, all systems shall: j. Include built-in measurement, self-test, and diagnostic software and hardware for detecting and reporting the system's status and degree of operability.”
12 |Unity 3.4.0.0
Response: The operating system for the tabulators is stored in non-volatile memory on each unit and meets this requirement. Each unit undergoes an integrity check when turned on. (Please refer to Unity 3.4.0.0 VSTL Test Report). New Mexico Requirement: Allow for pre-election testing of the ballot control logic and accuracy, with results stored in the memory that is used on Election Day, and shall be capable of printing a zero-results printout prior to these tests and a results printout after the test. Relationship to the 2005 VVSG: Voting systems must provide for logic and accuracy testing, which is defined as: logic and accuracy testing: Testing of the tabulator setups of a new election definition to ensure that the content correctly reflects the election being held (i.e., contests, candidates, number to be elected, ballot styles) and that all voting positions can be voted for the maximum number of eligible candidates and that results are accurately tabulated and reported. Response: Unity 3.4.0.0 and the tabulators meet this requirement. (Please refer to System Operating Procedures). See above. New Mexico Requirement: Have internal audit trail capability such that all pre-election, election day and post-election events shall be stored, recorded and recovered in an easy-to- read printed form and be retained within memory that does not require external power for memory retention. Relationship to 2005 VVSG: Section 2.1.5.1 of the 2005 VVSG provides: “Audit records shall be prepared for all phases of election operations performed using devices controlled by the jurisdiction or its contractors. These records rely upon automated audit data acquisition and machine-generated reports, with manual input of some information. These records shall address the ballot preparation and election definition phase, system readiness tests, and voting and ballot-counting operations. The software shall activate the logging and reporting of audit data as described below.” Response: Unity 3.4.0.0 software and tabulators have audit logs which can be printed and exported and meet this requirement. (Please refer to System Operating Procedures). The four tabulators under consideration meet this requirement. As shown above, the audit log lists all of the tabulator events that occur from the time the election definition PC card is loaded into the tabulator until the time it is removed. This information is retained in memory in the event of a complete power failure. The audit logs are stored and recorded on the removable storage media, and can be recovered and printed from that media.
13 |Unity 3.4.0.0
New Mexico Requirement: Possess the capability of remote transmission of election results to a central location only by reading the removable storage media devices once they have been removed from the tabulation device after the poll closing sequence has been completed; and Relationship to the 2005 VVSG: As set forth above, the 2005 VVSG does not require that all certified voting systems use removable storage media devices. Response: The Unity 3.4.0.0 system meets this requirement. (Please refer to System Operating Procedures). Election data cannot be remotely transmitted directly from a tabulator. Results can only be transmitted after the poll closing sequence has been completed. New Mexico Requirement: Prevent data from being altered or destroyed by report generation or by the transmission of results. Relationship to the 2005 VVSG: Section 2.4.3 Producing Reports, provides: "All systems shall be able to create reports summarizing the vote data on multiple levels. All systems shall provide capabilities to... (g.) prevent data from being altered or destroyed by report generation, or by the transmission of results over telecommunications lines.” Response: Report generation and transmission of results does not affect data. (Please refer to Unity 3.4.0.0 Voting System Testing Lab (VSTL) Test Report).
1-9-7.10. Voting systems; ballot handling and processing requirements.
New Mexico Requirement: Accept a ballot that is a minimum of six inches wide and a maximum of twenty-four inches long, in dual columns and printed on both sides; Relationship to 2005 VVSG: This requirement is not found in the 2005 VVSG. Response: The following table shows the ballot sizes which can be generated by Unity 3.4.0.0 and accepted by the four tabulators which are part of this certification: Ballot Target Limits for Paper Ballots STANDARD BALLOT SIZES
VOTING POSITIONS PER COLUMN/SIDE
8½ x 11 (4 ovals per inch) 36 rows x 3 columns = 108 per side 8½ x 14 (3 ovals per inch) 36 rows x 3 columns = 108 per side 8½ x 14 (4 ovals per inch) 48 rows x 3 columns = 144 per side 8½ x 17 (3 ovals per inch) 41 rows x 3 Columns = 123 per side 8½ x 17 (3 ovals per inch) 45 rows x 3 columns = 135 per side 8½ x 17 (4 ovals per inch) 60 rows x 3 columns = 180 per side 8½ x 19 (3 ovals per inch) 51 rows x 3 columns = 153 per side 8½ x 19 (4 ovals per inch) 68 rows x 3 columns = 204 per side
14 |Unity 3.4.0.0
(Please refer to the Unity 3.4.0.0 Overview documentation). New Mexico requirement: Accept a ballot in any orientation when inserted by a voter. Relationship to 2005 VVSG: The 2005 VVSG does not contain this requirement. Response: The precinct level tabulators, the M100 and DS200, can scan ballots inserted in any direction or orientation by the voter. The M650 and DS850 do not involve ballot inserted by a voter. New Mexico requirement: Have the capability to reject a ballot on which a voter has made more than the allowable number of selections in any contest. Relationship to the 2005 VVSG: Section 2.3.3.2 Paper-based System Requirements, provides that all paper-based systems shall:
1. Provide feedback to the voter that identifies specific contests for which he or she has made no selection or fewer than the allowable number of selections (e.g., undervotes)
2. Notify the voter if he or she has made more than the allowable number of selections for any contest (e.g., overvotes)
3. Notify the voter before the ballot is cast and counted of the effect of making more than the allowable number of selections for a contest
4. Provide the voter opportunity to correct the ballot for either an undervote or overvote before the ballot is cast and counted
Response: The M100 will use one of the following methods for accepting or rejecting blank ballots, overvotes, and crossover votes:
* Unconditional acceptance: The tabulator accepts and tabulates results for all ballots. The tabulator automatically sorts questioned ballots without storing results from those ballots. While scanning the ballot, the message PROCESSING BALLOT - PLEASE WAIT… will appear. Once the ballot is scanned, the message THANK YOU FOR VOTING appears. Then the message INSERT BALLOT - NUMBER OF VOTERS: appears.
* Unconditional rejection: The Model 100 automatically rejects crossover, overvoted or
blank ballots. Voters must review and correct ballot selections before the tabulator will accept the ballot.
In regard to the M650, the ballot scanner can sort blank, over-voted, under-voted, crossover and write-in ballots from regular ballots. The scanner does not tabulate blank, over-voted, under-voted and crossover ballots when they are sorted. The scanner will only tabulate sorted
15 |Unity 3.4.0.0
write-in ballots if the election definition contains the option to tabulate write-ins. The scanner lists this option on the ready report, which prints automatically when you start the scanner. To sort blank, over-voted and write-in ballots, the election official will select the appropriate options in the SORT section of the control panel. Any or all of the sort options may be selected. The DS200 will use one of the following methods for accepting or rejecting blank ballots, overvotes and undervotes:
Unconditional acceptance: The scanner accepts and tabulates results for all ballots. Any contests that are blank, overvoted or undervoted will be logged as such and the remaining contests will be tabulated appropriately.
Unconditional rejection: The DS200 automatically rejects undervoted, overvoted or blank ballots. Voters must review and correct ballot selections before the scanner will accept the ballot.
Query the voter for correction: The DS200 returns a questioned ballot to the voter and displays a screen message that describes the problem and prompts the voter to either review and edit the ballot or cast the ballot as it is. The voter presses Don’t Cast - Return Ballot to correct the ballot or presses Cast Ballot to cast the ballot without editing selections. Once ACCEPT is pressed, the message Thank you for voting. Your ballot has been counted appears.
DS850: The Sort Settings option allows the election official to specify whether ballots with writeins are to be processed and into which output bin they are to be diverted. It also allows the official to specify whether undervotes, overvotes, crossovers, blank ballots, and ballots with unclear marks are to be processed. New Mexico Requirement: Be designed to accommodate the maximum number of ballot styles or ballot variations encountered in the largest New Mexico election jurisdiction. Relationship to 2005 VVSG: This requirement is state-specific and is not found the 2005 VVSG. New Mexico Requirement: Be able to read a single ballot with at least four hundred twenty voting positions. Relationship to 2005 VVSG: Section 2.2.1.1 General Capabilities, provides: “All systems shall provide the general capabilities for ballot preparation. All systems shall be capable of… supporting the maximum number of potentially active voting positions as indicated in the system documentation.”
16 |Unity 3.4.0.0
Response: The following table demonstrates the number of ballot styles which can be generated by Unity 3.4.0.0: Characteristics Limit
Maximum precincts allowed in an election
2900 (1639 if using paper ballot coded by precinct)
Maximum Precincts included per poll (reporting limit)
1900
21,0001
Depends on election content (limited by 21,000 maximum counters)2
Maximum candidate counters allowed per precinct
10003
Maximum ballot styles allowed 99 specified ballot styles OR all ballot styles defined in per precinct the election unless otherwise limited by the tabulator
Maximum ballot styles allowed per election
or BMD memory 5500 (1639 if using paper ballot coded by style)
Maximum contests allowed per 200 or # of positions on ballot ballot style
Maximum precincts allowed per ballot style
1500
175
PROCESSING FREQUENCY
Model 100 Estimated maximum throughput in a real world environment – where mismarked, torn or folded ballots are occasionally rejected – to be about three voters per minute (20 seconds per voter), which adds up to 2700 ballots per terminal over the course of a 15-hour counting period.
Maximum throughput in a test environment with a single user feeding ballots into the machine with no rejections is an average of ten ballots per minute for a 19- inch ballot and fourteen ballots per minute for an 11- inch ballot. This rate computes to 600 to 840 ballots per hour, or 9000 to 12,600 for a 15-hour day.
The Model 100 ballot box holds up to 2800 paper ballots. Standard PC Card size for the Model 100 is 512 MB, with larger capacity cards commercially available. The number of ballot records that can be stored to this card depends on the size of the election.
18 precincts per M100, 40 styles per precinct
10 seconds per voter
17 |Unity 3.4.0.0
DS200 Estimated maximum throughput in a real world environment – where mismarked, torn or folded ballots are occasionally rejected – to be between 2 and 3 voters per minute, which adds up to approximately 2300 ballots per terminal over the course of a 15-hour counting period.
Maximum throughput in a test environment with a single user feeding ballots into the machine with no rejections is an average of 2.5 ballots per minute. This rate computes to 153 ballots per hour or a maximum of 2300 ballots for a 15-hour day.
The DS200 ballot box holds up to 2800 paper ballots. Supported USB Flash Drives for the DS200 start at 512 MB, with larger sizes available. The number of ballot records that can be stored to Flash media depend on the capacity of the Flash drive and size of the loaded election.
18 precincts per DS200, 40 styles per precinct
20 seconds per voter
Model 650 Estimated maximum throughput in a real world environment – where mismarked, torn or folded ballots are occasionally rejected –200 per minute, which adds up to 12000 ballots per hour. This will depend on the efficiency of the operator and processes.
Maximum throughput in a test environment feeding ballots into the machine with no rejections is an average of 275 per minute for a 19- inch ballot and 325 per minute for an 11-inch ballot. This rate computes to 16500 to 19500 ballots per hour.
The Model 650 holds a stack of up to 400 in both the input and output trays
100 per precinct 5 every 1 second.
DS850 DS850 can divert sorted ballots to bins without pausing operation. The input hopper holds up to 480 standard ballots and scans approximately 365 11-inch ballots per minute.
Approximately 365 11-inch ballots per minute. Throughput rate decreases with increased ballot lengths.
The ES&S DS850 input hopper and main output hopper each hold up to 480 standard sized ballots. Each outstack bin holds approximately 150 ballots. The DS850 is equipped with a 1TB hard drive that can hold more than 5 million ballot images and related data.
9990 precincts, 40 ballot styles per precinct in a ballots by style election
Between 5 and 6 ballots per second depending on ballot length.
ES&S AutoMARK Expected real-world ballot marking speed is 1.5 minutes for a sighted voter and 2.5 minutes for a voter with low or no vision.
Maximum ballot marking throughput speed in test mode is estimated at 2.5 minutes per ballot (filling all positions).
Does not apply. The AutoMARK marks a single ballot at a time. The system does not store or process vote totals and has no memory capacity limitations once programmed with an election definition.
6400 1-20 minutes per voter. Estimated average at 8 ballots per hour at maximum capacity.
1-9-7.11. Voting systems; source code; escrow. New Mexico requirement: As a condition of initial certification and continued certification, the source code that operates a voting system shall be placed in escrow and be accessible to the
18 |Unity 3.4.0.0
Report on ES&S Voting System Comprised of Unity 3.4.0.0 software, combined with existing M100 and M650
tabulators, as well as the newer model DS200 and DS850 tabulators Overview
Election Systems and Software (ES&S) applied to the State of New Mexico for certification of its Unity 3.4.0.0 software, to be operated in conjunction with New Mexico's existing inventory of M100 and M650 optical scan tabulators. Unity 3.4.0.0 is also proposed to operate with ES&S's newer generation of optical scan tabulators, the DS200 and the DS850. At the meeting of the Voting System Certification Committee (VSCC) held on June 24, 2013, the VSCC acknowledged receipt of the reports from the Federal Election Assistance Commission (EAC), which demonstrate that Unity 3.4.0.0, combined with the M100, M650, DS200 and DS850, meet the most recent Voluntary Voting System Guidelines (VVSG) issued by the EAC, as required by NMSA 1978, §1-9-14(A).
Although the M100’s and the M650’s were initially tested under the 2002 VVSG, it is important to note that these units were tested under the 2005 VVSG in conjunction with the certification of Unity 3.4.0.0, as shown by the Voting System Testing Lab report on file with the EAC. The VSCC has determined that the independent testing conducted through the EAC meets the requirement for independent testing set forth in NMSA 1978, §1-9-14(B). Those reports are posted on the Secretary of State's website. Additionally, the VSCC has been provided with all technical specifications, operating manuals and training manuals submitted by the vendor for these products. The following report provides information for the VSCC's consideration as to whether the ES&S Unity 3.4.0.0 software, in combination with ES&S's DS200 and DS850 optical scan tabulators, and New Mexico's existing inventory of ES&S M100 and M650 tabulators, conforms to the New Mexico Election Code, as required by NMSA 1978, §1-9-14(A).
The requirements of the New Mexico Election Code are as follows: 1-9-7.7. Voting systems; technical requirements.
2 |Unity 3.4.0.0
New Mexico requirement: Have a unique embedded internal serial number for audit purposes. Relationship to 2005 VVSG: This New Mexico requirement conforms to 2005 VVSG, 4.3.6 Product Marking, which requires that "All voting systems shall identify all devices by means of a permanently affixed nameplate or label containing the name of the manufacturer or vendor, the name of the device, its part or model number, its revision letter, its serial number, and if applicable, its power requirements. Response: This requirement applies to the M100, M650, DS200 and DS850. Each optical scan tabulator has a unique serial number given at the time of manufacture. (Please refer to the Unity 3.4.0.0 Voting System Training Lab (VSTL) Report). New Mexico requirement: Be supplied with a dust-and moisture-proof cover for transportation and storage purposes. Relationship to 2005 VVSG: This specific requirement is not contained in the 2005 VVSG. The guidelines provide in § 4.2.3 that voting systems shall "be capable of using, or be provided with, a protective enclosure rendering the equipment capable of withstanding (1) impact, shock and vibration loads associated with surface and air transportation, and (2) stacking loads associated with storage." Response: The M100, M650, DS200 and DS850 meet this requirement. (Please refer to the System Operating Procedures for each tabulator). New Mexico requirement: If the net weight of the system, or aggregate of voting device parts, is over twenty pounds, have self-contained wheels so that the system can be easily rolled by one person on rough pavement and can roll through a standard thirty-inch door frame. Relationship to 2005 VVSG: This requirement is more restrictive than the VVSG, which provides in §4.2.2 "There is no numerical limitation on the weight of any voting equipment, but the weight of each voting machine should be compatible with its intended use and the location at which the equipment is to be used.” Response: The M100, M650, DS200 and DS850 meet this requirement. (Please refer to the System Operating Procedures for each tabulator). The M100 ballot box contains wheels and the M650 cart has wheels. Both are designed to be easily moved and fit through a 30 inch door. The DS200 offers two ballot bin combinations. The DS200 plastic ballot bin is a configured two- piece unit where a poll worker places the DS200’s carrying case directly on top of a secure ballot bin to configure the system for voting. On the other hand, the DS200 metal ballot bin
3 |Unity 3.4.0.0
contains two independent ballot compartments for separating counted ballots and ballots including write-in votes. Both combinations include locking wheels. The weight of the DS200 is about 25 pounds. The weight of the carrying case is about 10 pounds. The weight of the plastic ballot box is 37 pounds. The weight of the metal ballot box without a ballot diverter is 103 pounds. The weight of the metal ballot box with a diverter is 107 pounds. New Mexico requirement: Be a stand-alone, non-networked election system such that all pre- election, Election Day and post-election events and activities can be recorded and retained in each device. Relationship to 2005 VVSG: Section 7.9.4 of the VVSG provides that "the printer shall not be permitted to communicate with any system or machine other than the voting machine to which it is connected. The printer shall only be able to function as a printer; it shall not contain any other services (e.g., provide copier or fax functions) or network capability. Response: Unity 3.4.0.0 software is configured in the stand-alone configuration and the M100, M650, DS200 and DS850 are stand-alone tabulators, such that all events and activities are recorded on the removable storage media resident on the tabulator. (Please refer to System Overview). New Mexico requirement: Employ scalable technology allowing easy enhancements that meet United States election assistance commission standards and state law. Relationship to 2005 VVSG: This requirement is not specifically found in the VVSG. Response: Unity 3.4.0.0 software and tabulators meet this requirement. (Please refer to the Unity 3.4.0.0 Voting System Testing lab (VSTL) Test Report). New Mexico requirement: Have ancillary equipment, such as printers, power sources, microprocessors and switch, and indicator matrices that are installed internally or are modular and transportable. Relationship to the 2005 VVSG: This requirement is not specifically found in the VVSG. Response: The M100, M650, DS200 and DS850 meet this requirement. (Please refer to the System Overview). The DS850 includes the following components:
Tabulator
Report Printer
Audit Printer The DS200 includes a 12-inch touch screen, providing voter and poll worker feedback, an internal thermal printer for generating machine totals and log reports, and a USB thumb drive for loading the election definitions and storing results. The M100 and M650 meet this requirement. All ancillary equipment is installed internally or is modular and transportable. New Mexico requirement: Display publicly the number of ballots processed. Relationship to 2005 VVSG: The 2005 VVSG, §2.1.8 Ballot Counter, requires for all voting systems that each piece of voting equipment that tabulates ballots shall provide a counter that:
A. can be set to zero before any ballots are submitted for tally; B. records the number of ballots cast during a particular test cycle or election; C. increases the count only by the input of a ballot; D. prevents or disables the resetting of the counter by any person other than authorized persons at authorized points; E. is visible to designated election officials.
Response: The M100, M650, DS200 and DS850 meet this requirement. (Please refer to the System Operating Procedures for each tabulator and the VSTL report). New Mexico Requirement: Be able to print. (1) an alphanumeric printout of the contests, candidates and vote totals when the polls are opened so that the poll workers can verify that the counters for each candidate are on zero. Relationship to 2005 VVSG: The 2005 VVSG, §5.4.3 In-process Audit Records, requires: "Critical system status messages other than informational messages displayed by the system during the course of normal operations. These items include, but are not limited to:
ii. The “zero totals” check conducted before opening the polling place or counting a precinct centrally."
Response: In regard to the M100, the certification report, or zero report, prints automatically when the polls are opened for voting on the machine. The zero report lists the date and time the polls open, followed by the vote count for all contests and blank signature lines for poll worker certification. The Model 100 allows for printing an additional certification report immediately after printing a results report.
5 |Unity 3.4.0.0
In regard to the M650, the System Operating Manual instructs poll workers to run a zero report. "Zero the scanner before you run Election Day ballots, and check your reports to ensure that all totals equal zero. The DS200 System Operating Manual gives instruction on how to print a zero tape. "Press Zero Report to reprint your zero report". The DS850 manual states that the Zero Report, which is printed before polls are open on Election Day, is used to indicate the vote totals have not been tampered with. New Mexico Requirement: An alphanumeric printout of the contests, candidates and vote totals at the close of the polls, which printouts shall contain the system serial number and public counter total. Relationship to the 2005 VVSG: The 2005 VVSG, §5.4.4 Vote Tally Data, provides that voting systems shall meet these reporting requirements by providing software capable of obtaining data concerning various aspects of vote counting and producing printed reports. At a minimum, vote tally data shall include:
A. Number of ballots cast, using each ballot configuration, by tabulator, by precinct, and by political subdivision;
B. candidate and measure vote totals for each contest, by tabulator; C. the number of ballots read within each precinct and for additional jurisdictional levels,
by configuration, including separate totals for each party in primary elections; D. separate accumulation of over votes and under votes for each contest, by tabulator,
precinct and for additional jurisdictional levels (no over votes would be indicated for DRE voting devices);
E. for paper-based systems only, the total number of ballots both able to be processed and unable to be processed; and if there are multiple card ballots, the total number of cards read.
In regard to systems that produce an electronic file containing vote tally data, the contents of the file shall include the same minimum data cited above for printed vote tally reports. Response: The M100, M650, DS200 and DS850 meet the above requirements. (Please refer to the System Operating Procedures for each tabulator and the Voting System Testing Lab (VSTL) report). New Mexico Requirement: Print as many copies of the alphanumeric printouts as necessary to satisfy state law.
6 |Unity 3.4.0.0
Relationship to the 2005 VVSG: This requirement is specific to state law and expressly stated in the 2005 VVSG. Response: The M100, M650, DS200 and DS850 meet the above requirements. (Please refer to the System Operating Procedures for each tabulator). The DS200 and DS850 operating manuals provide instructions on multiple print outs. These systems meet these requirements. The M100 and M650 meet the above requirements. Each has the capability to produce as many zero reports and results reports necessary to satisfy state law. New Mexico Requirement: Include a feature to allow reports to be sent to an electronic data file. Relationship to 2005 VVSG: The 2005 VVSG, Section 4.1.7.1, provides, "in voting systems that use storage media that can be removed from the system and transported to another location for readout and report generation, these media shall use devices with demonstrated error-free retention for a period of 22 months under the environmental conditions for operation and non- operation contained in Subsection 4.1.2.” Response: Unity 3.4.0.0 meets this requirement. (Please refer to Election Reporting Module (ERM) System Operating Procedures). The Operating Procedures instruct election officials on the process to export election results to ASCII format for export to UNIX or DOS based operating systems. 1-9-7.8. Voting systems; operational requirements. New Mexico requirement: Have internal application software that is specifically designed and engineered for the election application. Relationship to 2005 VVSG: This requirement is not specifically found in the 2005 VVSG. The VVSG provides: "7.4.4 Software Distribution, the vendor shall document all software including voting system software, third party software (such as operating systems and drivers) to be installed on the certified voting system, and installation programs. i) The documentation shall have a unique identifier (such as a serial number or part number) for the following set of information: documentation, software vendor name, product name, version, the certification application number of the voting system, file names and paths or other location information (such as storage addresses) of the software.” Response: Unity 3.4.0.0 software and tabulators are designed specifically for elections and meet this requirement. (Please refer to System Overview).
7 |Unity 3.4.0.0
New Mexico requirement: Include comprehensive diagnostics designed to ensure that failures do not go undetected. Relationship to the 2005 VVSG: Section 2.1.4 of the 2005 VVSG, provides: “To ensure system integrity, all systems shall: j. Include built-in measurement, self-test, and diagnostic software and hardware for detecting and reporting the system's status and degree of operability.” Response: Unity 3.4.0.0 software and tabulators have audit logs and meet this requirement. (Please refer to System Operating Procedures). In regard to the M100, the audit log lists all of the tabulator events that occur from the time the election definition PC card is loaded into the tabulator until the time it is removed after the polls close. The audit log also displays the total number of write-in votes counted by the tabulator as well as the number of accepted and rejected blank ballots, the number of over voted ballots and the number of crossover ballots scanned. In regard to the M650, the scanner generates reports to show up-to-the-minute totals by individual precinct, city, or by county. Final reports serve as unofficial election night results. The scanner also generates a time/date stamped audit log of scanner activities on a separate printer. In regard to the DS200, the Operating Manual instructs poll workers to press Event Log Report to print an audit log of the activity that has occurred on the scanner. Information such as the date and times when the system is initialized and when it prints reports appears on this report. The DS850 records errors and major events and tags these incidents with the date and time the incident occurred based on the DS850’s realtime clock settings. Audit log information can be exported to a USB flash drive inserted into a USB port on the DS850. New Mexico requirement: Have a real-time clock capable of recording and documenting the total time polls are opened. Relationship to the VVSG: The 2005 VVSG, § 2.1.5.1, requires “All systems shall include a real- time clock as part of the system’s hardware. The system shall maintain an absolute record of the time and date or a record relative to some event whose time and data are known and recorded." Response: The M100 and DS200 tabulators have a real-time clock and meet this requirement. The M650 and DS850 have real-time audit logs and met the requirement of the VVSG described above. (Please refer to System Operating Procedures and Voting System Testing Lab (VSTL) report).
8 |Unity 3.4.0.0
The M650 scanner generates reports to show up-to-the-minute totals by individual precinct, city, or by county. Final reports serve as unofficial election night results. The scanner also generates a time/date stamped audit log of scanner activities on a separate printer. The DS200 prints an audit log of the activity that has occurred on the scanner. Information such as the date and times when the system is initialized and when it prints reports appears on this report. The DS850 records errors and major events and tags these incidents with the date and time the incident occurred based on the DS850’s realtime clock settings. Audit log information can be exported to a USB flash drive inserted into a USB port on the DS850. New Mexico requirement: Have a self-contained, internal backup battery that powers all components of the system that are powered by alternating current power; and, in the event of a power outage in the polling place:
(1) the self-contained, internal backup battery power shall engage with no disruption of operation for at least two hours and with no loss of data; and
Relationship to the 2005 VVSG: Section 4.1.2.4 of the 2005 VVSG provides:
c. All voting machines shall also be capable of operating for a period of at least 2 hours on backup power, such that no voting data is lost or corrupted nor normal operations interrupted. When backup power is exhausted the voting machine shall retain the contents of all memories intact.
Response: The M100, M650, DS200 and DS850 meet this requirement. The M100 contains a standard 120-volt AC power cord to supply electricity to the tabulator. If a power outage occurs, the M100 contains an internal back-up battery that can run the tabulator for one to three hours, depending on tabulator activity. The tabulator stores accumulated totals to internal tabulator memory (DRAM) and to a removable PC card. The M650 contains a 3.6Vdc high energy lithium battery connected to the program card cage. The DS200 contains an external DC power supply, which plugs into a standard 120volt AC outlet and supplies power to the scanner. If a power outage occurs, the DS200 contains an internal backup battery that can run the scanner for a minimum of two hours, depending on scanner activity. For the DS850: To ensure 2 hours of uninterruptible power, election officials must use an Uninterruptible Power Supply (UPS) with the DS850. This will provide continuous power to the
9 |Unity 3.4.0.0
machine and to prevent the DS850 and the attached printers from being damaged in case of a power surge. New Mexico requirement: (2) the system shall maintain all vote totals, public counter totals and the internal clock time in the event that the main power and battery backup power fail. Relationship to the 2005 VVSG: Section 4.1.2.4 of the 2005 VVSG provides: “All voting machines shall also be capable of operating for a period of at least 2 hours on backup power, such that no voting data is lost or corrupted nor normal operations interrupted. When backup power is exhausted the voting machine shall retain the contents of all memories intact.” Response: All tabulators have backup batteries tested to maintain at least two hours of operation and meet the above requirements. (Please refer to System Operating Procedures for each tabulator). The M100 stores accumulated totals to internal tabulator memory (DRAM) and to a removable PC card so that it maintains all vote totals, public counter totals and internal clock time in the event of a complete power failure. The M650 backup and recovery system automatically saves vote totals in case of a power failure or machine failure. The M650 requires a backup generator at the central count location to continue scanning if a power failure occurs. The DS200 uses a USB flash drive to store the scanner’s election definition, audit log and other electionspecific information. Data on the USB flash drive is updated each time the DS200 scans a ballot. The USB flash drive maintains all vote totals, public counter totals, and internal clock time in the event of a complete power failure. The DS850 records errors and major events and tags these incidents with the date and time the incident occurred based on the DS850’s realtime clock settings. Audit log information can be exported to a USB flash drive inserted into a USB port on the DS850. 1-9-7.9. Voting systems; memory; removable storage media device; requirements. New Mexico requirement: Be programmable with removable storage media devices. Relationship to the 2005 VVSG: Section 4.1.7.1 Removable Storage Media provides: "In voting systems that use storage media that can be removed from the system and transported to another location for readout and report generation, these media shall use devices with demonstrated error-free retention for a period of 22 months under the environmental conditions for operation and non-operation contained in Subsection 4.1.2.
10 |Unity 3.4.0.0
Examples of removable storage media include: programmable read-only memory (PROM), random access memory (RAM) with battery backup, magnetic media or optical media." Response: All tabulators meet the above requirements. (Please refer to System Operating Procedures for each tabulator). The M100 uses PCMCIA cards to store the tabulator’s election definition, audit log and other election-specific information. Data on the PC card exists in one sequential block, which is updated each time the M100 scans a ballot. The M650 utilizes a zip drive to provide for removable media storage. The DS200 stores election results on a removable USB flash drive that is used to transfer scanner results to Election Reporting Manager after the polls close. The DS850 allows for the use of a removable USB flash drive to transfer scanner results. New Mexico requirement: Contain ballot control information, summary vote totals, maintenance logs and operator logs on the removable storage media device. Response: All tabulators meet the above requirements. (Please refer to System Operating Procedures for each tabulator). The removable media storage devices described above all contain ballot control information, summary vote totals, maintenance logs and operator logs. New Mexico requirement: Ensure that the votes stored on the removable storage media device accurately represent the actual votes cast. Relationship to the 2005 VVSG: Section 2.1.2 Accuracy, requires: “Memory hardware, such as semiconductor devices and magnetic storage media, must be accurate. The design of equipment in all voting systems shall provide for the highest possible levels of protection against mechanical, thermal, and electromagnetic stresses that impact system accuracy. Section 4 provides additional information on susceptibility requirements. To ensure vote accuracy, all systems shall:
A. Record the election contests, candidates, and issues exactly as defined by election officials;
B. record the appropriate options for casting and recording votes; C. record each vote precisely as indicated by the voter and produce an accurate report
of all votes cast; D. include control logic and data processing methods incorporating parity and
11 |Unity 3.4.0.0
checksums (or equivalent error detection and correction methods) to demonstrate that the system has been designed for accuracy; E. provide software that monitors the overall quality of data read-write and transfer quality status, checking the number and types of errors that occur in any of the relevant operations on data and how they were corrected.”
Response: All tabulators meet the above requirements. (Please refer to System Operating Procedures and VSTL for each tabulator). New Mexico Requirement: Be designed so that no executable code can be launched from random access memory. Relationship to the 2005 VVSG: Section 5.2.2 Software Integrity provides: "Self-modifying, dynamically loaded or interpreted code is prohibited, except under the security provisions outlined in Subsection 7.4. This prohibition is to ensure that the software tested and approved during the certification process remains unchanged and retains its integrity. External modification of code during execution shall be prohibited. Where the development environment (programming language and development tools) includes the following features, the software shall provide controls to prevent accidental or deliberate attempts to replace executable code:
a. unbounded arrays or strings (includes buffers used to move data); b. pointer variables; c. dynamic memory allocation and management.”
Response: All tabulators meet this requirement. The data is binary and the vendor uses Checksum to verify the data has not been modified. In addition, there is a check for authorized/certified USB media that will detect if an unauthorized stick is attempted to be used. (Please refer to Unity 3.4.0.0 VSTL Test Report). New Mexico requirement: Have any operating system software stored in nonvolatile memory, which shall include internal quality checks such as parity or error detection and correction codes, and which software shall include comprehensive diagnostics to ensure that failures do not go undetected. Relationship to the 2005 VVSG: Section 2.1.4 of the 2005 VVSG, provides: “To ensure system integrity, all systems shall: j. Include built-in measurement, self-test, and diagnostic software and hardware for detecting and reporting the system's status and degree of operability.”
12 |Unity 3.4.0.0
Response: The operating system for the tabulators is stored in non-volatile memory on each unit and meets this requirement. Each unit undergoes an integrity check when turned on. (Please refer to Unity 3.4.0.0 VSTL Test Report). New Mexico Requirement: Allow for pre-election testing of the ballot control logic and accuracy, with results stored in the memory that is used on Election Day, and shall be capable of printing a zero-results printout prior to these tests and a results printout after the test. Relationship to the 2005 VVSG: Voting systems must provide for logic and accuracy testing, which is defined as: logic and accuracy testing: Testing of the tabulator setups of a new election definition to ensure that the content correctly reflects the election being held (i.e., contests, candidates, number to be elected, ballot styles) and that all voting positions can be voted for the maximum number of eligible candidates and that results are accurately tabulated and reported. Response: Unity 3.4.0.0 and the tabulators meet this requirement. (Please refer to System Operating Procedures). See above. New Mexico Requirement: Have internal audit trail capability such that all pre-election, election day and post-election events shall be stored, recorded and recovered in an easy-to- read printed form and be retained within memory that does not require external power for memory retention. Relationship to 2005 VVSG: Section 2.1.5.1 of the 2005 VVSG provides: “Audit records shall be prepared for all phases of election operations performed using devices controlled by the jurisdiction or its contractors. These records rely upon automated audit data acquisition and machine-generated reports, with manual input of some information. These records shall address the ballot preparation and election definition phase, system readiness tests, and voting and ballot-counting operations. The software shall activate the logging and reporting of audit data as described below.” Response: Unity 3.4.0.0 software and tabulators have audit logs which can be printed and exported and meet this requirement. (Please refer to System Operating Procedures). The four tabulators under consideration meet this requirement. As shown above, the audit log lists all of the tabulator events that occur from the time the election definition PC card is loaded into the tabulator until the time it is removed. This information is retained in memory in the event of a complete power failure. The audit logs are stored and recorded on the removable storage media, and can be recovered and printed from that media.
13 |Unity 3.4.0.0
New Mexico Requirement: Possess the capability of remote transmission of election results to a central location only by reading the removable storage media devices once they have been removed from the tabulation device after the poll closing sequence has been completed; and Relationship to the 2005 VVSG: As set forth above, the 2005 VVSG does not require that all certified voting systems use removable storage media devices. Response: The Unity 3.4.0.0 system meets this requirement. (Please refer to System Operating Procedures). Election data cannot be remotely transmitted directly from a tabulator. Results can only be transmitted after the poll closing sequence has been completed. New Mexico Requirement: Prevent data from being altered or destroyed by report generation or by the transmission of results. Relationship to the 2005 VVSG: Section 2.4.3 Producing Reports, provides: "All systems shall be able to create reports summarizing the vote data on multiple levels. All systems shall provide capabilities to... (g.) prevent data from being altered or destroyed by report generation, or by the transmission of results over telecommunications lines.” Response: Report generation and transmission of results does not affect data. (Please refer to Unity 3.4.0.0 Voting System Testing Lab (VSTL) Test Report).
1-9-7.10. Voting systems; ballot handling and processing requirements.
New Mexico Requirement: Accept a ballot that is a minimum of six inches wide and a maximum of twenty-four inches long, in dual columns and printed on both sides; Relationship to 2005 VVSG: This requirement is not found in the 2005 VVSG. Response: The following table shows the ballot sizes which can be generated by Unity 3.4.0.0 and accepted by the four tabulators which are part of this certification: Ballot Target Limits for Paper Ballots STANDARD BALLOT SIZES
VOTING POSITIONS PER COLUMN/SIDE
8½ x 11 (4 ovals per inch) 36 rows x 3 columns = 108 per side 8½ x 14 (3 ovals per inch) 36 rows x 3 columns = 108 per side 8½ x 14 (4 ovals per inch) 48 rows x 3 columns = 144 per side 8½ x 17 (3 ovals per inch) 41 rows x 3 Columns = 123 per side 8½ x 17 (3 ovals per inch) 45 rows x 3 columns = 135 per side 8½ x 17 (4 ovals per inch) 60 rows x 3 columns = 180 per side 8½ x 19 (3 ovals per inch) 51 rows x 3 columns = 153 per side 8½ x 19 (4 ovals per inch) 68 rows x 3 columns = 204 per side
14 |Unity 3.4.0.0
(Please refer to the Unity 3.4.0.0 Overview documentation). New Mexico requirement: Accept a ballot in any orientation when inserted by a voter. Relationship to 2005 VVSG: The 2005 VVSG does not contain this requirement. Response: The precinct level tabulators, the M100 and DS200, can scan ballots inserted in any direction or orientation by the voter. The M650 and DS850 do not involve ballot inserted by a voter. New Mexico requirement: Have the capability to reject a ballot on which a voter has made more than the allowable number of selections in any contest. Relationship to the 2005 VVSG: Section 2.3.3.2 Paper-based System Requirements, provides that all paper-based systems shall:
1. Provide feedback to the voter that identifies specific contests for which he or she has made no selection or fewer than the allowable number of selections (e.g., undervotes)
2. Notify the voter if he or she has made more than the allowable number of selections for any contest (e.g., overvotes)
3. Notify the voter before the ballot is cast and counted of the effect of making more than the allowable number of selections for a contest
4. Provide the voter opportunity to correct the ballot for either an undervote or overvote before the ballot is cast and counted
Response: The M100 will use one of the following methods for accepting or rejecting blank ballots, overvotes, and crossover votes:
* Unconditional acceptance: The tabulator accepts and tabulates results for all ballots. The tabulator automatically sorts questioned ballots without storing results from those ballots. While scanning the ballot, the message PROCESSING BALLOT - PLEASE WAIT… will appear. Once the ballot is scanned, the message THANK YOU FOR VOTING appears. Then the message INSERT BALLOT - NUMBER OF VOTERS: appears.
* Unconditional rejection: The Model 100 automatically rejects crossover, overvoted or
blank ballots. Voters must review and correct ballot selections before the tabulator will accept the ballot.
In regard to the M650, the ballot scanner can sort blank, over-voted, under-voted, crossover and write-in ballots from regular ballots. The scanner does not tabulate blank, over-voted, under-voted and crossover ballots when they are sorted. The scanner will only tabulate sorted
15 |Unity 3.4.0.0
write-in ballots if the election definition contains the option to tabulate write-ins. The scanner lists this option on the ready report, which prints automatically when you start the scanner. To sort blank, over-voted and write-in ballots, the election official will select the appropriate options in the SORT section of the control panel. Any or all of the sort options may be selected. The DS200 will use one of the following methods for accepting or rejecting blank ballots, overvotes and undervotes:
Unconditional acceptance: The scanner accepts and tabulates results for all ballots. Any contests that are blank, overvoted or undervoted will be logged as such and the remaining contests will be tabulated appropriately.
Unconditional rejection: The DS200 automatically rejects undervoted, overvoted or blank ballots. Voters must review and correct ballot selections before the scanner will accept the ballot.
Query the voter for correction: The DS200 returns a questioned ballot to the voter and displays a screen message that describes the problem and prompts the voter to either review and edit the ballot or cast the ballot as it is. The voter presses Don’t Cast - Return Ballot to correct the ballot or presses Cast Ballot to cast the ballot without editing selections. Once ACCEPT is pressed, the message Thank you for voting. Your ballot has been counted appears.
DS850: The Sort Settings option allows the election official to specify whether ballots with writeins are to be processed and into which output bin they are to be diverted. It also allows the official to specify whether undervotes, overvotes, crossovers, blank ballots, and ballots with unclear marks are to be processed. New Mexico Requirement: Be designed to accommodate the maximum number of ballot styles or ballot variations encountered in the largest New Mexico election jurisdiction. Relationship to 2005 VVSG: This requirement is state-specific and is not found the 2005 VVSG. New Mexico Requirement: Be able to read a single ballot with at least four hundred twenty voting positions. Relationship to 2005 VVSG: Section 2.2.1.1 General Capabilities, provides: “All systems shall provide the general capabilities for ballot preparation. All systems shall be capable of… supporting the maximum number of potentially active voting positions as indicated in the system documentation.”
16 |Unity 3.4.0.0
Response: The following table demonstrates the number of ballot styles which can be generated by Unity 3.4.0.0: Characteristics Limit
Maximum precincts allowed in an election
2900 (1639 if using paper ballot coded by precinct)
Maximum Precincts included per poll (reporting limit)
1900
21,0001
Depends on election content (limited by 21,000 maximum counters)2
Maximum candidate counters allowed per precinct
10003
Maximum ballot styles allowed 99 specified ballot styles OR all ballot styles defined in per precinct the election unless otherwise limited by the tabulator
Maximum ballot styles allowed per election
or BMD memory 5500 (1639 if using paper ballot coded by style)
Maximum contests allowed per 200 or # of positions on ballot ballot style
Maximum precincts allowed per ballot style
1500
175
PROCESSING FREQUENCY
Model 100 Estimated maximum throughput in a real world environment – where mismarked, torn or folded ballots are occasionally rejected – to be about three voters per minute (20 seconds per voter), which adds up to 2700 ballots per terminal over the course of a 15-hour counting period.
Maximum throughput in a test environment with a single user feeding ballots into the machine with no rejections is an average of ten ballots per minute for a 19- inch ballot and fourteen ballots per minute for an 11- inch ballot. This rate computes to 600 to 840 ballots per hour, or 9000 to 12,600 for a 15-hour day.
The Model 100 ballot box holds up to 2800 paper ballots. Standard PC Card size for the Model 100 is 512 MB, with larger capacity cards commercially available. The number of ballot records that can be stored to this card depends on the size of the election.
18 precincts per M100, 40 styles per precinct
10 seconds per voter
17 |Unity 3.4.0.0
DS200 Estimated maximum throughput in a real world environment – where mismarked, torn or folded ballots are occasionally rejected – to be between 2 and 3 voters per minute, which adds up to approximately 2300 ballots per terminal over the course of a 15-hour counting period.
Maximum throughput in a test environment with a single user feeding ballots into the machine with no rejections is an average of 2.5 ballots per minute. This rate computes to 153 ballots per hour or a maximum of 2300 ballots for a 15-hour day.
The DS200 ballot box holds up to 2800 paper ballots. Supported USB Flash Drives for the DS200 start at 512 MB, with larger sizes available. The number of ballot records that can be stored to Flash media depend on the capacity of the Flash drive and size of the loaded election.
18 precincts per DS200, 40 styles per precinct
20 seconds per voter
Model 650 Estimated maximum throughput in a real world environment – where mismarked, torn or folded ballots are occasionally rejected –200 per minute, which adds up to 12000 ballots per hour. This will depend on the efficiency of the operator and processes.
Maximum throughput in a test environment feeding ballots into the machine with no rejections is an average of 275 per minute for a 19- inch ballot and 325 per minute for an 11-inch ballot. This rate computes to 16500 to 19500 ballots per hour.
The Model 650 holds a stack of up to 400 in both the input and output trays
100 per precinct 5 every 1 second.
DS850 DS850 can divert sorted ballots to bins without pausing operation. The input hopper holds up to 480 standard ballots and scans approximately 365 11-inch ballots per minute.
Approximately 365 11-inch ballots per minute. Throughput rate decreases with increased ballot lengths.
The ES&S DS850 input hopper and main output hopper each hold up to 480 standard sized ballots. Each outstack bin holds approximately 150 ballots. The DS850 is equipped with a 1TB hard drive that can hold more than 5 million ballot images and related data.
9990 precincts, 40 ballot styles per precinct in a ballots by style election
Between 5 and 6 ballots per second depending on ballot length.
ES&S AutoMARK Expected real-world ballot marking speed is 1.5 minutes for a sighted voter and 2.5 minutes for a voter with low or no vision.
Maximum ballot marking throughput speed in test mode is estimated at 2.5 minutes per ballot (filling all positions).
Does not apply. The AutoMARK marks a single ballot at a time. The system does not store or process vote totals and has no memory capacity limitations once programmed with an election definition.
6400 1-20 minutes per voter. Estimated average at 8 ballots per hour at maximum capacity.
1-9-7.11. Voting systems; source code; escrow. New Mexico requirement: As a condition of initial certification and continued certification, the source code that operates a voting system shall be placed in escrow and be accessible to the
18 |Unity 3.4.0.0