Election TechReports(tm) Newsletter--Nov2002

HAVA Great Holiday Season and Happy New Year!!! *Election TechREPORTS^™* InfoSENTRY® Services www.infosentry.com info@infosentry.com Issue 14 December 2002 Privacy Policy FEATURE 1: HAVA and Models of Statewide Voter Registration Systems FEATURE 2: Configuration Management Is Not A New Diet FEATURE 3: Changing of the Guard
HAVA and Models of Statewide Voter Registration Systems One of the most striking mandates in the recently enacted Help America Vote Act of 2002 is its requirement for states to implement a "single, uniform, official, centralized, interactive computerized statewide voter registration list." It has been striking over the years how many states respond to surveys indicating that they already have a statewide voter registration system. A state that collected voter registration files from the counties a couple of times a year, put them all in a big computer CuisineArt, and output some kind of tape containing all of the files could indicate they have a statewide voter registration "system"--just like Oklahoma, Georgia, Kentucky, and Louisiana that have online, real-time statewide voter registration networks. Those states have had truly central voter registration systems for some time. A statewide voter registration system clearly was in the eye of the beholder. In the pre-HAVA days, that diversity was acceptable. However, HAVA has some basic requirements that will start to tighten the definition of a statewide voter registration system considerably. The HAVA requirement for the "official" electronic voter registration record to be in the state central database places a tremendous amount of custodial responsibility for accuracy and completeness in the office of the Chief State Election Officer. The HAVA requirement that "all voter registration information...shall be electronically entered into the computerized list on an expedited basis at the time the information is provided to the local official" sure sounds like online, interactive entry from the local jurisdictions into the central database. Add to this mix a HAVA requirement that the "appropriate official...shall provide adequate technological security measures to prevent unauthorized access..." to this statewide voter registration "list." In short, it will be up to the owner and custodian of this system to assure the total availability (continuity), reliability, integrity, and confidentiality of this system. Those four characteristics are the key, textbook components of information system security. Many CSEOs will move very quickly from having very small local area networks to being the owners and managers of the second or third largest network and database in their states. All questions regarding the "technological security measures" will land on their desks. It is important to keep in mind that HAVA is written from a political and campaign committee perspective--not an election administration perspective. The HAVA section on this system repeatedly refers to a statewide computerized "list." That language is reminiscent of a "walking list" or "phone list" or "poll list." HAVA is written without any consideration at all that voter registration systems have a use even more important than providing candidates with clean "lists." That use is to support many aspects of free and fair elections. Integrated voter registration systems often support petition signature checking, absentee voter management, ballot management, poll book production, NVRA report production, election worker management and payrolls, polling place management, public information responses, and a myriad of other activities. InfoSENTRY has visited numerous election jurisdictions in which voter registration systems directly support all of these operations--and more. It will be up to the State and local election workers to define the systems (as required by HAVA) to meet more than just "lists." HAVA also requires that "...the computerized list shall be coordinated with other agency databases within the State." (It's about time!) There is one additional set of "database interfaces" that need to be added to this coordination mix: local databases. In many counties the local voter registration system is integrated with the county geographic information system (and E911 system) for determination of valid street addresses. These systems also support automatic precincting of the voters at the time of registration. In other counties the voter registration system is integrated with the local tax department to obtain address information automatically. Design and implementation of the new system will need to work through an entire set of automated interfaces with both state and local agencies. So, states most likely will have to design and implement statewide voter registration systems that go far beyond a the simple notion of a "list" that is in HAVA. Rather than categorizing each state's current statewide voter registration system, InfoSENTRY has reviewed data on a number of state implementations and created a series of "models" for these systems. We hope this basic categorization will help you assess your state's capability--and where you need to go in order to comply with HAVA. The models range from no statewide system at all to a highly integrated, centralized system. Then, we have described characteristics of each model system. You can download a copy of these models and their characteristics at http://www.infosentry.com/Statewide_VRS_Models.pdf . As recently as a few days before posting this newsletter issue, we understood that disagreements still exist among the Congressional Members and the staff who drafted HAVA about what are the law's system and operational requirements. We certainly see where there is room for disagreement. Because of the aggressive time schedule for HAVA implementation, these differences need to be resolved quickly. That quick resolution is necessary for states to get the wheels rolling on what will be a multi-year, complex effort to design the system, hire the personnel, purchase the hardware and software, install the network, establish the procedures, train everyone, test everything, and get the system running. In our initial view, HAVA strongly directs states toward the high end of the models: Data entry occurs in the Counties, with all voter registration data and all other data on voter history and other voter transactions being transmitted and stored in real time in the statewide database. The State stores the data in a database format for routine report production, inquiries, and use in election administration functions. The State purchases (or develops) and maintains the software used by all jurisdictions. The State typically distributes software updates through the network to the Counties. The State often transmits voter registration applications from NVRA agencies to the Counties for data entry and verification/confirmation activities. Counties have the ability to inquire interactively on the statewide database to check for all information relating to any registered voter’s record. So, there are numerous details to be worked out in every state to make all of this a reality--and the check is not yet in the mail. InfoSENTRY looks forward to working with States and local jurisdictions to make it all happen. Return to Top of Page Configuration Management Is Not a New Diet Three stories from 2002 elections in separate locations illustrate why election officials are going to have to get familiar with configuration management. Simply put "configuration management" means knowing, documenting, and controlling the structure and technical settings of your system's hardware, software, and network. While the definition is pretty simple, getting there is both difficult and important! So much for the definition. Here are the stories. VOTE TABULATION SYSTEM DIRECTORY CONFIGURATION--A county wisely carried out an exhaustive pre-implementation user test of new DRE vote tabulation equipment prior to purchase and use in a 2002 primary. The test called for entering specified numbers of votes on test ballots on the test machines. After entering the votes, testers printed tallies from each of the test machines. Following the required procedures, the testers transferred the vote results electronically from the vote tabulation equipment to the county's server. Next, testers used the vendor's software to print the total election results from the server and compare them with the totals with the individual results from the voting machines. YOU GUESSED IT! The total votes from the server did not match the summed votes cast on the voting machines. In fact, there were MORE votes on the server than had been cast on the test machines. After several hours of frantic software reviews, reviews of the test procedures, and transmissions of "screen dumps" to the vendor, the testers found the problem. The vendors software automatically creates a series of directories on the server when it receives vote data from individual voting machines. However, the vendors software and operations do not "flush" or "resent" the directories to zero before dumping data from a voting machine into the directory. And because the vendor and the county staff had used the server and voting equipment in earlier, informal "tests," there were "votes" in the server than had not been cleared out automatically prior to the actual user acceptance test. In fact, the tabulation systems and software had worked correctly during the test. It was what the software did not do (clear out the system's directory configuration) and the absence of procedural documentation (to verify the correct directory configuration) that created the problem. Fortunately, it was only a test. A VOTE TABULATION SYSTEM FIRMWARE CONFIGURATION--A county used a vendor's latest DRE vote tabulation system for "early voting" sites. Very early in the use at two of the sites election workers reported problems that votes were not being tabulated smoothly and properly. Additionally, the machines' displays were registering memory errors that were less than reassuring to voters. When the county reported the problem to the vendor, the vendor asked the county to send a staff member to the sites to determine which "firmware revision level" was in the equipment. 'HOUSTON, WE HAVE A PROBLEM!" That was the vendor asking the county staff to report the firmware "rev level" back to the vendor. In the real information technology universe, it should have been the other way around. The vendor should have referred to its documentation in order to determine the hardware and firmware configuration it has placed in the field for the county. It turned out that the equipment in fact had an older firmware "rev level" that was the cause of the problem. The county immediately pulled the DRE vote tabulation equipment from the early voting sites and replaced it with previously used equipment. A VOTE TABULATION SYSTEM'S "LOST" BALLOTS--A county "found" over 500 "uncounted" ballots during the state-mandated recount for a congressional race. This was a large number in an important race that had a 122-vote margin going into the recount. The county used new electronic machines in 2002 to replace punch card ballots. Once again, the machines in question were used in early voting sites. As in the first of our three configuration parables, two of the vote tabulation machines placed their tallies in directory "subfiles." Unfortunately, there appears to have been no documentation or training for county workers noting the existence and use of the subfiles. OOPS! The vote tallies on a third machine simply were overlooked and not added to the election results. (It turned out the missing, "uncounted" ballots did not have an effect on the race's outcome.) The lesson learned from these case studies is pretty straightforward: require (and test) your vendor's procedures, operations, and documentation for the hardware, software, and network configurations they are providing you. You must have a documented configuration management plan in place. Put provisions into your contract with the vendor before you commit to buy or lease that accurate configurations, accurate system administration and user documentation of those configurations, and training in maintenance of the configurations are responsibilities of the vendor. In short, make sure the configuration settings and operations of your vote tabulation system and voter registration system are known, documented, tested, and up-to-date. Both are critical systems. An unplanned, undocumented, and untested change in a system configuration setting can cause more disruption to your elections than a malicious hacker's wildest dream could imagine! It can cause your voter registration system to fail at a critical time. It can cause your vote tabulation system to add unexplained votes or miss votes. Ultimately, it will be election officials that bear the public brunt of configuration management errors and oversights. InfoSENTRY has worked with clients ranging from elections authorities across the country to Federal agencies to prepare, document, implement, and administer system configuration management plans. Return to Top of Page Changing of the Guard Richard Filling, Pennsylvania's Commissioner of Boards and Elections is retiring from that position in January, 2003. We have enjoyed working with Dick and benefiting from his advice and experience since we prepared a needs assessment and requirements analysis for what has become Pennsylvania's Statewide Uniform Registry of Electors in 1996. For the past year, Dick has been talking about spending more time with his family--but we suspect he will also start working in another endeavor he has been considering for some time. We hope to get to see a Harrisburg Senators or Baltimore Orioles game with him next year! Al Zimmer, General Counsel for the Illinois State Board of Elections is retiring at the end of this year after long service. Al provided invaluable advice and solace while we worked on a needs assessment and requirements analysis for Illinois' statewide voter registration system. All the while he maintained his great affection for music theory and the joy of driving a Corvette. Al has given the best description of what it means to "go vote" that we have ever heard: "Affirming a private act and responsibility in public." Best wishes getting that Masters Degree in Music! Susie Penhollow, County Clerk for Deschutes County, OR, is leaving office at the end of this year. We got to visit Susie in Bend and observe the election operations in her office. We also had the pleasure of working with Susie when we prepared a needs assessment and requirements analysis for Oregon's Central Voter Registration System in 1998 and 1999. She chaired that study's Advisory Board and kept the group of state election staff, local election officials, political party representatives, media representatives, and us on track! We were delighted to visit and work with these dedicated elections servants over the years--and to see that these states are well on their way to implementing statewide voter registration systems. We wish the outgoing folks all the best and look forward to working with the new guard. (If you know of any other election officials who are coming and going, we will appreciate a note from you. Send your notices to helen_sims@infosentry.com or glenn_newkirk@infosentry.com .) Return to Top of Page Please click here to visit our main election systems consulting page. It has a table of contents for previous newsletter issues. Please click here to visit our main project management consulting page. It has examples of elections systems projects with which we have assisted clients throughout the country. Please click here to read a copy of our white paper on User Acceptance Testing. Please click here to read a copy of our white paper on After Action Reviews as a formal--but inexpensive and quick--way to capture lessons learned in information system projects. Please visit our main information technology consulting page and our information technology security and recovery page. They contain brief descriptions of some of our previous consulting engagements, including those for election jurisdictions. Please contact et@infosentry.com if you would like to get a PDF version or a laser printed copy of this newsletter for distribution in your election office. InfoSENTRY Services, Inc. 2 Hannover Square, Suite 1740 Raleigh, NC 27601 P.O. Box 28048, Raleigh, NC 27611 Phone: 919.838.8570 Glenn Newkirk's e-mail: glenn_newkirk@infosentry.com Copyright 2002, InfoSENTRY® Services, Inc. All fights reserved. Reproduction and dissemination without the express written permission of InfoSENTRY® Services, Inc. is strictly prohibited. InfoSENTRY Services, Inc. publishes Election TechREPORTS monthly, focusing on technology trends and issues in election offices. From time to time, Election TechReports might mention the name of vendors' hardware or software products. However, InfoSENTRY® Services is completely independent from hardware and software vendors. Mentions of vendors' hardware and software products in no way constitutes an endorsement or indication of worthiness for those vendors or products.

HAVA Great Holiday Season and Happy New Year!!!

Election TechREPORTS^™
InfoSENTRY® Services www.infosentry.com info@infosentry.com
Issue 14 December 2002 Privacy Policy

FEATURE 1: HAVA and Models of Statewide Voter Registration Systems
FEATURE 2: Configuration Management Is Not A New Diet
FEATURE 3: Changing of the Guard

HAVA and Models of Statewide
Voter Registration Systems

One of the most striking mandates in the recently enacted Help America Vote Act of 2002 is its requirement for states to implement a "single, uniform, official, centralized, interactive computerized statewide voter registration list."

It has been striking over the years how many states respond to surveys indicating that they already have a statewide voter registration system. A state that collected voter registration files from the counties a couple of times a year, put them all in a big computer CuisineArt, and output some kind of tape containing all of the files Senate Roster Photo could indicate they have a statewide voter registration "system"--just like Oklahoma, Georgia, Kentucky, and Louisiana that have online, real-time statewide voter registration networks. Those states have had truly central voter registration systems for some time.

A statewide voter registration system clearly was in the eye of the beholder. In the pre-HAVA days, that diversity was acceptable. However, HAVA has some basic requirements that will start to tighten the definition of a statewide voter registration system considerably.

The HAVA requirement for the "official" electronic voter registration record to be in the state central database places a tremendous amount of custodial responsibility for accuracy and completeness in the office of the Chief State Election Officer. The HAVA requirement that "all voter registration information...shall be electronically entered into the computerized list on an expedited basis at the time the information is provided to the local official" sure sounds like online, interactive entry from the local jurisdictions into the central database.

Add to this mix a HAVA requirement that the "appropriate official...shall provide adequate technological security measures to prevent unauthorized access..." to this statewide voter registration "list." In short, it will be up to the owner and custodian of this system to assure the total availability (continuity), reliability, integrity, and confidentiality of this system. Those four characteristics are the key, textbook components of information system security.

Many CSEOs will move very quickly from having very small local area networks to being the owners and managers of the second or third largest network and database in their states. All questions regarding the "technological security measures" will land on their desks.

It is important to keep in mind that HAVA is written from a political and campaign committee perspective--not an election administration perspective. The HAVA section on this system repeatedly refers to a statewide computerized "list." That language is reminiscent of a "walking list" or "phone list" or "poll list." HAVA is written without any consideration at all that voter registration systems have a use even more important than providing candidates with clean "lists." That use is to support many aspects of free and fair elections.

Integrated voter registration systems often support petition signature checking, absentee voter management, ballot management, poll book production, NVRA report production, election worker management and payrolls, polling place management, public information responses, and a myriad of other activities.

InfoSENTRY has visited numerous election jurisdictions in which voter registration systems directly support all of these operations--and more. It will be up to the State and local election workers to define the systems (as required by HAVA) to meet more than just "lists."

HAVA also requires that "...the computerized list shall be coordinated with other agency databases within the State." (It's about time!) There is one additional set of "database interfaces" that need to be added to this coordination mix: local databases.

In many counties the local voter registration system is integrated with the county geographic information system (and E911 system) for determination of valid street addresses. These systems also support automatic precincting of the voters at the time of registration. In other counties the voter registration system is integrated with the local tax department to obtain address information automatically. Design and implementation of the new system will need to work through an entire set of automated interfaces with both state and local agencies.

So, states most likely will have to design and implement statewide voter registration systems that go far beyond a the simple notion of a "list" that is in HAVA.

Rather than categorizing each state's current statewide voter registration system, InfoSENTRY has reviewed data on a number of state implementations and created a series of "models" for these systems. We hope this basic categorization will help you assess your state's capability--and where you need to go in order to comply with HAVA.

The models range from no statewide system at all to a highly integrated, centralized system. Then, we have described characteristics of each model system. You can download a copy of these models and their characteristics at http://www.infosentry.com/Statewide_VRS_Models.pdf .

As recently as a few days before posting this newsletter issue, we understood that disagreements still exist among the Congressional Members and the staff who drafted HAVA about what are the law's system and operational requirements. We certainly see where there is room for disagreement. Because of the aggressive time schedule for HAVA implementation, these differences need to be resolved quickly. That quick resolution is necessary for states to get the wheels rolling on what will be a multi-year, complex effort to design the system, hire the personnel, purchase the hardware and software, install the network, establish the procedures, train everyone, test everything, and get the system running.

In our initial view, HAVA strongly directs states toward the high end of the models: Data entry occurs in the Counties, with all voter registration data and all other data on voter history and other voter transactions being transmitted and stored in real time in the statewide database. The State stores the data in a database format for routine report production, inquiries, and use in election administration functions. The State purchases (or develops) and maintains the software used by all jurisdictions. The State typically distributes software updates through the network to the Counties. The State often transmits voter registration applications from NVRA agencies to the Counties for data entry and verification/confirmation activities. Counties have the ability to inquire interactively on the statewide database to check for all information relating to any registered voter’s record.

So, there are numerous details to be worked out in every state to make all of this a reality--and the check is not yet in the mail. InfoSENTRY looks forward to working with States and local jurisdictions to make it all happen.

Return to Top of Page

Configuration Management Is Not a New Diet

Three stories from 2002 elections in separate locations illustrate why election officials are going to have to get familiar with configuration management. Simply put "configuration management" means knowing, documenting, and controlling the structure and technical settings of your system's hardware, software, and network. While the definition is pretty simple, getting there is both difficult and important!

So much for the definition. Here are the stories.

VOTE TABULATION SYSTEM DIRECTORY CONFIGURATION--A county wisely carried out an exhaustive pre-implementation user test of new DRE vote tabulation equipment prior to purchase and use in a 2002 primary. The test called for entering specified numbers of votes on test ballots on the test machines. After entering the votes, testers printed tallies from each of the test machines. Following the required procedures, the testers transferred the vote results electronically from the vote tabulation equipment to the county's server. Next, testers used the vendor's software to print the total election results from the server and compare them with the totals with the individual results from the voting machines.

YOU GUESSED IT!

The total votes from the server did not match the summed votes cast on the voting machines. In fact, there were MORE votes on the server than had been cast on the test machines. After several hours of frantic software reviews, reviews of the test procedures, and transmissions of "screen dumps" to the vendor, the testers found the problem.

The vendors software automatically creates a series of directories on the server when it receives vote data from individual voting machines. However, the vendors software and operations do not Gore Creek Snowfall Photo "flush" or "resent" the directories to zero before dumping data from a voting machine into the directory. And because the vendor and the county staff had used the server and voting equipment in earlier, informal "tests," there were "votes" in the server than had not been cleared out automatically prior to the actual user acceptance test.

In fact, the tabulation systems and software had worked correctly during the test. It was what the software did not do (clear out the system's directory configuration) and the absence of procedural documentation (to verify the correct directory configuration) that created the problem. Fortunately, it was only a test.

A VOTE TABULATION SYSTEM FIRMWARE CONFIGURATION--A county used a vendor's latest DRE vote tabulation system for "early voting" sites. Very early in the use at two of the sites election workers reported problems that votes were not being tabulated smoothly and properly. Additionally, the machines' displays were registering memory errors that were less than reassuring to voters.

When the county reported the problem to the vendor, the vendor asked the county to send a staff member to the sites to determine which "firmware revision level" was in the equipment.

'HOUSTON, WE HAVE A PROBLEM!"

That was the vendor asking the county staff to report the firmware "rev level" back to the vendor. In the real information technology universe, it should have been the other way around. The vendor should have referred to its documentation in order to determine the hardware and firmware configuration it has placed in the field for the county.

It turned out that the equipment in fact had an older firmware "rev level" that was the cause of the problem. The county immediately pulled the DRE vote tabulation equipment from the early voting sites and replaced it with previously used equipment.

A VOTE TABULATION SYSTEM'S "LOST" BALLOTS--A county "found" over 500 "uncounted" ballots during the state-mandated recount for a congressional race. This was a large number in an important race that had a 122-vote margin going into the recount.

The county used new electronic machines in 2002 to replace punch card ballots. Once again, the machines in question were used in early voting sites. As in the first of our three configuration parables, two of the vote tabulation machines placed their tallies in directory "subfiles." Unfortunately, there appears to have been no documentation or training for county workers noting the existence and use of the subfiles.

OOPS!

The vote tallies on a third machine simply were overlooked and not added to the election results.

(It turned out the missing, "uncounted" ballots did not have an effect on the race's outcome.)

The lesson learned from these case studies is pretty straightforward: require (and test) your vendor's procedures, operations, and documentation for the hardware, software, and network configurations they are providing you. You must have a documented configuration management plan in place. Put provisions into your contract with the vendor before you commit to buy or lease that accurate configurations, accurate system administration and user documentation of those configurations, and training in maintenance of the configurations are responsibilities of the vendor.

In short, make sure the configuration settings and operations of your vote tabulation system and voter registration system are known, documented, tested, and up-to-date. Both are critical systems. An unplanned, undocumented, and untested change in a system configuration setting can cause more disruption to your elections than a malicious hacker's wildest dream could imagine! It can cause your voter registration system to fail at a critical time. It can cause your vote tabulation system to add unexplained votes or miss votes. Ultimately, it will be election officials that bear the public brunt of configuration management errors and oversights.

InfoSENTRY has worked with clients ranging from elections authorities across the country to Federal agencies to prepare, document, implement, and administer system configuration management plans.

Return to Top of Page

Changing of the Guard

Richard Filling, Pennsylvania's Commissioner of Boards and Elections is retiring from that position in January, 2003. We have enjoyed working with Dick and benefiting from his advice and experience since we prepared a needs assessment and requirements analysis for what has become Pennsylvania's Statewide Uniform Registry of Electors in 1996. For the past year, Dick has been talking about spending more time with his family--but we suspect he will also start working in another endeavor he has been considering for some time. We hope to get to see a Harrisburg Senators or Baltimore Orioles game with him next year!

Al Zimmer, General Counsel for the Illinois State Board of Elections is retiring at the end of this year after long service. Al provided invaluable advice and solace while we worked on a needs assessment and requirements analysis for Illinois' statewide voter registration system. All the while he maintained his great affection for music theory and the joy of driving a Corvette. Al has given the best description of what it means to "go vote" that we have ever heard: "Affirming a private act and responsibility in public." Best wishes getting that Masters Degree in Music!

Susie Penhollow, County Clerk for Deschutes County, OR, is leaving office at the end of this year. We got to visit Susie in Bend and observe the election operations in her office. We also had the pleasure of working with Susie when we prepared a needs assessment and requirements analysis for Oregon's Central Voter Registration System in 1998 and 1999. She chaired that study's Advisory Board and kept the group of state election staff, local election officials, political party representatives, media representatives, and us on track!

We were delighted to visit and work with these dedicated elections servants over the years--and to see that these states are well on their way to implementing statewide voter registration systems. We wish the outgoing folks all the best and look forward to working with the new guard.

(If you know of any other election officials who are coming and going, we will appreciate a note from you. Send your notices to helen_sims@infosentry.com or glenn_newkirk@infosentry.com .)

Return to Top of Page

Please click here to visit our main election systems consulting page. It has a table of contents for previous newsletter issues.

Please click here to visit our main project management consulting page. It has examples of elections systems projects with which we have assisted clients throughout the country.

Please click here to read a copy of our white paper on User Acceptance Testing.

Please click here to read a copy of our white paper on After Action Reviews as a formal--but inexpensive and quick--way to capture lessons learned in information system projects.

Please visit our main information technology consulting page and our information technology security and recovery page. They contain brief descriptions of some of our previous consulting engagements, including those for election jurisdictions.

Please contact et@infosentry.com if you would like to get a PDF version or a laser printed copy of this newsletter for distribution in your election office.

InfoSENTRY Services, Inc.
2 Hannover Square, Suite 1740 Raleigh, NC 27601
P.O. Box 28048, Raleigh, NC 27611
Phone: 919.838.8570
Glenn Newkirk's e-mail: glenn_newkirk@infosentry.com

Copyright 2002, InfoSENTRY® Services, Inc. All fights reserved. Reproduction and dissemination without the express written permission of InfoSENTRY® Services, Inc. is strictly prohibited. InfoSENTRY Services, Inc. publishes Election TechREPORTS monthly, focusing on technology trends and issues in election offices. From time to time, Election TechReports might mention the name of vendors' hardware or software products. However, InfoSENTRY® Services is completely independent from hardware and software vendors. Mentions of vendors' hardware and software products in no way constitutes an endorsement or indication of worthiness for those vendors or products.