Election TechReports(tm) Newsletter--Jan2003

*Election TechREPORTS^™* InfoSENTRY® Services www.infosentry.com info@infosentry.com Issue 15 January 2003 Privacy Policy FEATURE 1: HAVA: It's Not Just a Good Idea...It's the Law FEATURE 2: HAVA-Project^tm for Supporting States' HAVA Implementation and Compliance Efforts FEATURE 3: A Wormy Start for the New Year FEATURE 4: More Changing of the Guard
HAVA: It's Not Just a Good Idea...It's the Law The message going to attendees at January's meeting of the Joint Election Officials' Liaison Committee (JEOLC) in Washington, D.C. could have been taken from the Eagles song "Get Over It." The message from the Congressional staff members involved in drafting the bill seemed to reflect that great American philosopher Don Henley's (the Eagles drummer and sometimes lead singer) lyrics: "...stop whining and moaning and pitching a fit...get over it....get over it." That message came in panel after panel. Another message was that every state and local election official in the country needs to focus on the "State Plan" required in the Help America Vote Act. An immediate question in most of the meetings was "Do States have to develop a plan and comply with HAVA's requirements if there is no or little federal funding?" The answer from JEOLC presenters and from congressional staffers was an unequivocal 'Yes." There were a couple other definitive views that came from the JEOLC meetings. First, interest groups will prepare to file suit against States that do not comply with HAVA. Regardless of the level of monitoring by the Federal government, various voting rights and other interest groups will monitor states' HAVA implementations closely. It is up to the States to obtain or provide sufficient resources in order to assure compliance. It they do not, there is a good likelihood that an interest group will litigate the issue. Second, if States accept funds under HAVA, they are clearly subject to Federal audits. It is not completely clear who will launch the audits, who will perform the audits, or when they will come, but they will be there. It is likely that both kinds of audits (that is, bean counting audits and compliance/performance audits) will be occur. It will be important for state and local election offices to pay attention to what the audit requirements might be as they develop the plans--instead of waiting to pull together the mound of compliance materials when the audits occur. Additionally, the information technology projects of HAVA are among the largest IT efforts in many States. They will require State and local funds beyond the Federal funds to complete. This application of State funds for IT projects possibly will trigger state-level audits and quality assurance reviews from State performance audit divisions, legislative post-audit organizations, and state information technology quality assurance groups. As to the HAVA money, there was virtually unanimous agreement that the funding would be somewhere between $0 and the $3.865 billion that Congress authorized (but did not appropriate). Even with full funding, national election officials estimated that the full cost to the states and localities eventually would reach $8 - $12 billion for complete implementation. Oh, yes, the congressional funding does not appear to pay anything for maintenance of the hardware and software of the expensive systems that will be implemented under HAVA. Just as we were preparing this issue of Election TechREPORTS^tm the US Senate passed an appropriation bill that contained $1.5 billion for the current fiscal year (2002-2003) that ends on September 30. The timing and nature of House action--as well as the President's budget advisors' reaction to the numbers--are uncertain. So, counties are moving ahead with plans to purchase new voting equipment. States are briefing their legislative sessions about what is coming--while they are starting to develop their State Plans. It is clear that the next three years will see a very large re-structuring of the relationships between state and local election officials in a majority of the states. It will be a new type and level of give and take between the states and the counties as the new structures take shape. In short, everyone is getting ready to get over it--because HAVA is the law. However, "getting over it" still does not mean that one size fits all in all the states or every state. It means that state and local election officials in every state will have to work together to develop solutions and schedules that fit their political and governmental situations--just like they have always done. Trying to "blame HAVA" for whatever the outcome is will be a sure path to failure. InfoSENTRY has pulled together a high-level project schedule in PDF format of the numerous tasks and deadlines listed in the Help America Vote Act of 2002. If you would like a copy of this file, click on and download HAVA2002_High-Level_Schedule.pdf . Return to Top of Page HAVA-Project^tm for Supporting States' HAVA Implementation and Compliance Efforts InfoSENTRY has developed and will use HAVA-Project^tm to assist our clients in dealing with the complexities of HAVA. As we have noted in last month's issue of Election TechREPORTS^tm, States and counties will be implementing some of the largest information technology networks in their jurisdictions. Counties that have not installed new voting equipment in decades will be specifying, purchasing, installing, and using substantially sophisticated voting systems--and integrating them into their existing networks. With HAVA-Project^tm we have developed a database application and a series of detailed project management templates that we can use to assist clients in handling the details of HAVA. The project schedule listed in the previous article has a couple of dozen high-level tasks and deadlines. Beneath each one of those tasks are multiple other projects, some of which will involve many hundreds of tasks. We customize our HAVA-Project^tm database and project template to assist in managing and monitoring the details of election project implementation. To handle many of the details involved in these projects InfoSENTRY uses the HAVA-Project^tm database to help clients: Organize and help index the myriad of HAVA planning documents, certifications, memos, reports, e-mails, letters, spreadsheets, graphic presentations, meeting minutes, and even videotapes that your HAVA project will generate and receive. Track and manage the thousands of issues, small and large, that will arise during implementation of your HAVA State Plan. Track appointments to the various committees, task forces, and commissions involved in your HAVA State Plan. Manage the agendas, attendance lists, minutes, and documents associated with the various public HAVA meetings. Maintain data on the hardware, software, and network connections in your State Plan's statewide voter registration system. Document the detailed needs and requirements of your statewide voter registration system. Document requirements of contracts with vendors and document the vendors' performance against those requirements. Develop user acceptance test scripts, tied back to those needs and requirements, and track user acceptance test results of developers' or vendors' software engineering efforts. Manage documentation required for HAVA compliance audits. To assist our clients in managing the numerous projects that will make up HAVA, InfoSENTRY has developed HAVA-Project^tmproject schedule templates in Microsoft Project to assist clients in: Conducting needs assessments and requirements analyses for statewide voter registration systems Implementation tasks for statewide voter registration systems, including software development, RFP preparation, proposal evaluation, user acceptance testing, network planning and deployment in the counties, hardware sizing and deployment in the counties, and user training Implementation tasks for selecting, user acceptance testing, and deploying vote tabulation systems. Meeting the various notification, certification, and compliance deadline requirements of HAVA. Developing security and business continuity plans for HAVA-related information systems. InfoSENTRY makes as much or as little of this information as you desire available through links on your website to HAVA-Net^tm . We will transfer documents from HAVA-Project^tm to the HAVA-Net^tm website and establish the links from your website at your instruction. InfoSENTRY and HAVA-Project^tm help elections offices focus their attention on the business of voter registration and elections while InfoSENTRY handles the organizing, and managing the details of what will be among the largest information technology projects and network implementations in state government. We offer a highly cost-effective method of outsourcing the most difficult parts of these projects to our experienced, vendor-neutral experts in election information technology. For additional information on InfoSENTRY's election consulting services and HAVA-Project^tm please e-mail glenn_newkirk@infosentry.com or call him at 919.838.8570. Return to Top of Page A Wormy Start for the New Year It has not been a pretty start to the New Year for the Internet. The year began with a moderately serious attach of the YaHa virus that apparently originated in Kuwait. Among other virus issues we have tracked, a "worm" aimed at Microsoft's SQL Server 2000 database management system ripped around the world in late January. It reportedly affected over 40,000 servers. SQL Server 2000 is a database management platform on which a number of vendors have build their election management information systems. The worm's payload did not appear to carry any additional malicious code that threatened programs or data. However, it did have the potential of flooding a server with attempts to re-infect an already attacked system. That effect could create a "denial of service" attack against a network. Speaking of "denial of service" attacks, Canada's NDP party conducted its leadership election by Internet near the end of this month. The project offered NDP party members throughout the country the opportunity to cast a vote for party leader. However, it appears that someone launched a "denial of service" (DOS) attack that flooded the central voting computer. The apparent attack delayed voting for approximately 45 minutes. However, the election effort continued and Toronto city councillor won the NDP leadership position. So, have a security management plan for your systems, keep the plan tested and up to date, apply security patches from system vendors, don't assume that no one would want to attack your mission critical Internet system, and maintain your backups! Return to Top of Page More Changing of the Guard Welcome to newly elected and appointed election officials around the country! Arizona Secretary of State Jan Brewer has appointed Mary Jo Kief as that state's new Election Director. Idaho Secretary of State Ben Ysursa has named former Cassia County Administrator Tim Hurst as his Chief Deputy Secretary of State with responsibility for elections. Kansas Secretary of State Ron Thornberg has appointed Mindy Miller as that state's HAVA project manager, working with Brad Bryant, the Deputy Assistant Secretary of State for Elections and Legislative Matters. Ohio Secretary of State Kenneth Blackwell has appointed Dana Walch to the new post of State Election Reform Director. South Carolina's State Election Commission announced that Marci Andino will serve as the agency's executive director. Nancy Blankenship is the new Deschutes County (OR) Clerk. Sherry Hall is the new Clackamas County (OR) Clerk. Please send information on election officials' comings and goings to elections@infosentry.com . Return to Top of Page Please click here to visit our main election systems consulting page. It has a table of contents for previous newsletter issues. Please click here to visit our main project management consulting page. It has examples of elections systems projects with which we have assisted clients throughout the country. Please click here to read a copy of our white paper on User Acceptance Testing. Please click here to read a copy of our white paper on After Action Reviews as a formal--but inexpensive and quick--way to capture lessons learned in information system projects. Please visit our main information technology consulting page and our information technology security and recovery page. They contain brief descriptions of some of our previous consulting engagements, including those for election jurisdictions. Please contact et@infosentry.com if you would like to get a PDF version or a laser printed copy of this newsletter for distribution in your election office. InfoSENTRY Services, Inc. 2 Hannover Square, Suite 1740 Raleigh, NC 27601 P.O. Box 28048, Raleigh, NC 27611 Phone: 919.838.8570 Glenn Newkirk's e-mail: glenn_newkirk@infosentry.com Copyright 2002, InfoSENTRY® Services, Inc. All fights reserved. Reproduction and dissemination without the express written permission of InfoSENTRY® Services, Inc. is strictly prohibited. InfoSENTRY Services, Inc. publishes Election TechREPORTS monthly, focusing on technology trends and issues in election offices. From time to time, Election TechReports might mention the name of vendors' hardware or software products. However, InfoSENTRY® Services is completely independent from hardware and software vendors. Mentions of vendors' hardware and software products in no way constitutes an endorsement or indication of worthiness for those vendors or products.

Election TechREPORTS^™
InfoSENTRY® Services www.infosentry.com info@infosentry.com
Issue 15 January 2003 Privacy Policy

FEATURE 1: HAVA: It's Not Just a Good Idea...It's the Law
FEATURE 2: HAVA-Project^tm for Supporting States' HAVA Implementation and Compliance Efforts
FEATURE 3: A Wormy Start for the New Year
FEATURE 4: More Changing of the Guard

HAVA: It's Not Just a Good Idea...It's the Law

The message going to attendees at January's meeting of the Joint Election Officials' Liaison Committee (JEOLC) in Washington, D.C. could have been taken from the Eagles song "Get Over It." The message from the Congressional staff members involved in drafting the bill seemed to reflect that great American philosopher Don Henley's (the Eagles drummer and sometimes lead singer) lyrics: "...stop whining and moaning and pitching a fit...get over it....get over it."

That message came in panel after panel. Another message was that every state and local election official in the country needs to focus on the "State Plan" required in the Help America Vote Act. An immediate question in most of the meetings was "Do States have to develop a plan and comply with HAVA's requirements if there is no or little federal funding?" The answer from JEOLC presenters and from congressional staffers was an unequivocal 'Yes."

There were a couple other definitive views that came from the JEOLC meetings. First, interest groups will prepare to file suit against States that do not comply with HAVA. Regardless of the level of monitoring by the Federal government, various voting rights and other interest groups will monitor states' HAVA implementations closely. It is up to the States to obtain or provide sufficient resources in order to assure compliance. It they do not, there is a good likelihood that an interest group will litigate the issue.

Second, if States accept funds under HAVA, they are clearly subject to Federal audits. It is not completely clear who will launch the audits, who will perform the audits, or when they will come, but they will be there. It is likely that both kinds of audits (that is, bean counting audits and compliance/performance audits) will be occur. It will be important for state and local election offices to pay attention to what the audit requirements might be as they develop the plans--instead of waiting to pull together the mound of compliance materials when the audits occur.

Additionally, the information technology projects of HAVA are among the largest IT efforts in many States. They will require State and local funds beyond the Federal funds to complete. This application of State funds for IT projects possibly will trigger state-level audits and quality assurance reviews from State performance audit divisions, legislative post-audit organizations, and state information technology quality assurance groups.

As to the HAVA money, there was virtually unanimous agreement that the funding would be somewhere between $0 and the $3.865 billion that Congress authorized (but did not appropriate). Even with full funding, national election officials estimated that the full cost to the states and localities eventually would reach $8 - $12 billion for complete implementation. Oh, yes, the congressional funding does not appear to pay anything for maintenance of the hardware and software of the expensive systems that will be implemented under HAVA.

Just as we were preparing this issue of Election TechREPORTS^tm the US Senate passed an appropriation bill that contained $1.5 billion for the current fiscal year (2002-2003) that ends on September 30. The timing and nature of House action--as well as the President's budget advisors' reaction to the numbers--are uncertain.

So, counties are moving ahead with plans to purchase new voting equipment. States are briefing their legislative sessions about what is coming--while they are starting to develop their State Plans. It is clear that the next three years will see a very large re-structuring of the relationships between state and local election officials in a majority of the states. It will be a new type and level of give and take between the states and the counties as the new structures take shape.

In short, everyone is getting ready to get over it--because HAVA is the law. However, "getting over it" still does not mean that one size fits all in all the states or every state. It means that state and local election officials in every state will have to work together to develop solutions and schedules that fit their political and governmental situations--just like they have always done. Trying to "blame HAVA" for whatever the outcome is will be a sure path to failure.

InfoSENTRY has pulled together a high-level project schedule in PDF format of the numerous tasks and deadlines listed in the Help America Vote Act of 2002. If you would like a copy of this file, click on and download HAVA2002_High-Level_Schedule.pdf .

Return to Top of Page

HAVA-Project^tm for Supporting States' HAVA Implementation and Compliance Efforts

InfoSENTRY has developed and will use HAVA-Project^tm to assist our clients in dealing with the complexities of HAVA. As we have noted in last month's issue of Election TechREPORTS^tm, States and counties will be implementing some of the largest information technology networks in their jurisdictions. Counties that have not installed new voting equipment in decades will be specifying, purchasing, installing, and using substantially sophisticated voting systems--and integrating them into their existing networks.

With HAVA-Project^tm we have developed a database application and a series of detailed project management templates that we can use to assist clients in handling the details of HAVA. The project schedule listed in the previous article has a couple of dozen high-level tasks and deadlines. Beneath each one of those tasks are multiple other projects, some of which will involve many hundreds of tasks. We customize our HAVA-Project^tm database and project template to assist in managing and monitoring the details of election project implementation.

To handle many of the details involved in these projects InfoSENTRY uses the HAVA-Project^tm database to help clients:

Organize and help index the myriad of HAVA planning documents, certifications, memos, reports, e-mails, letters, spreadsheets, graphic presentations, meeting minutes, and even videotapes that your HAVA project will generate and receive.
Track and manage the thousands of issues, small and large, that will arise during implementation of your HAVA State Plan.
Track appointments to the various committees, task forces, and commissions involved in your HAVA State Plan.
Manage the agendas, attendance lists, minutes, and documents associated with the various public HAVA meetings.
Maintain data on the hardware, software, and network connections in your State Plan's statewide voter registration system.
Document the detailed needs and requirements of your statewide voter registration system.
Document requirements of contracts with vendors and document the vendors' performance against those requirements.
Develop user acceptance test scripts, tied back to those needs and requirements, and track user acceptance test results of developers' or vendors' software engineering efforts.
Manage documentation required for HAVA compliance audits.

To assist our clients in managing the numerous projects that will make up HAVA, InfoSENTRY has developed HAVA-Project^tmproject schedule templates in Microsoft Project to assist clients in:

Conducting needs assessments and requirements analyses for statewide voter registration systems
Implementation tasks for statewide voter registration systems, including software development, RFP preparation, proposal evaluation, user acceptance testing, network planning and deployment in the counties, hardware sizing and deployment in the counties, and user training
Implementation tasks for selecting, user acceptance testing, and deploying vote tabulation systems.
Meeting the various notification, certification, and compliance deadline requirements of HAVA.
Developing security and business continuity plans for HAVA-related information systems.

InfoSENTRY makes as much or as little of this information as you desire available through links on your website to HAVA-Net^tm . We will transfer documents from HAVA-Project^tm to the HAVA-Net^tm website and establish the links from your website at your instruction.

InfoSENTRY and HAVA-Project^tm help elections offices focus their attention on the business of voter registration and elections while InfoSENTRY handles the organizing, and managing the details of what will be among the largest information technology projects and network implementations in state government. We offer a highly cost-effective method of outsourcing the most difficult parts of these projects to our experienced, vendor-neutral experts in election information technology.

For additional information on InfoSENTRY's election consulting services and HAVA-Project^tm please e-mail glenn_newkirk@infosentry.com or call him at 919.838.8570.

Return to Top of Page

A Wormy Start for the New Year

It has not been a pretty start to the New Year for the Internet. The year began with a moderately serious attach of the YaHa virus that apparently originated in Kuwait.

Among other virus issues we have tracked, a "worm" aimed at Microsoft's SQL Server 2000 database management system ripped around the world in late January. It reportedly affected over 40,000 servers. SQL Server 2000 is a database management platform on which a number of vendors have build their election management information systems. The worm's payload did not appear to carry any additional malicious code that threatened programs or data. However, it did have the potential of flooding a server with attempts to re-infect an already attacked system. That effect could create a "denial of service" attack against a network.

Speaking of "denial of service" attacks, Canada's NDP party conducted its leadership election by Internet near the end of this month. The project offered NDP party members throughout the country the opportunity to cast a vote for party leader. However, it appears that someone launched a "denial of service" (DOS) attack that flooded the central voting computer. The apparent attack delayed voting for approximately 45 minutes. However, the election effort continued and Toronto city councillor won the NDP leadership position.

So, have a security management plan for your systems, keep the plan tested and up to date, apply security patches from system vendors, don't assume that no one would want to attack your mission critical Internet system, and maintain your backups!

Return to Top of Page

More Changing of the Guard

Welcome to newly elected and appointed election officials around the country!

Arizona Secretary of State Jan Brewer has appointed Mary Jo Kief as that state's new Election Director.

Idaho Secretary of State Ben Ysursa has named former Cassia County Administrator Tim Hurst as his Chief Deputy Secretary of State with responsibility for elections.

Kansas Secretary of State Ron Thornberg has appointed Mindy Miller as that state's HAVA project manager, working with Brad Bryant, the Deputy Assistant Secretary of State for Elections and Legislative Matters.

Ohio Secretary of State Kenneth Blackwell has appointed Dana Walch to the new post of State Election Reform Director.

South Carolina's State Election Commission announced that Marci Andino will serve as the agency's executive director.

Nancy Blankenship is the new Deschutes County (OR) Clerk.

Sherry Hall is the new Clackamas County (OR) Clerk.

Please send information on election officials' comings and goings to elections@infosentry.com .

Return to Top of Page

Please click here to visit our main election systems consulting page. It has a table of contents for previous newsletter issues.

Please click here to visit our main project management consulting page. It has examples of elections systems projects with which we have assisted clients throughout the country.

Please click here to read a copy of our white paper on User Acceptance Testing.

Please click here to read a copy of our white paper on After Action Reviews as a formal--but inexpensive and quick--way to capture lessons learned in information system projects.

Please visit our main information technology consulting page and our information technology security and recovery page. They contain brief descriptions of some of our previous consulting engagements, including those for election jurisdictions.

Please contact et@infosentry.com if you would like to get a PDF version or a laser printed copy of this newsletter for distribution in your election office.

InfoSENTRY Services, Inc.
2 Hannover Square, Suite 1740 Raleigh, NC 27601
P.O. Box 28048, Raleigh, NC 27611
Phone: 919.838.8570
Glenn Newkirk's e-mail: glenn_newkirk@infosentry.com

Copyright 2002, InfoSENTRY® Services, Inc. All fights reserved. Reproduction and dissemination without the express written permission of InfoSENTRY® Services, Inc. is strictly prohibited. InfoSENTRY Services, Inc. publishes Election TechREPORTS monthly, focusing on technology trends and issues in election offices. From time to time, Election TechReports might mention the name of vendors' hardware or software products. However, InfoSENTRY® Services is completely independent from hardware and software vendors. Mentions of vendors' hardware and software products in no way constitutes an endorsement or indication of worthiness for those vendors or products.