Elections: Federal Program for Certifying Voting Systems Needs to Be Further Defined, Fully Implemented, and Expanded
GAO-08-814
Published: Sep 16, 2008. Publicly Released: Sep 16, 2008.
Skip to Highlights
Highlights
The 2002 Help America Vote Act (HAVA) created the Election Assistance Commission (EAC) and, among other things, assigned the commission responsibility for testing and certifying voting systems. In view of concerns about voting systems and the important role EAC plays in certifying them, GAO was asked to determine whether EAC has (1) defined an effective approach to testing and certifying voting systems, (2) followed its defined approach, and (3) developed an effective mechanism to track problems with certified systems and use the results to improve its approach. To accomplish this, GAO compared EAC guidelines and procedures with applicable statutes, guidance, and best practices, and examined the extent to which they have been implemented.
Recommendations
Matter for Congressional Consideration
| Matter | Status | Comments |
|---|---|---|
| To address the potentially longstanding void in centrally facilitated problem identification and resolution for non-EAC-certified voting systems, Congress may wish to expand EAC's role under HAVA such that, consistent with both the commission's nonregulatory mission and the voluntary nature of its voting system standards and certification program, EAC is assigned responsibility for providing resources and services to facilitate understanding and resolution of common voting system problems that are not otherwise covered under EAC's certification program, and providing EAC with the resources needed to accomplish this. | The Congress has not enacted legislation to expand EAC's role. |
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Election Assistance Commission | To assist EAC in building upon and evolving its voting systems testing and certification program, the Chair of the EAC should direct the commission's Executive Director to ensure that plans are prepared, approved, and implemented for developing and implementing detailed procedures, review criteria, and documentation requirements to ensure that voting system testing and certification review activities are conducted thoroughly, consistently, and verifiably. |
The Election Assistance Commission (EAC) has implemented this recommendation by developing and implementing standard operating procedures, specific review criteria, and additional documentation requirements for each step in the certification process (manufacturer registrations, voting system application review, and voting system testing). As of August 2010, the commission had created a standard operating procedure for both its manufacturer registration and voting system applications processes that provides detailed instructions; specifies timeframes for processing, reviewing, and approving applications; and identifies the personnel responsible for performing work. It had also enhanced the review criteria for both processes by defining ambiguous terms (such as "sufficient") found in its voting system guidelines. Documentation requirements were added for both processes, such as requiring the name and title of the reviewer and the Program Director's signature for approval. In addition, EAC significantly strengthened its voting system testing process by updating its Certification Program Requirements Matrix to provide detailed criteria for certain requirements, such as functional testing, wireless security, and the functioning of systems with voter-verifiable paper audit trails. Further, the commission established five defined criteria for approving or rejecting test plans and test reports and issued supplemental guidance specifying threshold criteria systems need to meet in order to be approved. By taking these steps, EAC has helped ensure that its voting system certification activities are conducted thoroughly, consistently, and verifiably.
|
| Election Assistance Commission | To assist EAC in building upon and evolving its voting systems testing and certification program, the Chair of the EAC should direct the commission's Executive Director to ensure that plans are prepared, approved, and implemented for developing and implementing an accessible and available software repository for testing laboratories to deposit certified versions of voting system software, as well as procedures and review criteria for evaluating related manufacturer-provided tools to support stakeholders in comparing their systems with this repository. |
The Election Assistance Commission (EAC) has not implemented the two elements of this recommendation. First, the commission has not established a more accessible and available repository for certified voting system software. EAC's Director for Voting System Testing and Certification stated in September 2012 that the commission will continue to store trusted builds and source code for certified voting systems in a locked, fire-proof safe in its offices rather than with an external repository and will physically package and ship copies of this material to election officials upon request. The director reported that this approach was based on the commission's limited budget and the shortfalls it found with candidate repositories, and that it has effectively satisfied the one request for comparison software it received since our report was issued. However, EAC's current approach remains problematic because several concurrent requests for certified software from election officials could still tax EAC's limited resources and be difficult to satisfy promptly and reliably. Second, the EAC has not established procedures and review criteria for evaluating the effectiveness and efficiency of manufacturer-provided voting system comparison tools. The Program Director told us in September 2012 that the commission requires voting system test laboratories to evaluate such tools and ensure they operate as intended by the manufacturer. However, the commission does not require that manufacturers or testing laboratories apply a standard set of evaluation criteria or test procedures to the tools and the commission has not developed any. Consequently, election jurisdictions still lack an independent framework for determining the accuracy, reliability, security, and usability of manufacturers' software verification tools. The absence of both of these elements of a robust software verification program means that state and local jurisdictions still lack the means to effectively and efficiently verify that voting systems used in federal elections are the same as those certified by EAC.
|
| Election Assistance Commission | To assist EAC in building upon and evolving its voting systems testing and certification program, the Chair of the EAC should direct the commission's Executive Director to ensure that plans are prepared, approved, and implemented for developing and implementing detailed procedures, review criteria, and documentation requirements to ensure that problems with certified voting systems are effectively tracked and resolved, and that the lessons learned are effectively used to improve the certification program. |
The Election Assistance Commission (EAC)implemented this recommendation by developing procedures, criteria, and documentation requirements that track and resolve problems with certified voting systems. Specifically, EAC's "Standard Operating Procedures for Conducting Certification Program Manufacturing Facility Inspections and Field Investigations", released in April 2010, defines roles and responsibilities for identifying and prioritizing manufacturing facilities to be inspected and contains step-by-step procedures for inspections, such as forming the inspection team, preparing an inspection plan, conducting the inspection, and reporting the results. It also defines criteria for determining whether a fielded system has a proper mark of certification, whether it is deployed in the appropriate configuration, and causal factors that underlie reported anomalies. EAC has also issued guidance on information to include in incident reports for both facility inspections and fielded system reviews. Moreover, between March 2011 and May 2012, EAC followed its procedures to initiate an investigation of anomalies with one its certified systems; produce a public report of its findings; issue a finding of non-compliance for the system in question; and then test and eventually certify a new and redesigned version of the system. By taking these actions, the EAC has helped improve the quality of voting systems in use across the country, and thereby foster public confidence in the electoral process.
|
Full Report
Topics
Best practicesCertification and accreditationDevelopmental testingElectionsFederal regulationsstate relationsInformation managementOperational testingProduct evaluationProgram evaluationProgram managementReports managementRequirements definitionSoftware verification and validationStandardsStrategic planningSystem softwareSystems analysisSystems evaluationSystems testingTestingVotingVoting systems