United StatesUnited States

www.eac.gov

Election Assistance CommissionElection Assistance Commission

EAC UOCAVA Documents: Status &Update

EAC Technical Guidelines Development Committee Meeting(TGDC)

July 26-27, 2011

1

UOCAVA Whitepaper - Purpose UOCAVA Whitepaper - Purpose

• This white paper provides a framework to assist federal and state policy makers, state and local election officials, the TGDC, and other stakeholders engaged in making decisions about the use of electronic technology for voting or creating standards for testing voting systems.

• This framework consists of a set of functional descriptions of the election administration and voter processes associated with absentee voting as prescribed by the Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) and other federal and state laws related to this Act.

2www.eac.gov

• Begins with a summary of the relevant features of UOCAVA voting and a comparison of UOCAVA voting and polling place voting.

• Provides functional level descriptions of the five processes directly associated with UOCAVA voting:

1. Prepare and submit voter registration application and/or absentee ballot request 2. Prepare and process voter registration applications and/or absentee ballot requests 3. Prepare and deliver absentee ballots 4. Receive, mark and return absentee ballot 5. Receive and process absentee ballot

• Discusses how process steps are affected when remote voting system technology is employed. (In contrast to the relatively minor procedural adjustments associated with the introduction of email, fax and web servers, this technology has a more significant impact because it automates many of the steps currently performed manually by Local Election Officials and voters.)

• Finally, draws comparisons between electronic document delivery technology and remote electronic voting systems.

UOCAVA Whitepaper - SummaryUOCAVA Whitepaper - Summary

3www.eac.gov

4

UOCAVA Whitepaper - UseUOCAVA Whitepaper - Use

• Paper presents high level functional descriptions of the processes associated with UOCAVA voter registration and voting.

• Development of process diagrams is especially helpful in understanding how a particular technology affects LEO workflow and the resulting implications for workload. A LEO could make level of effort estimates for the process steps involved with their current technology and see what might change with a different system.

• Because of the similarities in the way electronic document delivery systems operate, it may be possible to develop a common set of security criteria and testing requirements for the entire class. These criteria can be supplemented with technology specific requirements where necessary.

5www.eac.gov

UOCAVA Whitepaper – Process MappingUOCAVA Whitepaper – Process Mapping

• The use of remote electronic voting systems entails significant modification to LEO procedures. While these systems may simplify many aspects of a LEO’s work, this technology is complex and will require new system management and administration methods and supporting personnel with a information technology training.

• Process descriptions and flow diagrams are very useful analysis tools to aid in redefining LEO procedures to work effectively with new voting technologies.

Located Athttp://www.eac.gov/assets/1/Documents/

UOCAVA_Registration_and_Voting_Processes.pdf

6www.eac.gov

Survey of Internet Voting and Associated RiskSurvey of Internet Voting and Associated Risk

• More than 30 Projects surveyed, not including continuously used systems

• 6 Risk Assessments Located - Awaiting more• Various Standards Used by Other Nations• Analyzing and Drawing Conclusions from the data now• Awaiting review from various nations for accuracy

7

Comparing Nations - SIVARComparing Nations - SIVAR

EstoniaSponsor: National Election Commission

Election Type: European, Parliament, and Local Election

Date: See Table 3-2

Target Population: Estonian voters

Channel: Remote Electronic Voting: Uncontrolled PC

Technology Provider: AS Cybernetica

Channel Protection: Two-way SSL authentication

Participating Voters: See Table 3-2

Authentication: Two-factor: PIN and National ID Card

FinlandSponsor: Ministry of JusticeElection Type: Municipal ElectionDate: October 26, 2008Target Population: Registered Voters of Kauniainen, Karkkila and VihtiChannel: Remote Electronic Voting: Controlled EnvironmentTechnology Provider: TietoEnator, ScytlChannel Protection: VPNParticipating Voters: The EAC is unable to locate this informationAuthentication: One-factor: Proof of identity via a photograph presented to election

official 8

SIVAR - Addressing Risk SIVAR - Addressing Risk

Risk in EstoniaLevel of Risk AssumedThe E-Voting conceptions security: analysis and measures document contains a security analysis and a list of protection measures against major risks. A list of specific risks accepted by the Estonian National Electoral Committee is summarized below:

•Need to spend resources on organizational and technical security•Need to trust voter's computer and public network•Need to trust Central System computers•Impossibility to support all voters•Concentration of risks and the possibility of negative media report•Risks deriving from formalization of processes

9www.eac.gov

SIVAR - Turnout In Estonia SIVAR - Turnout In Estonia

Election Type Turnout Percentage

2005 Local Election 9317 47%

2007 Parliament Election 30275 62%

2009 European Parliament 58669 44%

2009 Local Election 104413 61%

2011 Parliament Election 140846 63%

10www.eac.gov

Authentication Mechanisms- SIVARAuthentication Mechanisms- SIVAR

Estonian National ID Card

11www.eac.gov

Understanding Systems - SIVARUnderstanding Systems - SIVAR

12www.eac.gov

SIVAR - Conclusions SIVAR - Conclusions

•Obtaining access to the information required to complete this report was difficult, as it took the resources of a federal agency to collate this information into a single document. •There is not a dedicated forum or organization for communicating experiences or sharing information with newer, interested parties. A forum such as this would facilitate the building of a standardized body of knowledge. Test Plans, Test Reports, experiences, and critiques could all be available for the betterment of others. • Sustained usage of internet systems is extremely limited.

13www.eac.gov

SIVAR - System Use Per Year SIVAR - System Use Per Year

14www.eac.gov

ContactContact

Brian Hancock, Director, Testing and Certification Division

U.S. Election Assistance Commission1201 New York Avenue, Suite 300Washington, DC 20005Phone: 202-566-3122Email: BHancock@eac.gov

15www.eac.gov