Election Advisory No. 2018-34

To:	County Elections Officers (County Clerks/Elections Administrators/Tax Assessors-Collectors)
From:	Keith Ingram, Director of Elections
Date:	October 15, 2018
RE:	Electronic Voting System Procedures Advisory

The purpose of this advisory is to provide an explanation of various voting systems provisions in the Texas Election Code and Texas Administrative Code and to prescribe additional procedures for voting systems in accordance with Section 122.001(c) of the Texas Election Code. Each section is outlined below, and followed by the glossary of terms for voting systems.

Section 1 – Acquiring a Voting System
Section 2 – Adopting a Voting System
Section 3 – Acceptance Testing
Section 4 – Election Set-up and Definition
Section 5 – Voting System Testing
Section 6 – Polling Place Preparation and Procedures
Section 7 – Central Accumulation Procedures
Section 8 – Post Election Audits
Section 9 – Voting System Security
Section 10 –Automatic Recount, if applicable
Section 11 – Requested Recount, if applicable
Section 12 – Retention of Election Material

Section 1 – Acquiring a Voting System (TEC Chapter 123, Subchapter B)

A contract for the acquisition of a voting system must be (1) in writing, and (2) approved by the Secretary of State. This approval is required to ensure that the voting system being acquired complies with applicable state requirements. The authority acquiring the equipment is required to submit to the Secretary of State a letter requesting approval of the acquisition of the voting system along with a copy of the relevant portions of the acquisition contract. The Secretary of State only needs the relevant portion of the contract that contains the information identifying the versions of the voting system and voting system equipment.

If a contract is approved, the Secretary of State will provide to the parties of the contract:

A letter stating that the voting system and voting system equipment being acquired satisfy the applicable approval requirements, and
A certified copy of the written order issued by the Secretary of State approving the voting system and voting system equipment

Any contract not approved by the Secretary of State is void. If a contract is not approved, the Secretary of State shall provide notice to the parties of the contract of the reasons that the contract was not approved. Executing a voting system equipment contract without the approval of the Secretary of State constitutes a Class B Misdemeanor.

Section 2 – Adopting a Voting System (TEC Chapter 123, Subchapter A)

A voting system must be adopted for use in any one or more elections by resolution, order or other official action. The adoption of a voting system may be modified or rescinded at any time. Additionally, the authority adopting the system should indicate in their official adoption action whether they are adopting the system for use in early voting only, regular voting on election day or both. The general custodian of election records is required to make any user or operator manuals or instructions relating to the system available for public inspection.

Adoption of a Voting System occurs by the following authorities:

General Election for State and County Officers: Commissioners Court
Primary Elections: County Executive of Party holding the primary
All Other Elections
1. The Commissioners Court, if ordered by the governor or a county authority,
2. The Governing Body of the Political Subdivision served by the authority ordering the election.

Section 3 - Acceptance Testing (Texas Election Code (TEC Chapter 129.021)

If your entity has purchased or leased new voting system equipment from a vendor, the entity is required to perform Acceptance Testing immediately upon taking delivery from a vendor of a new system or new equipment components.

As part of the Acceptance Testing, the entity is required to do the following:

Verify that the system delivered is certified by the Texas Secretary of State.
1. To verify the system, the entity must compare the following to the certification order:
  1. Model number and/or name of system.
  2. Software and/or firmware version.
Perform the following tests:

Hardware Diagnostic Test provided by 129.022(b), and
Logic and Accuracy (L&A) Test as provided by 129.023.

The entity MUST complete a system validation. Your vendor should provide you with specific instructions on how to validate that software that is being installed and used on your voting system is the same software that was certified by the EAC.

Section 4 - Election Set-up and Definition (TEC, § 125)

Prior to each election, there are a number of things you must do to properly configure your election systems. This section provides guidance on the pre-election actions you must take to prepare for an election.

Setting up Equipment:
1. In order to prepare for an election you will need to program and configure the following equipment that is used in your jurisdiction, if applicable:
  1. Election management system software,
  2. Electronic ballot marking devices,
  3. Direct recording electronic (DRE) voting machines,
  4. Precinct scanner,
  5. Central Scanners,
  6. Electronic pollbooks (e-pollbooks)
2. Establishing passwords and users -- As part of the set-up you should also:
  1. Set different passwords for each election on your Election Management System and on your voting system equipment, as applicable.
  2. Set up different authorized users for the software, as applicable.
    1. The number of users that have access to your election management system should be limited.
    2. The names and access levels must be documented, tracked and preserved for the duration of your entity’s use of your electronic voting system.
Programming or Coding your Voting System Ballot

Ballot Programming may be completed in one of the following ways.
1. Programming by Authority that Owns or Adopts a Voting System
  1. Programming or coding should be conducted in a secured location (129.051).
  2. Programming or coding should be completed with two individuals present, if available. This is to ensure that there is a witness to all actions taken with respect to the ballot.
  3. Poll watchers are not permitted to be present for this process.
  4. After the programming or coding is completed, you must store the electronic media or voting system equipment in a secure location and/or in the presence of an election official (129.051(b) and (c)).
  5. Chain of Custody must be verified at each step of the process.
2. Programming by Vendor
  1. If programming or coding is completed by vendor, you MUST track chain of custody of the electronic media throughout the entire process.
  2. If media is transferred between the entity and vendor via courier or common or contract carrier, there MUST be a tracking mechanism in place for the transport process.
  3. Upon receipt of the coded media, the entity must verify chain of custody for the transport process, AND the entity must verify chain of custody with the vendor. To verify chain of custody with vendor, you must have a document or tracking sheet signed by the last person to handle the media before it was deposited in the mail or handed to a courier.
  4. Upon taking delivery of media and verifying chain of custody, the coded media must be stored in a secure location or in the presence of an election official (129.051(b) and (c)).

Proofing the Programming

After programming, you will need to proof the programming of your election for accuracy, and proofing shall include, but not be limited to, the following:
1. Verifying races within each precinct;
2. Verifying precincts included in each ballot style;
3. Verifying candidates associated in each race;
4. Verifying party affiliation with candidates, if applicable;
5. Checking for all contests on ballot and verify that candidate/proposition spelling is correct;
6. Checking contest order;
7. Verifying the correct number of votes allowed for each race;
8. Verifying that write-in positions are correct, if applicable;
9. If available, verifying the audio ballot; and
10. Verifying straight-party associations to appropriate candidates in applicable elections.
11. (e-pollbooks) Verifying that the election was set up correctly, and that voters are assigned to the correct precinct/ballot style.

Back-Up Programming:

As part of your recovery plan, you will need to back-up your election programming at various stages of the election definition process.
1. At a minimum, as soon as you finish the programming of your election and it’s been locked down, create a back-up copy for storage at a secure off-site location.
2. If another entity does your programming, keep your own back-up copy at a secure off-site location that is in your control, not the programming entity’s control.

Security and Record Retention:

The election setup materials shall be secured by limiting access to the person or persons so authorized in writing by the county clerk and/or election official.
Any audit logs and ballot definition files created shall be included with retention material for that election as outlined in Retention of Election Materials in Section 12.

Section 5 - Voting System Testing (TEC, Chapters 125, 127 and 129)

Three types of voting system testing shall be performed for each election within a jurisdiction. The three tests are:

Hardware Diagnostic Test,
Logic and Accuracy (L&A) Test/Testing of Tabulation Equipment, and
Post-Election Audit (Partial Manual Count).

Hardware Diagnostic Test (TEC § 129.022):

The general custodian of election records shall commence the Hardware Diagnostic Test prior to the election and allow time for each electronic voting device to be deployed, tested, repaired and/or replaced, if necessary. Each device shall be tested to verify that mechanical components are working correctly. This test shall include, but not be limited to, the following:

All input and output devices;
Communications ports;
System printers;
System screen displays;
Boot performance and initializations;
Firmware and/or software loads;
Confirmation that screen displays are functioning;
Verify and adjust to correct date and time, if necessary;
Verify and adjust calibration, if applicable;
Confirm that the unit is cleared of votes;
Confirm that it is configured for the current election; and
Confirm that physical security devices are in working order (locks, seals, etc.)

Logic and Accuracy (L&A) Test/Test of Tabulation Equipment (TEC, § 129.023 and subchapter D, Chapter 127)

The designated general custodian of election records shall conduct both a Logic and Accuracy Test and a Test of the Tabulation Equipment.
Logic and Accuracy Test: Prior to the commencement of voting and no later than 48 hours before voting begins on the equipment, the designated general custodian of election records shall conduct the public Logic and Accuracy Test. NOTE: The Secretary of State (SOS) recommends conducting testing prior to mailing out mail ballots to ensure there are no issues with how the ballot has been coded.
Testing Board: The designated general custodian of election records shall create a Testing Board consisting of at least two persons. The general custodian of election records shall make every reasonable effort to ensure that the testing board consists of at least one person from each political party that holds a primary election. (129.023(a).
Notice Requirement: A public notice must be published at least 48 hours prior to the testing. This notice must be published in the same paper you publish your election notice. The public Logic and Accuracy Test shall be open to representatives of the press and the public. (129.023(b)).
Internal L&A Test: An internal L&A test should be done soon after the programming and proofing of your election is complete. This will provide you time to make corrections as necessary and be better prepared for the public L&A test.
Test Ballots – In preparation for the Logic and Accuracy Test, the designated general custodian of election records shall design a method which directs the Testing Board to cast votes which will verify that each precinct, ballot style, and contest position on the ballot can be voted and is accurately counted.

This can be done by marking test ballots or providing the Testing Board with some other form identifying how each test vote shall be cast. NOTE: The SOS strongly recommends that you devise your own test ballots, rather than using the test deck provided by the vendor.
The test ballots for ballots that are read by a scanner must be prepared on the same ballot stock as the official ballots.

The General Custodian of Election Records shall develop written procedures for the testing. The testing shall include:

Overvotes and undervotes for each race
Write-in votes, when applicable.
Straight party votes and crossover votes, as applicable.
Electronic processing of provisional votes, if applicable to the system being used (129.023(c)).

The testing shall be designed in a manner which provides a different number of vote totals for at least three candidates in races with more than two candidates, or each candidate in races with exactly two candidates.

The predetermined results must be pre-calculated from the test ballots to allow comparison after the votes are tallied. (129.023(c)(10)).

An appropriate number of voting devices will be available and the Testing Board may witness the necessary programming and/or downloading of memory devices necessary to test the specific precincts.
Prior to the start of testing, all devices used will have the public counter reset to zero and presented to the testing board for verification.
Conducting the test:

Ballot Marking Devices and DREs:

Manual vote choices are made by entering the votes indicated on the Test Ballot or designed form as stated above. To help prevent human error, all entries are made by a team of two people. One person calls out the votes and one person enters. Both team members verify the votes on the summary screen before the ballot is cast or printed.
To test the audio, at a minimum, one set of vote choices will be entered using the audio feature. Both team members listen to the summary prior to casting or printing the ballot.

Ballot Marking Devices: Verify that the printed ballot reflects the choices entered on the Ballot Marking Device. Also, if applicable, process the marked ballots with the scanning equipment (precinct ballot scanner or central scanner).
Scanner Based Systems (Precinct or Central Scanners) Scanning Equipment must be tested as prescribed in Chapter 127, Subchapters D and F. Pursuant to Section 127.094(e) the design of the test ballots must also include the design in subsection (f) above.
Accessibility Testing: For each feature of the system that allows disabled voters to cast a ballot, at least one vote must be cast and verified by a two-person testing board team using that feature; this includes, but is not limited to all audio functions, large font functionality, and sip-and-puff functionality. As a reminder, all components should be checked during the Hardware Diagnostic Test as well.

Other Testing Measures:

Modeming From Regional Substations: If you transmit results via modeming from regional central counting stations to the main central counting station, test the transmission of results by modem, if applicable.

Finalizing L&A Test:

When all votes are cast, the designated general custodian of election records and Testing Board shall observe the tabulation of all test ballots and compare the results to the predetermined results.
A test is successful if the results report of the electronic voting system matches the predetermined results. The voting system should otherwise function properly during the counting of the test ballots.
If the initial test is unsuccessful, the general custodian of election records shall prepare a written record of what caused the discrepancy and what actions have been taken to achieve a successful test. The record shall be retained with the test materials.

Verification: The Testing Board and the general custodian of election records shall:

Sign a written statement attesting to the qualification of each device that was successfully tested, any problems discovered, and the cause of any problem if it can be identified, and
Provide any other documentation as necessary to provide a full and accurate account of the condition of a given device. We recommend that the number/characters of the seal attached to the voting device at the end of the test should be included in the written statement.

The SOS has issued form AW 6-2, Certification of First Test of Automated Tabulating Equipment (PDF), for this purpose.

Record Retention:

Upon completion of the testing, the Testing Board shall witness and document all steps taken to reset, seal, and secure any equipment or test materials, as appropriate; and the general custodian of election records shall preserve a copy of the programming data used during the testing at a secure location that is outside the administrator’s and programming entity’s control for the duration of the preservation period related to that election day.
All test materials, when not in use, shall be kept in a container with a uniquely identified tamper-resistant or tamper-evident seal. The general custodian of election records and at least two members of the Testing Board shall sign the seal. (129.024).

The designated general custodian of election records shall be the custodian of the container.
The container may not be unsealed unless the contents are necessary to conduct a test under Chapter 129, Subchapter B or a criminal investigation, election contest, or other official proceeding under the Election Code. If the container is unsealed, the general custodian of election records shall reseal the contents when not in use. (129.024(c)).
The test materials shall remain sealed for the period for preserving the precinct election records. (129.024(b)).

Test of Tabulation Equipment: The tabulation supervisor and counting station manager of the central counting station shall prepare and test the central accumulator system three times as required by Chapter 127, Subchapter D Times for Conducting Test. The test shall be conducted as part of the Logic and Accuracy testing explained above.

Design of Test:

The test must be designed to determine whether the central accumulator system accurately tabulates results from the electronic files used to count ballots voted in the election.
The electronic files created from the Logic and Accuracy testing for the election must be used in the process of this test.

Conduct of Test One:

The general custodian of election records shall publish notice of the date, hour, and place of the first test conducted under 127.093(b) in a newspaper, as provided by general law for official publications by political subdivisions, at least 48 hours before the date of the test. (This is the same notice as your public L&A test.)
Internal Test: SOS Recommendation - An internal Test of the Tabulation Equipment should be done soon after the programming and proofing of your election is complete. This will provide you time to make corrections as necessary and be better prepared for the public test.
The first test is open to the public.
Verify that your system has been reset to zero and print out a zero report prior to performing the test.
If the initial test is unsuccessful, the counting station manager shall prepare a written record of what caused the discrepancy and what actions have been taken to achieve a successful test. The record shall be retained with the test materials.
When a test is successful, the tabulation supervisor and counting station manager shall certify in writing that a test was successful and the date and hour the test was completed. The certification shall be retained with the test materials.

Determining Success of Tabulation Test: A test is successful if a perfect count of the electronic files, that contain the cast vote records (ballot images) and/or device results, is obtained and the central accumulator system otherwise functions properly during the counting of the test electronic files.
Security of Test Materials: On completion of the test, the counting station manager or tabulation supervisor shall place the test electronic files, or a copy of the test electronic files, and other test materials in a container provided for that purpose and seal the container so it cannot be opened without breaking the seal. The counting station manager and tabulation supervisor, and not more than two watchers, if one or more watchers are present, shall sign the seal or seal log, as applicable. The watchers must be of opposing interests, when possible.
Custody of Test Materials: The counting station manager is the custodian of the test materials until they are delivered to the general custodian of election records.
Requirements for Test Two of Tabulation Equipment:

The second test shall be conducted immediately before the counting of ballots or accumulation of vote totals begins on the equipment.
The Central Counting Station (CCS) Manager and the Presiding Judge shall verify that the seal is intact on the secure container with the test materials.
After verification, the CCS Manager and the Presiding Judge shall break the seal and remove test materials.
The test materials used for Test One shall be reused for Test Two. If the results from Test Two match the results from Test One, it will be considered a successful test.
If the test is successful, the Presiding Judge shall certify in writing that a test was successful and the date and hour the test was completed. This certification shall be retained with the test materials. (127.097)
The test materials shall be stored in a secure container until Test Three is performed.

Requirements for Test Three of Tabulation Equipment.

The Third Test shall be conducted after the counting of ballots or accumulation of vote totals has been completed.
The Central Counting Station Manager and the Presiding Judge shall verify that the seal is intact on the secure container with the test materials.
After verification, the CCS Manager and the Presiding Judge shall break the seal and remove test materials.
The test materials used for Test One and Test Two shall be reused for Test Three. If the results from Test Two match the results from Test One, it will be considered a successful test.
If the test is successful, the Presiding Judge shall certify in writing that a test was successful and the date and hour the test was completed. This certification shall be retained with the test materials. (127.097)
Unsuccessful Test Three;

If the test is unsuccessful, the ballot count is void, and the testing authority shall prepare a written record of what caused the discrepancy and shall repeat the test. If the test is successful, the testing authority must document what actions have been taken to achieve a successful test. The record shall be retained with the test materials.
If the testing authority is unable to achieve a successful test, the ballot count is void and the ballots must be counted manually, if applicable or with an alternative type of tabulating equipment

Precinct Ballot Counters and DREs:

The Secretary of State has determined that it is not feasible to conduct the 2nd and 3rd test of the Tabulation Equipment on precinct ballot scanners and on DRE as described in 127.152(b). However you are still required to conduct to the test on any central accumulator used to accumulate your election media and/or generate election results.

Section 6 - Polling Place Preparation and Procedures

The following procedures should be taken at the polling place:

General Procedures

Arrange the polling place to allow full view by presiding judge and election clerks of voting and voter activity to guard against unauthorized access while protecting voter privacy.
The voting equipment must be in sight of the presiding election judge and/or an election clerk at all times while the election is being conducted.
The election official shall periodically check for evidence of tampering on voting equipment during the election. For example, make sure the uniquely identified tamper-resistant or tamper-evident seal is still intact. (TEC § 125.005).
Restrict/monitor physical access to equipment when the presiding election judge and election clerks are not present.
Equipment Failure During Voting:

Procedures and plans shall be written for handling election day equipment failure, including backup and contingency plans. (See TEC § 125.006 for further details).
If a DRE malfunctions during voting and there have been votes cast on that machine, extra precaution should be taken to protect the cast vote records (ballot images) and audit logs stored on that DRE. Secure the equipment and document the chain of custody when transporting the equipment to another location. (TEC § 125.006).

Fleeing Voter:

When a voter begins the process of making ballot selections but leaves without casting a vote on a DRE, a polling place official must cancel the electronic ballot and document the cancellation.
When a voter leaves without fully depositing their paper ballot into the optical/digital scanner or ballot box, this ballot must be treated as a spoiled ballot, and the presiding election judge or an election clerk shall cancel the ballot and document the cancellation.

Provisional Voter:

Provisional votes may be cast electronically on a direct recording electronic voting system only if the system segregates provisional votes from regularly-cast votes on the election day precinct returns. Verify that no conditions are listed on the Secretary of State certification document for your system that would restrict the use of electronic provisional voting. (TAC § 81.176).

Curbside Voter:

If the voter is physically unable to enter the polling place without assistance or likelihood of injury to the voter’s health, then the voter may vote at the curbside.
A presiding election judge or election clerk shall deliver the voting device to the curbside voter.
Make sure to allow the curbside voter the same privacy as a voter in the polling place

Opening the Polls

The presiding election judge shall verify and document the unique identifier (e.g., serial number) of the equipment delivered to the polling site.
Look for evidence of tampering and document the time this was done.
Verify that the Public Count is “0” on each applicable device.
Check the accuracy of the date and time on applicable equipment.
Confirm that all units are open for voting, as applicable; and
At a minimum, print one zero tape from each applicable device, as follows:

The presiding election judge, an election clerk, and not more than two watchers, if one or more watchers are present, shall sign the zero tape.
Maintain zero tapes in a secure location to be returned with election materials (i.e., Ballot Box #4 or other secure means designated by the general custodian of election records). NOTE: Certain counties participating in the Countywide Polling Place Program that use the Hart eSlate have a modified procedure regarding the printing of zero tapes. Please contact the SOS for a copy of these procedures.

Closing the Polls

Verify and document the public count on applicable devices.
Verify that the public count(s) match the number of voters that have signed the combination form or checked in for voting through an epollbook. If there is a discrepancy, the presiding judge should attempt to determine the source of the discrepancy and document their investigation.
After the polls have been closed on election day, the precinct election officials shall print out, at a minimum, three copies * of the results tape from each applicable device, and secure the voting device against further use. (WARNING: Do not print out the results tape during Early Voting; this includes the last day of Early Voting). NOTE: Certain counties that participate in the Countywide Polling Place Program and use the Hart eSlate, have a modified procedure regarding the printing of results tape. Please contact the SOS for a copy of these procedures.

The presiding election judge, an election clerk, and not more than two watchers, if one or more watchers are present, shall sign the results tape(s).
The copies of the results tape(s) shall be distributed as follows:

Envelope #1 that is delivered to the presiding judge of the canvassing authority;
Envelope # 2 that is addressed to the General Custodian; and
Ballot Box #3 (or other secure means designated) that is delivered to the general custodian of election records, along with other election media and materials. *NOTE: Some entities may opt to only print two copies of the results tape as two of the three copies are being returned to general custodian.

Lock and secure the voting equipment and other election material from any physical access to prepare for transport.

Central Counting Station: For entities that have established a central counting station for the purpose of counting or accumulating voting system results -- the results tapes that are printed at the polling place are NOT considered the official precinct returns. The official returns will be prepared at the central counting/accumulation station and certified by the presiding judge of the central counting/accumulation station in accordance with Section 127.131 of the Texas Election Code.
Precinct Scanners: For additional procedures specific to Precinct Ballot Counters, please see Advisory 2017-17 – Updates to Voting System Procedures –Precinct Ballot Counters.

Early Voting Procedures.

Opening the polls procedures above also apply to the 1st day of early voting.
Opening the polls on the 2nd thru last day of early voting shall be handled as follows:

Look for evidence of tampering and document the time this was done;
Verify and document that the numbers on the public counter match the number of voters documented on the early voting by personal appearance roster at the close of polls on the previous day; and confirm that all units are open for voting.

Suspending and securing the Polls during Early Voting by personal appearance, except for the last day.

Verify and document that the numbers on the public counter match the number of voters documented on the early voting by personal appearance roster at the close of polls on the previous day;
Lock and secure voting equipment, so no additional votes may be cast on the voting equipment; and
Restrict physical access to voting equipment.

Early Voting: Secure Early Voting location at the end of each day and store the equipment in a secure location to prevent theft or tampering after hours. If early voting clerk is unable to secure voting system equipment at early voting location, the equipment should be returned daily to the early voting clerk’s office and redeployed on a daily basis.
If the early voting device is being moved to another temporary location, the instructions listed in Section 9 of this document should be followed.

Closing the polls on the last day of Early Voting: Verify and document that the numbers on the public counter match the number of voters documented on the early voting by personal appearance roster at the close of polls on the previous day and be sure to:

Look for evidence of tampering and document the time this was done
DO NOT PRINT THE RESULTS TAPE (tape will be printed later at the central counting station); and
Lock and secure the voting equipment and other election material from any physical access to prepare for transport.

Section 7 – Central Accumulation Procedures (TEC, Chapter 127)

Election Night Verification for Central Accumulation System:

As the media is loaded into a central accumulator, the election official shall verify that the vote totals on the electronic media match the vote totals on the printed results tape, if applicable.
After uploading all precinct results to the central accumulator system, the election official must verify and document that the central accumulator’s total number of votes cast in an election matches the number of signatures on the combination form. If there is a discrepancy, the presiding judge of the counting station in conjunction with the central counting station manager shall determine if a further audit is necessary.

Transferring Results from Secure Computer/Server

Any time data is transferred to another computer, the transfer may only occur with the following devices:

Single use DVD/CD,
Single use, disposable, removable USB thumb drive, or
Re-formatted, multi-use removable USB thumb drive.

In order to maintain the secure nature of the central accumulator, approved users should only use clean, removable media devices. These device should not have been previously used on any other computers or hardware. If they have been previously used, they must be properly reformatted each and every time they are inserted into the secure, central accumulator.

Audit Logs from Central Accumulators:

All central accumulators certified for use in Texas elections maintain an internal audit log. Some of the legacy systems still maintain a continuous feed audit log printer. These audit logs (both internal and produced by continuous feed printers) are considered election records. They must be maintained with the election records for the proper preservation period.
A full copy of the central accumulator’s audit log must be printed after the tabulation of election results on election night. If an entity is using a continuous feed audit log printer, the attached log will serve as this required printed copy.
The printed copy of the log must be retained with the election records for the preservation period.
Poll watcher access to Audit Logs (1 TAC 81.62(g))

A poll watcher may request a printed copy of an audit log produced by a central accumulator:

Before any votes are tabulated,
After early voting results are tabulated, and
Immediately following the completion of the vote tabulation

Once a request for a report has been made, the central counting station manager or tabulation supervisor is required to print a copy of the audit log at the required time, and make a copy of it available to any and all poll watchers that have requested a copy of the audit log. The CCS manager should NOT remove or tear off the audit log maintained by any continuous feed audit log printer, if one is being used with voting system in use.
Poll watchers do not get to specify the format of the audit log produced on election night. The central counting station manager has discretion as to whether to provide a copy of the audit log printed from the internal logs or provide a copy of the audit log produced from the continuous feed audit log printer.

If the central counting station manager opts to use the audit log from a continuous feed audit log printer, then the poll watchers will only receive their copy of the log at the end of the night as it is not feasible to provide a copy of the log at the intervals stated above. Tearing the printed audit log to provide a copy to poll watchers would compromise the integrity of the audit log.

Central Counting Station Plan (TEC 127.007): The manager of the central counting station is required to establish and implement a written plan for the orderly operation of the central counting station. That plan must be made available to on request not later than 5 p.m. on the fifth day before the date of the election. For details on what should be included in the central counting station plan, please see Advisory 2017-16.

Section 8 - Post-Election Audit (Partial Manual Count) (TEC, Chapter 127)

To ensure the accuracy of the tabulation of electronic voting system results, the general custodian of election records shall conduct a manual count of all the races in at least one percent of the election precincts or in three precincts, whichever is greater, in which the electronic voting system was used.

In a general election for state and county officers, primary election, or election on a proposed amendment to the state constitution or other statewide measure submitted by the legislature, the Secretary of State shall notify the election official, on the day after the election, of the selected precincts that must be manually counted. The election official shall begin the manual count within seventy-two (72) hours after the polls close. (127.201(b)).
All Other Elections: The custodian shall select the precincts at random and shall begin the count not later than 72 hours after the polls close. The count shall be completed no later than the 21st day after Election Day. (127.201(a)). Section 127.201(b) supersedes this section to the extent of a conflict.
The SOS will send out detailed instructions regard the partial manual count prior to the election it applies to.
See Advisory 2018-30 for additional details on the partial annual count.
Post-Election Verification for Central Accumulation System:

To ensure the accuracy of any central accumulation software used to accumulate vote totals from electronic voting systems, the general custodian of election records shall conduct a post-election verification of the same precincts and races selected for the partial manual count either by the general custodian of election records or the Secretary of State, whichever is applicable.
The general custodian of election records shall verify that the vote total(s) printed on the results tape from the voting system equipment used at a given precinct or polling place matches the reports generated by the central accumulation software.
The general custodian of election records has the discretion to verify a greater number of precincts than specified above.
The reconciliation shall consist of a race-by-race comparison of the number of votes reported on the precinct results tape to the central accumulator’s unofficial election results report that was generated on election night.
If there is any discrepancy in the comparison, the results tape from the precinct level shall constitute the official results.
Any political subdivision that utilizes modem transfer of election results from sub-stations to the central counting station for the purpose of being combined with other such tabulations to produce complete returns shall establish procedures to reconcile received tabulations to transmitted tabulations in order to determine if any discrepancies exist. NOTE: Modeming results from a polling place location to the central counting station is prohibited under Texas law.

Section 9 - Voting System Security

Personnel Security (TEC § 129.051(g)): Employees authorized by the county clerk or election official to prepare or maintain the voting system or election setup materials shall be deputized by the county clerk or election official for this specific purpose and so sworn, with the following oath, prior to the first election of the calendar year in which they will be performing one or more of these activities

“I swear (or affirm) that I will faithfully perform my duty as an officer of the election and guard the purity of the election.” (Section 62.003 of TEC)

Criminal Background Checks Required (TEC § 129.051(g)):

In accordance with Section 129.051(g) of the Texas Election code, the General Custodian of election records shall conduct criminal background checks for all election officials, staff and temporary workers who are engaged in pre-election programming, testing and preparing of the voting system equipment for Early Voting and Election Day. This does not include poll workers (election judges and clerks) assigned to work election voting centers or precincts, but does include temporary workers hired to test, store, or service voting equipment. Additionally, this includes all individuals that participate in both pre-election Logic and Accuracy Testing and pre-election testing of the tabulation equipment.
A person having a criminal record is not automatically disqualified from working with electronic voting equipment. However, the hiring entity should consider the nature of the crime(s) in determining whether to hire or assign voting system duties to an individual with a criminal record. You may wish to consult with your Human Resources Department to develop a policy similar to your governing body’s regular employment policy regarding persons with a criminal background.
If you contract with your vendor to program, test, or perform maintenance on the voting equipment prior to an election, you may wish to require the vendor to certify that a criminal background check has been performed on the necessary employees. We recommend that part of your agreement or contract with the vendor include wording that they (the vendor) have performed that duty. Suggested language to include:

_______________ Company certifies that a criminal background check on all employees, including temporary employees, that may program, test, perform maintenance, transport equipment, or perform technical support on the voting system equipment for (name of entity) has been performed. The Company has determined there are no findings that would prevent the employees from performing their assigned duties.

Criminal background checks conducted through the Texas Department of Public Safety (“DPS”) Crime Records Service will provide information on arrests, prosecutions and the disposition of the case for persons arrested for Class B misdemeanor or greater violation of Texas criminal statutes. This is part of the Conviction Database that is extracted from the DPS Computerized Criminal History System (“CCH”). Election custodians will be required to create a secure online account via the DPS website to conduct criminal history checks via CCHS. DPS has requested that each county elections custodian register the county with the user name that fits this formula: “Name of Your County/Elections” (e.g. Upshur County/Elections).
Elections custodians will be required to sign a User Entity Agreement and a User Acknowledgement Agreement and fax completed documents to DPS. These documents will be presented to you online when you register for an account. Print each document and follow the instructions provided online, but fax the documents instead of mailing them as indicated on the website. When forwarding these documents, include a letter on your county letterhead requesting access to the secured CCHS and stating that the secured system search will be used in accordance with Texas Election Code § 129.051(g).
It can take up to four (4) weeks to establish an account, but once activated, authorized county personnel will be able to conduct background checks as required by Texas Election Code § 129.051(g). If you need assistance accessing the DPS website, please contact the DPS representatives at 512-424-2474.

Pre-Election Security Procedures:

Unique Identifier: All electronic media (e.g., USB drives, memory cards, compact flash card, PCMCIA card, PEBs, voter card encoders, supervisor cards, and key cards) shall have an external permanent unique identifier (e.g., numbers, letters, or combination of numbers and letters). The identifier can be either etched or printed on a tamper resistant label. (Recommendation: include a barcode on the label, which will make it more efficient to inventory). (TEC § 129.051)
Inventory: The general custodian of election records shall create and maintain an inventory of all electronic information storage media.
Chain of Custody of Electronic Media: The general custodian of election records shall create a process and maintain a procedure for tracking the custody of electronic information storage media from their storage location, through election coding, through the election process, to their final post-election disposition and return to storage.

The chain of custody must utilize two or more individuals to perform a check and verification check whenever a transfer of custody takes place.

Secure Storage of Election Media: The general custodian of election records shall create and maintain a secured location for storing the electronic information storage media when not in use, for coding a medium for an election, for transferring and installing the medium into the voting system equipment, and for storing the voting system equipment once the election parameters are loaded.

An election information storage medium shall be kept in the presence of an election official or in a secured location once the medium has been coded for an election.
For each election, the general custodian of election records or their assigned staff shall seal each election information storage medium in its relevant voting device or container utilizing one or more uniquely identified tamper-resistant or tamper-evident seals.
A combined master identification of the voting device equipment, the election information storage medium, and the seal(s) must be created and maintained.
For election information storage medium that are device independent (e.g., PEBs, voter card encoders,), these devices should be stored in a secured, sealed container and must also be identified on a master log.

Chain of Custody of Voting System Equipment: The general custodian of election records shall create a process and maintain a procedure for tracking the custody of the voting device equipment once the equipment is loaded with an election definition.

The chain of custody must utilize two or more individuals to perform a check and verification check whenever a transfer of custody takes place.

Recovery Plan: The general custodian of election records shall have in place a recovery plan that is to be followed should there be an indication of a security breach in the accountability and chain of custody procedures. The plan must include notifying the Secretary of State’s office immediately. Any indication of a security breach must be confirmed by more than one individual.
Training Plan: The general custodian of election records shall have a training plan for relevant election officials and staff that addresses these security procedures and the relevant work instructions.

Storage and Transport of Voting System Equipment (TEC § 129.052):

The general custodian of election records shall adopt procedures for securely storing and transporting voting device equipment. This shall include procedures that are to be used at locations outside the direct control of the general custodian of election records, such as overnight storage at a polling location.
Secure storage must employ the use of uniquely identified tamper-resistant or tamper-evident seals and logs, or other security measures that will detect any unauthorized access.
For each election, the general custodian of election records shall create and maintain an inventory of these items for each storage location.
The chain of custody must utilize two or more individuals to perform a check and verification check whenever a transfer of custody takes place or where the voting devices have been left unattended for any length of time. Particular attention must be given to the integrity of the tamper-resistant or tamper-evident seals.
The general custodian of election records shall have a method of recording the names of the individuals who transport the voting system equipment and materials from one site to another and the time they left the sending site; and
A method of recording the time the equipment transporters arrived at the receiving site and the name of the individual(s) at the receiving site who accepted the election equipment and material.

Restrict Access to Voting Systems (TEC § 129.053)

The general custodian of election records shall secure access control keys or passwords to voting system equipment. Use of access control keys or passwords must be witnessed by one or more individuals authorized to use that information. The use of an access control key or password must be documented and witnessed in a log dedicated for that purpose that is retained until the political subdivision disposes of the equipment.
The general custodian of election records must maintain these access control keys/passwords in a secured and controlled environment.
The general custodian must utilize a form, letter or a list to document and indicate the following:

List of individuals that are given an access control key or password (based on duties, positions),
What privileges they are given,
When and where these privileges can be used, and
An indication that the granting of access came from the general custodian of election records.

If an individual leaves, changes roles, or positions or no longer requires access, the documentation that granted access to the individual needs to be updated and amended to remove the person’s eligibility. Any keys distributed should be collected and passwords should be changed as applicable.
Changes to the encryption keys and passwords are at the discretion of the general custodian of election records, but it is advisable that this discretionary authority should not be delegated. However, the individuals(s) that implement the change must have this “authorization to change” responsibility delineated within their position descriptions(s). (Note the distinction relative to describing who may authorize a change, who implements a change, and who has access but cannot change the passwords and encryption keys.)

Where appropriate, the degree of access should be defined within each relevant position description and maintained at that level within the election management system and/or equipment. This applies where a voting system can limit an individual’s access to certain menus, software modules, etc.

An access log should be developed and utilized to document access to any device, election media, or election management system that requires the use of a password and/or encryption tool. If possible, access should be witnessed by one or more individuals authorized to use such information.

The log should be retained throughout the life of the device or election management system.
The general custodian of election records shall ensure the protection of the election tabulation process by securing the premises where the vote tabulation is being conducted and not allowing unauthorized and unescorted personnel to be in contact with tabulation equipment.
The general custodian of election records shall have a training plan for relevant election officials, and staff that address these security procedures and the relevant work instructions.

Prohibit the Use of Network Connections and Restrictions on Wireless Technology (TEC § 129.054):

No voting system shall be connected to any exterior communications network, including a connection to the Internet.
A voting system may not have the capability of permitting wireless communication unless the system uses line-of-sight infrared technology that shields the transmitter and receiver from external infrared transmissions and the system can only accept transmissions generated by the system.

Restrict Usage of Voting System Computers (TEC § 129.055):

All voting system computer(s)/server(s) shall be restricted to the sole purpose of election administration, and not used for other purposes.
Only the applicable operating system, commercial off-the-shelf software (COTS) needed for the election process, and the certified voting software shall be loaded on a voting system computer/server.
Remote Access to a voting system computer/server is not allowed.

Plan for Machine Failure (TEC § 129.056):

The general custodian of election records shall create a contingency plan for addressing direct recording electronic voting machine failure. This plan must include timely notification to the Secretary of State’s office.
The plan should address the creation of emergency ballots, ballot boxes, transportation of voted ballots to the custodian of election records, and securing of DREs.

Section 10 – Automatic Recounts (if necessary) (TEC, Chapter 216)

An automatic recount must be conducted in an election requiring a plurality vote when two or more candidates for the same office tie for the number of votes required to be elected, unless the tying candidates cast lots to resolve the tie or one of them decides to withdraw.
An automatic recount must also be conducted in an election requiring a majority vote if more than two candidates tie for the highest number of votes or if two or more candidates tie for the second highest number of votes to determine who will be the runoff candidates before resorting to casting lots in order to resolve the tie.
An automatic recount must be held if the candidates in a runoff election tie before the tying candidates can cast lots to determine the winner.
The method of counting votes in an automatic recount is the same method of counting used in the election that resulted in the tie vote.
In order to initiate an automatic recount, the presiding officer of the canvassing authority shall request the recount in writing in the same manner as a recount petitioner, except that no deposit is filed with the request, and the cost of the recount is covered by the political subdivision.

Section 11 – Requested Recounts (if necessary)

Requested Recount on DRE Voting Systems (Pursuant to TEC § 214.071):

The candidate requesting a recount may request that the recount be done electronically or manually.
For an electronic recount, the persons specifically permitted by law to be present at the recount are also authorized to be present as the election media are reloaded into the central accumulator system.
For a manual recount of a DRE election, the Recount Coordinator shall organize the printing of cast vote records (ballot images) for the affected race or issue.

The Recount Coordinator shall notify the parties in the recount of the date, place, and time the printing of cast vote records (ballot images) will take place.
The full recount committee is not required to be present at the printing of cast vote records (ballot images) and the Recount Chair shall determine how many members should be present. The persons specifically permitted by law to be present at the recount are entitled to be present as the cast vote records (ballot images) are printed and to have the same number of representatives as allowed for the recount.
If the manual recount does not take place immediately after the printing of the cast vote records (ballot images), the printed cast vote records (ballot images) shall be locked and secured until the recount takes place.
A manual count of the printed cast vote records (ballot images) shall be conducted in the same manner as a recount of hand-counted paper ballots.
After the recount is complete, the printed cast vote records (ballot images) shall be secured and preserved for the appropriate preservation period for maintaining election records.

Requested Recount on Optical Scan Voting Systems (See TEC, Chapter 214, Subchapter C)

Section 12 – Retention of Election Materials

Records created as part of an election must be retained for twenty-two months. In addition to the instructions provided in TEC § 66.058, electronic records shall be secured in a locked container sealed with one or more uniquely identified tamper-resistant or tamper-evident seals that is logged. This includes, but is not limited to the following:

Logic and Accuracy Test and results;
Printed audits (Real-time audit log);
Forms;
Zero tapes;
Results tapes; and
Electronic Records:
1. Ballot definitions;
2. Cast vote records (ballot images), as applicable;
3. Audit logs; and
4. Election results.

The electronic files can be duplicated to another storage medium (ex. External hard drive, USB drive, CD, or DVD) to meet the retention requirement and allow for the external memory store to be reused in the next election. Whatever medium you choose, you must ensure that you will have the hardware and/or software needed to read the data from the medium at a later date, if necessary.
A minimum of two duplicates of the electronic data must be retained, labeled and stored in a secure manner where any opening could be detected, and each placed in a different locked area with restricted access.
A precinct ballot scanner used in early voting may be deployed for use on Election Day only if the system provides the capability to retain a copy of the audit log(s) showing the activity during early voting.
The scanner system must provide the capability to view and print the audit log(s) as needed to retain the records listed above.
A DRE used in early voting may not be re-deployed for use on Election Day.
Electronic data on a DRE, a DRE component and any external memory storage device used in conjunction with a DRE shall not be cleared until a backup of the electronic records has been performed. Also, the electronic data on a DRE and any external memory store shall be preserved for 10 days after Election Day unless the DRE is required for another election before that time expires. If you need to use the equipment before the 10 day wait period has expired, you will need to seek a written waiver from the Secretary of State’s office. If a written waiver has been issued, the results shall be preserved until the local canvass of the returns containing the election results from the DRE is complete and a backup of the electronic records has been done. Please email elections@sos.texas.gov to request your waiver.
A DRE shall remain secure if, before the security period prescribed above expires, the DRE’s custodian receives a request to maintain security of the DRE for an extended period. This request must be in writing and signed by: (1) a person eligible to contest the election or obtain a recount; or (2) a public authority authorized to conduct a criminal investigation involving use of the DRE in the election or a person designated by the public authority to make the request.
For detailed instruction on how to back up your election records with your specific version of your vendor’ hardware and software, please contact your vendor for assistance.

Glossary

Term	Definition
Audit Logs	Recorded information that allows election officials to view the steps that occurred on the equipment included in an election to verify or reconstruct the steps followed without compromising the ballot or voter secrecy.
Ballot Image	Electronically produced record of all votes cast by a single voter. Also known as a Cast Vote Record (CVR).
Cast Vote Record (CVR)	Permanent record of all votes produced by a single voter whether in electronic or paper copy form. Used for counting votes. Also referred to as ballot image when used to refer to electronic ballots.
Central Accumulator System	Part of an Election Management System that tabulates and/or consolidates the vote totals for multiple precincts/devices.
Commercial Off-The-Shelf (COTS)	Commercial, readily available hardware devices (which may be electrical, electronic, mechanical, etc.; such as card readers, printers, or personal computers) or software products (such as operating systems, programming language compilers, database management systems, subsystems, components; software, etc.).
Data Storage Device	A device for storing data. It usually refers to permanent (non-volatile) storage, that is, the data will remain stored when power is removed from the device; unlike semiconductor RAM. Recording can be done mechanically, magnetically, or optically.
Direct Recording Electronic (DRE)	Voting system that records votes by means of a ballot display provided with mechanical or electro-optical components that can be actuated by the voter, that processes the data by means of a computer program, and that records voting data and cast vote records in internal and/or external memory components. It produces a tabulation of the voting data stored in a removable memory component and/or imprinted copy.
Election Management System	Set of processing functions and databases within a voting system that define, develop and maintain election databases, perform election definition and setup functions, format ballots, count votes, consolidate and report results, and maintain audit trails.
Firmware	Computer programs (software) stored in read-only memory (ROM) devices embedded in the system and not capable of being altered during system operation.
Logic and Accuracy Test	Testing of the tabulator setups of a new election definition to ensure that the content correctly reflects the election being held (i.e., contests, candidates, number to be elected, ballot styles, etc.) and that all voting positions can be voted for the maximum number of eligible candidates and that results are accurately tabulated and reported.
PCMCIA	Personal Computer Memory Card International Association – a portable computer card.
Public Counter	Counter in a voting device that counts the votes cast in a single election.
Results Tape	A Results Tape is the tape that is printed when the polls close. It is called a Results Tape since all contests and propositions are listed and have the resulting votes next to each name or question.
Voting Device	Any apparatus by which votes are registered electronically.
Voting System	The integrated mechanical, electromechanical, or electronic equipment and software required to program, control, and support the equipment that is used to define ballots; to cast and count votes; to report and/or display election results; and to maintain and produce all audit log information.
Zero Tape	A Zero Tape is the tape that is printed when the voting machine is first set up at the polls. It is called a Zero Tape since all contests or propositions should have zero votes next to each name or question.

KI:CA