# CONCLUSIVE EVIDENCE:

**ONE SMART CARD PER VOTER**

**IMPROVES THE**

**SECURITY & TRANSPARENCY**

**OF THE U.S.A.**

**ELECTORAL PROCESS**

BY

## FERNANDO MORALES

November 18, 2004

Document requested by

Dr. Ronald L. Rivest, Chairman of the EAC/TGDC/Subcommittee of

SECURITY & TRANSPARENCY

The system described by this document is protected by the

USA patent \# 6,607,137 and patent application

Available for purchase since 9/11/04 by federal or state governments or
private entities

For price information visit <http://www.sballot.com/>

# INTRODUCTION

This document describes an electoral system that introduces a new
paradigm. After implemented, this system will shorten the lines at the
precincts, will drastically increase the turnout during elections, will
reliably and speedily produce the vote counts in election night, and
will increase the voters' level of confidence in government and party
officials. All of this while saving billions of dollars from taxpayers.

This document proves that the use of one Smartcard per voter improves
the minimum acceptable level of Security and Transparency of the U. S.
A. Electoral Process, thus raising the minimum level to a new height
where the following functions can be performed in a secure manner.

-   Allow voters to verify their entire ballot after Election Day

-   Allow voters to cast a vote at the precinct or outside the precinct

-   Allow an absentee voter to cast a vote while being observed, and yet
    in total confidentiality

-   Allow overseas voters to cast votes by phone in total
    confidentiality

-   Allow ballots to keep their votes secret until tally time

-   Allow ballots to stand up for a correct tally of the votes entrusted
    to them

-   Allow all political parties to oversee the entire process with step
    by step audit trails

-   Allow the Court to remove from the ballot box a ballot that was cast
    by an impugned voter

Unless Dr. Ronald Rivest finds a flaw in the system presented here by
the end of this year, the use of "one Smartcard per voter" must become
the new minimum level of Security and Transparency in the Voluntary
Voting Guidelines due in April of 2005.

A transparent electoral process by which its people can elect their
government must be impartial. The government, being also an interested
party, cannot guarantee an impartial process, as they also stand to win
or lose from the outcome. Therefore, the first step is to have the
parties equally represented, working together with BOE Election Reps to
oversee and guarantee the transparency, impartiality, security, secrecy,
and availability of the election process to all citizens.

# WHAT PROTECTS THE INTEGRITY OF THE ELECTIONS

## SOFTWARE TRANSPARENCY

We anticipate the Electoral Software to be simple, written in machine
language, well documented, and posted publicly for review and
verification by all political parties, government, electoral
organizations and by voters. Once verified, security measures must be in
full force up to the point where they are opened for use. The Election
Reps must supervise the whole security process and ensure adherence to
the new methodology.

It is the Election Reps' responsibility to verify that the copy of the
software to be utilize in their locality is identical to the one
authorized by the political party by using the tools provided (Software
Comparator).

It is also the responsibility of the Election Reps to be vigilant during
the operation that no software replacement occurs.

## HARDWARE RELIABILITY

Off the shelf PC hardware is recommended for all functions, preferably
at the precinct, as long as the equipment is
recommended/certified/authorized by the EAC/TGDC/NIST and political
parties. The interface which requires the most attention is the
connection between the Smartcard and the PC, since information of both
the voter and Election Reps is exchanged through that interface.

## PERSONAL IDENTIFICATION NUMBER

To protect the personalized Smartcard the voter's PIN is required in
order to cast a vote. In addition, the PIN is used to verify the cast
votes, and to unscramble the encrypted votes posted at the precinct
website after Election Day. See Acronyms, Terms and Definitions.

## PERSONAL VOTING CODE

The PVC is the confidentiality element of the electoral system. Only the
Smartcard and the voter know it and they are never disclosed, thus
ensuring complete confidentiality. This Personal Voting Code is not
stored in any other place nor is it downloaded into any database. In
other words, once the voter enters his/her PVC the Smartcard becomes the
sole custodian of this information. By having this information in only
one place the voter can fully trust the electoral system.

## VOTER VERIFICATION NUMBER

Immediately after the voter casts his/her ballot, a printout containing
a randomly generated number is provided to the voter. The VVN is also
stored inside the Smartcard. Once the vote is tallied, the VVN has to be
revealed together with the encrypted vote and posted on the precinct's
web site. Voters, after Election Day, can then verify if their vote was
correctly counted by 1) finding their VVN on the precincts web site, 2)
copy/download the encrypted data file, 3) and follow the instructions
given by the Vote Verification Wizard on a computer loaded with the
Voter Software Module. The voter can review each and every one of the
questions in the ballot and see the answer exactly as they were entered
(the PVC displayed together with other numbers which serve as decoys and
in the same order they were on the day the voter cast his/her ballot).

## IDOK CODES

Each Election Rep creates their own set of access & verification codes
and become custodians of those codes; they are the guarantee of our
trust in the legitimacy of the Smartcard, the voter's identity data and
the vote. In order to enable Smartcard functionalities, such as allowing
the voter to enter PIN & PVC, verifying voter IDOK, or revealing the
vote, etc., the IDOK access codes from ALL Election Reps must be entered
in advance.

The government and political parties are equally responsible for the
safekeeping of their own set of codes for the protection of the
electoral process in the event of death of any of the Election Reps, but
in no event can these codes be shared with other Election Reps.

Legal sanctions should be imposed to a party that withholds the codes as
an attempt to block the counting of votes.

## SUPREME COURT CODES

In the event that a party claims that the ballot box contains votes from
deceased or illegitimate voters, that party may impugn the suspected
Smartcards to the justice system and in the event that the court finds
reasons to believe the party's claim, a Supreme Court code is required
to reveal the voter's identity without revealing the vote. These codes
are created by the court and remain under its custody. After the
software is loaded a Supreme Court Representative is responsible for
loading these codes into the Smartcard. All the Smartcards in the
impugned ballot box must be compared to the list of ARV of that
precinct. The illegitimate ones should be rejected in the presence of
other Election Reps and a recount of the legitimate Smartcards should
immediately ensue.

## SMARTCARD

The State selects which Smartcard is used for the election process. A
top security level (EAL4+) Smartcard is recommended. The minimum
security requirements include: that the software be loaded on a one time
programmable read only memory; that the clock and voltage be generated
inside; self-contained tampering notification mechanism; out of
frequency/voltage/temperature detection; and DPA/SPA resistance
mechanisms. In order to use the card for the life of the voter, the
Smartcard must have flash memory large enough to accommodate the ballot
questions, preferably with candidate's pictures and party's logos. The
Smartcard connection must follow the economic/convenience model chosen
by the state. A contact-less Smartcard can expedite the electoral
process at the precinct (the picture of the legitimate voter will pop on
the screen when the voter enters the precinct) and to tally, but
requires an especial interface for the voters who prefer to vote from
home. On the other hand, a Universal Serial Buss interface will be easy
for voters at home, but no so easy to handle at the precinct. The
Smartcard can have more than one interface.

## SMARTCARD SOFTWARE SECURITY

The Smartcard software CD must be compared and be identical to all the
Election Rep Software CDs and the loading must be witnessed by the
Election Rep-Software (ERS). The empty Smartcard should have been
previously verified by them as well. Immediately afterward, each ERS
loads, using his/her own PC, their software access and verification
codes and tests them. When they apply the access codes the software
returns the verification codes as evidence that the Smartcard has the
valid software. Afterward, a Supreme Court representative must use
his/her PC to load the Supreme Court codes to all the Smartcards and
test them, when s/he applies the code the software returns an OK as
evidence that the Smartcard has the code. Any defective card that cannot
be verified must be destroyed in the presence of all political parties.
All parties must keep their codes safe in the event that a
representative passes away. These Smartcards must be stored in a secure
government office, ready to be loaded with newly registered voters in
preparation for the following elections.

## VOTER'S IDENTITY SECURITY

The list of legitimate voters must be periodically updated to reflect
the reality of the locality. A new Smartcard must be issued to every new
voter registered by the Election Reps. To start-up a PC with a CD, the
CD must be compared and be equal to all the Election Rep CD's and must
be loaded into an empty PC, witnessed by the Election Reps. Before
loading the voter's identification into the Smartcard each ERS must
command the Smartcard to produce the software verification codes as
evidence that the software inside the Smartcard is a legitimate copy.
Immediately afterward, and in the presence of the Election Reps the new
voter's identification must be loaded into the Smartcard. Immediately
afterward each elections rep must load using her PC their IDOK access
and verification codes and test them, when they apply the IDOK access
codes the software returns the IDOK verification codes as evidence that
the Smartcard has a valid voter. The Smartcard with the new voter can be
stored with all previously used Smartcards.

## MAILING SECURITY

The list of voters that will be entitled to vote in a particular
election must be used to print the labels to mail voters their
personalized Smartcard. To startup a PC with a CD, the CD must be
compare and be equal to all the Election Rep CDs and must be load into a
PC in the presence of other Election Reps. Because all Smartcards are
stored randomly, Election Reps verify that each Smartcard returns their
IDOK verification codes before they compare the Smartcard voter's
identification with the list of the ones entitled to vote. In the event
that the voter's identification stored in the Smartcard doesn't match
anyone in the list, that Smartcard must be set aside or destroyed. In
the event that the identification matches, load the ballot questions and
place the Smartcard in an envelope with the address label and mail it to
the voter.

## ACQUISITION OF EQUIPMENT

**SOFTWARE**

The state government must purchase or license software that complies
with the EAC/TGDC Voluntary Guidelines.

Master copy must be stored at NIST.

**HARDWARE**

The hardware running the electoral software can be the PC's that are
available in the state government offices, two per 100 voter per
precinct, minimum of four.

If the state government has already invested on specialized hardware, it
should obtain a license to make its design public before purchasing or
licensing any additional software. Careful analysis of any especial
hardware must be performed in order to find any hidden circuitry that
can take control of the device at the time of elections.

**SOFTWARE PACKAGING**

Each computer's software must be certified and burnt onto CD's according
to where they are being used.

#### ALPHA CD

> The Alpha PC software
>
> The Smartcard software

#### BETA CD 

> The Beta PC software
>
> The Alpha CD

#### GAMMA CD

> The Gamma PC software

#### DELTA CD

> The Delta PC software

#### EPSILON CD

> The Epsilon PC software

#### ZETA CD 

> The Zeta PC software

# HARDWARE INITIALIZATION PROCEDURES

## Alpha PCs Initialization Procedure:

Runs all BOE Rep functions:

1)  BOE Rep submits the Alpha CD to all Party Election Reps

2)  Each Election Rep on his/hers owns Beta PCs compares the CD

3)  Authenticated CD is loaded onto the Alpha PCs in presence of all
    Election Reps

4)  The BOE Rep turns off the PC and allows it to boot from the CD drive

5)  The Alpha PC is initialized

6)  End of procedure

> Next Step: Go to "Smartcard Initialization Procedure"

## Beta PCs Initialization Procedure:

Runs all Election Rep functions:

1)  Election Rep loads a trusted Beta CD into the CD drive

2)  The Election Rep turns off the PC and allows it to boot from the CD
    drive

3)  The Beta PC is initialized

4)  End of procedure

> Next Step: Go to "Smartcard Initialization Procedure"

## Gamma PCs Initialization Procedure:

Used by voters to enter PIN and PVC at the precinct:

1)  BOE Rep submits the Gamma CD to Party Election Reps

2)  Each Election Rep on his/hers own PCs compares the CD

3)  Authenticated CD is loaded onto the Gamma PCs in presence of all
    Reps

4)  The BOE Rep turns off the PC and allows it to boot from the CD drive

5)  The Gamma PC is initialized

6)  End of procedure

> Next Step: Go to "Smartcard Initialization Procedure"

## Delta PCs Initialization Procedure:

Used at the precinct for voting:

1)  BOE Rep submits the Delta CD to Party Election Reps

2)  Each Election Rep on his/hers own PCs compares the CD

3)  Authenticated CD is loaded onto the Delta PCs in presence of all
    Election Reps

4)  The BOE Rep turns off the PC and allows it to boot from the CD drive

5)  Delta PC is initialized

6)  End of procedure

> Next Step: Go to "Voting at the Precinct Procedure"

## Epsilon PCs Initialization Procedure:

Used in precincts for voting by phone:

1)  BOE Rep submits the Epsilon CD to Election Reps

2)  Each Election Rep on his/hers own PCs compares CD

3)  Authenticated CD is loaded onto the Epsilon PCs in presence of all
    Election Reps

4)  The BOE Rep turns off the PC and allows it to boot from the CD drive

5)  The Epsilon PC is initialized

6)  End of procedure

> Next Step: Go to "Voting by Phone Procedure"

## Zeta PCs Initialization Procedure:

Used outside the precinct for voting:

1)  Voter obtains the Zeta CD w/Smartcard or from the party or from a
    store

2)  Voter/Notary compares CD with the Authorized Version on the NIST
    website

3)  Voter loads the authenticated Zeta CD into the CD drive

4)  Voter turns off the PC and allows it to boot from the CD drive

5)  The Zeta PC is initialized

6)  End of procedure

> Next step: Go to "Voting Outside the Precinct Procedure"

## Smartcard Initialization Procedure:

**SUMMARY**

It is the responsibility of each representative, whether of the BOE, the
party, the court or the people, to create and hold in a secure place
their own list of codes. It is also the responsibility of each party or
group to provide and to guard his/hers initialized Beta PC.

One Smartcard for each registered voter:

1)  Smartcard Software is loaded into Smartcards by BOE Rep on Alpha PC

2)  Software Codes are loaded into Smartcards by Election Reps on their
    own Beta PCs

3)  BOE Rep on Alpha PC simultaneously loads Voter Identification Data
    and his/her IDOK codes into individual Smartcards

4)  BOE Rep on Alpha PC loads formatted ballot into individual
    Smartcards (Step is optional for overseas voter due to time
    considerations)

5)  IDOK Codes are loaded into Smartcards by Election Reps using their
    own Beta PC

6)  BOE Rep using labels generated by the Alpha PC mails Smartcard to
    voter

7)  Voter identifies him/herself to Election Reps or Notary Public prior
    to entering PIN and PVC

8)  Smartcard is initialized

9)  End of procedure

> Next step: Voting Procedures (at the precinct, or outside the
> precinct)

**DETAILED SMARTCARD INITIALIZATION PROCEDURES**

The State BOE programmed the Smartcards, therefore it is up to each
State BOE to determine the sequence in which the steps will be performed
and the number of transactions required to complete the whole procedure.
For the purpose of describing a tight security scenario, this document
assumes that all representatives are available in one sitting at a place
equipped for this operation inside a precinct. Each representative would
have their own PC initialized, running Election Software, and grouped
according to their responsibility.

Steps from 1 to 18 describe the initialization of a Smartcard when done
at the precinct.

1)  Once initialized, the Alpha and Beta PC's initial screen displays
    two options: "Load Codes" and "Run Election Software".

2)  Witnessed by all Election Reps the BOE Rep loads the Software into a
    Smartcard and passes it on to the first Election Rep.

3)  The Election Rep connects the Smartcard to his/her Beta PC and an
    Accepted-Tone notifies the Election Rep that his/her Access and
    Verification codes have been enter into the Smartcard (Command 5 or
    9).

4)  After the Accepted-Tone, the representative removes the Smartcard
    and passes it on to the next representative of the same group who
    likewise performs Steps 3 and 4 until the Smartcard reaches the last
    representative of the group.

5)  At a later time, minutes or months, the Smartcard is connected to
    the BOE Rep's Alpha PC. After passing the software verification
    check (Command 6) the representative loads the Voter Information
    Data, precinct information and the formatted ballot (Commands 7, 14
    & 23). The Smartcard is then passed on to the first Election Rep for
    IDOK codes.

6)  The Election Rep verifies the accuracy of the information (Commands
    8, 15 and 24) and executes Step 3 and 4.

7)  The last IDOK representative removes the Smartcard and passes it on
    to the BOE Rep at the Alpha PC who is in charge of mailing.

8)  The BOE Rep connects the Smartcard and a mailing label with the
    voter's address is printed out (Command 8).

9)  The label is affixed to an Election Package; the Smartcard is
    removed and inserted into the package and dropped into the shipping
    bin.

10) When the voter opens his/her Election Package, the enclosed
    Instructions Guide provides him/her with the designated precinct's
    address to go to and a phone number to call in case s/he needs help.
    The voters are encouraged to go to the precinct to initialize their
    Smartcard, but for their convenience, personal codes can also be
    entered in the presence of a Public Notary (Step 19).

11) Voter submits Smartcard to BOE Rep [at the precinct]{.underline}.

12) On the Alpha PC, BOE Rep accesses the Smartcard and verifies that it
    pertains to the locality (Command 15).

    a.  A Valid-Tone indicates that the voter belongs to the precinct. A
        No-Picture-Tone notifies the representative to take the voter's
        picture, load it into the Smartcard, and then hands over the
        Smartcard to the first Party Election Rep; go to Step 13.

> If the picture is already loaded, only the Valid-Tone is heard.

b.  If an Invalid-Tone sounds, the representative provides the precinct
    address to the voter and directs the voter to it. End of procedure.

c.  If a Warning-Tone sounds, the Smartcard didn't respond as expected.
    The BOE Rep takes possession of the Smartcard and accompanies the
    voter to the Special Attention Desk (the Escalation Procedure gets
    underway). End of procedure.

```{=html}
<!-- -->
```
13) The party Election Rep connects the Smartcard to his/her Beta PC's.

14) The representative confirms voter identity and verifies Smartcard
    has IDOK codes (Commands 8 & 10).

    a.  A Valid-Tone indicates that the IDOK codes are loaded and the
        Party Election Rep hands over the Smartcard to an Election Rep
        of a different party. After the third representative executes
        Command 10, go to Step 15.

> This step must be performed by three different Party Election Reps
> before the voter can load his/her codes.

b.  If Warning-Tone sounded, the Access code failed and the
    corresponding Party Election Rep protects his/her code by taking
    possession of the Smartcard and accompanies the voter to the Special
    Attention Desk. End of procedure.

```{=html}
<!-- -->
```
15) After being verified three times the Smartcard is now ready to
    record the provisional PIN and PVC codes. The voter is directed to a
    Gamma PC where an Election Rep will assist the voter to setup the
    Smartcard up to the point where the Guided Demo is ready to run, at
    that time the Election Rep leaves so the voter can enter the codes
    privately.

> To familiarize him/herself with the keyboard (especially if blind) the
> voter goes through a Guided Demo. The demo simulates entering the PIN
> twice and the PVC twice; the second time as a confirmation. No
> receipts (not even audio receipts) are provided to ensure that ONLY
> the voter knows the PIN and PVC code s/he entered.
>
> Once the codes are recorded, Command 12, the Gamma PC indicates that
> the "Smartcard was successfully initialized" and that the "Smartcard
> can be safely removed".

16) The voter removes the Smartcard, walks out of the booth, and hands
    over the Smartcard to an Election Rep who verifies his/her identity
    again, Commands 8 & 13 (see Step 13-14). This time, after three
    verifications the Smartcard removes the provisional flag and locks
    in the PIN/PVC codes, making them final.

17) The Smartcard is handed over to the voter so s/he can now, and in
    future elections, vote at the precinct or outside the precinct
    without having to reload his/her codes again.

18) End of procedure.

> Next step: Voting Procedures (at the precinct, or outside the
> precinct).

Steps 19 through 32 describe the initialization of a Smartcard when done
through a Notary.

19) The voter is in the Notary's office holding the required proof of
    identity and the Notary's Zeta PC is initialized (must be equipped
    with a speaker system if the voter is blind).

20) The Notary connects the Smartcard to the Zeta PC.

21) The initial screen displays two messages. One for the voter,
    encouraging him/her to initialize the Smartcard at his/her assigned
    precinct and another message providing instructions to the Notary on
    how to provisionally initialize the Smartcard. The precinct's phone
    number is found in both the Election Package mailed to the voter and
    inside the Smartcard (Command 15).

22) The Notary calls the precinct and goes through a handshake procedure
    with the BOE Rep.

23) Upon satisfactory identification, the BOE Rep provides the unlock
    code to the Notary.

24) The Notary writes down the unlock code for later use and then keys
    in the unlock code into the PC.

25) The Notary then enters his name, phone number, Notary License
    Number, and license expiration date as prompted by the system
    (Command 16).

26) The PC opens up a Guided Demo and the Notary leaves the office so
    the voter can enter his/her codes privately.

27) To familiarize him/herself with the keyboard (especially if blind)
    the voter goes through the Guided Demo. The demo simulates entering
    the PIN twice and the PVC twice; the second time as a confirmation.
    No receipts (not even audio receipts) are provided to ensure that
    ONLY the voter knows the PIN and PVC code s/he entered.

28) Once the codes are recorded with Command 18, the Zeta PC prompts the
    voter to ask the Notary to return and re-enter the unlock code. The
    following occurs:

    a.  The PC prints out a Notary Statement, which includes the voter's
        ID, the Notary's name, phone and license numbers, notary
        verification code (Command 19), a blank line for his Signature,
        and space for his/her Seal (Commands 8, 15, 17 & 19).

    b.  The PC displays and reads out that the "Smartcard is
        provisionally initialized" and,

    c.  The PC displays and reads out that the "Smartcard can be safely
        removed".

29) The Smartcard is removed and the Notary signs and seals the Notary
    Statement.

30) The Smartcard and the Notary Statement are handed over to the voter.

31) The voter is responsible for inserting the Smartcard, the Notary
    Statement, and the copies of valid proofs of identity into the
    addressed envelope and mails it back to the precinct after
    completing the "Voting Outside the Precinct Process".

32) End of procedure.

> Next step: Voting Procedures (at the precinct, or outside the
> precinct).

# ELECTION PROCEDURES

## Voting at the Precinct Procedure:

1)  The voter is directed to a Delta PC for voting.

2)  The voter connects to the Smartcard.

3)  The Delta PC recognizes a valid Smartcard; displays and reads out
    the voter's ID; and requests the voter to enter his/her PIN, using
    Command 8. If there is no match (Command 21) or the voter has
    forgotten his/her PIN, s/he must reset the PIN with the BOE Rep.

4)  Upon recognizing the valid PIN, the Delta PC displays and reads out
    the available options on the ballot, using Commands 24.

5)  The Delta PC allows the voter to write a candidate's name, using
    Command 25.

6)  Using the Left-Arrow and Right-Arrow keys, the voter places his/her
    PVC under the desired candidate. The voter can watch on the screen
    and/or hear with a hearing aid, which numbers are under each
    candidate. Each time an arrow key is pressed, the display and audio
    will indicate the new choices accordingly.

7)  To accept the choices the voter presses any other key, except the
    Left- or Right-Arrow keys, and the vote is stored in the Delta
    PC.[^1]

8)  The Delta PC will ask for a confirmation, to which the voter will
    press any other key to confirm or press the Left-Arrow key to return
    to Step 6.

9)  The Delta PC will indicate that voting is loaded into the Smartcard
    and prints out a random Vote Verification Number, using Command 26.

10) Steps 4 through 9 are repeated until all ballot questions are cast.

11) The Delta PC asks the voter if s/he wishes to verify his/her
    choices, if the answer is no, Command 33 is executed; the PC
    announces that the Smartcard can be safely removed and directs the
    voter to collect the printout.

12) The voter removes the Smartcard and picks up the printout. If s/he
    doesn't want to verify the choices, skip to Step 14.

13) If the voter wishes, the voter can proceed to verify his/hers
    choices on the same PC or on a vote-verification machine, another
    Delta PC prepared for this purpose, before dropping the Smartcard
    into a For-Tally Box.

    a.  The voter places the Smartcard in the Delta PC port.

    b.  The Delta PC uses Command 4 and recognizes that the Smartcard as
        locked and only requests the voter to enter his/her PIN number.

    c.  Voter enters PIN and the Delta PC will display and read out the
        same choices selected in Step 8, using Command 27.

    d.  Only if the voter answer yes to the question on step 11 will
        s/he be allowed to delete all the ballot choices with
        Command 32. The voter will have to start the voting process all
        over from Step 2.

    e.  The Delta PC will execute Command 33 and announces that the
        Smartcard can be safely removed.

14) The voter drops the Smartcard into one of the For-Tally Box and
    secures the Vote Verification Number before leaving the precinct.

15) End of procedure.

## Voting Outside the Precinct Procedure:

1)  The voter connects the Smartcard to the Zeta PC.

2)  The Zeta PC recognizes a valid Smartcard; displays and reads out
    voter's identification and requests the voter to enter his/her PIN,
    using Command 8. If there is no match after executing Command 21 or
    the voter has forgotten his/her PIN, s/he must bring the Smartcard
    to the precinct or Notary to reset the PIN. End of procedure.

3)  Upon recognizing the valid PIN, the Zeta PC displays and reads out
    the available options on the ballot, using Commands 24.

4)  The Zeta PC allows the voter to write a candidate's name, using
    Command 25.

5)  Using the Left-Arrow and Right-Arrow keys, the voter places his/her
    PVC under the desired candidate. The voter can watch on the screen
    and/or hear which numbers are under each candidate. Each time an
    arrow key is pressed, the display and audio will indicate the new
    choices accordingly.

6)  To accept the choices the voter presses any other key, except the
    Left- or Right-Arrow keys, and the vote is stored in the Zeta
    PC.[^2]

7)  The Zeta PC will ask for a confirmation, to which the voter will
    press any other key to confirm or press the any Arrow key to return
    to Step 5.

8)  Steps 3 through 7 are repeated until all the ballot questions are
    cast.

9)  The Zeta PC indicates that voting is complete and prints out a
    random Vote Verification Number, using Command 26. If you have
    problems with your printer, write down the number displayed on the
    screen exactly as it appears and keep it in safe place.

10) The Zeta PC asks the voter if s/he wishes to verify his/her choices,
    if the answer is no, execute Command 33, announces that the
    Smartcard can be safely removed. Jump to Step 13.

11) If the voter answered yes to the previous question (wishes to verify
    his/hers choices), the Zeta PC requests for voter's PIN number
    again, using Commands 4. Then the Zeta PC will display and read out
    the same choices selected in Step 7, using Command 27.

12) If the voter wishes to modify any of the cast ballot questions, the
    Zeta PC must delete all the ballot choices, using Command 32, before
    the voter can start the voting process again from Step 2.

13) The voter removes the Smartcard and inserts it into the addressed
    envelope.

14) The voter removes the Vote Verification Number from the printer and
    files it in a safe place for use after Election Day.

15) The voter mails the envelope back to the addressed precinct.

16) End of procedure.

## Voting by Phone Procedure:

1)  The BOE must authorize a voter (who already loaded his/her PIN and
    PVC into the Smartcard) to cast a vote over the phone if the voter
    has no other way to vote in a timely manner.

2)  The voter's Election Package containing his/her Smartcard arrives at
    the precinct or service center. The package is placed inside a
    mailbox starting with the first two letters of the voter's last
    name.

3)  When the voter calls in, the attendant goes to pickup the Election
    Package pertaining to the voter. The attendant uses the package's
    label to confirm that the caller is in fact the legitimate voter.

4)  The attendant opens the package and connects the Smartcard to an
    initialized Epsilon PC and switches the phone line to the Epsilon
    computer.

5)  The Epsilon PC recognizes a valid Smartcard, reads out the voter's
    identification and requests voter to enter using the telephone
    keypad his/her PIN, using Command 8. If after executing Command 21
    there is no match or the voter has forgotten his/her PIN, s/he must
    reset the PIN at the precinct or at a Notary office. End of
    procedure.

6)  Upon recognizing the valid PIN, the Epsilon PC reads out the
    available options on the ballot, using Commands 24.

7)  The Epsilon PC is enabled to interpret the voter's entry and writes
    the candidate's name into Command 25.

8)  Using the phone's keypad, 7-key for Left-Arrow and 9-key for the
    Right-Arrow, the voter places his/her PVC under the desired
    candidate. The voter can hear over the phone, which numbers are
    under each candidate. Each time an arrow key is pressed, the audio
    will indicate the new choices accordingly.

9)  To accept the choices the voter presses the 1-key and the vote is
    stored in the Epsilon PC.[^3]

10) The Epsilon PC will ask for a confirmation, to which the voter will
    press the 3-key as a confirmation or press the 7-key or 9-key to
    return to Step 8.

11) If confirmed, the Epsilon PC will indicate that voting is Final and
    reads out a random Vote Verification Number, using Command 26.

12) Steps 6 through 9 are repeated until all ballot questions are cast.

13) The Epsilon PC asks the voter if wishes to verify his/here choices,
    if the answer is no, Command 33 is executed and announces that the
    Smartcard can be safely removed. Jump to step 16.

14) If the answer to the previous question is yes, the voter verifies
    his/her choices. The Epsilon PC requests the voter's PIN again,
    using Commands 4. Voter enters PIN using the phone keypad and the
    Epsilon PC will read out the same choices accepted in Step 9, using
    Command 27.

15) If the voter wishes to modify any of the cast questions, the Epsilon
    PC must delete all the ballot choices, using Command 32, before the
    voter can start the voting process again from Step 6.

16) When the voter has completed his vote, the attendant will hear a
    Completed-Tone and removes the Smartcard, inserts it into the
    addressed envelope and mails it or it is dropped into the
    For-Tally-Box.

17) End of procedure.

## Notarized Voter Approval Procedure:

1)  BOE Rep takes one envelope with a Smartcard from the
    For-Approval-Box.

2)  On Alpha PC, BOE Rep verifies that the Smartcard pertains to the
    locality and verifies that the Smartcard has his/her IDOK codes,
    using Commands 15 & 6.

    a.  If the voter belongs to the precinct and IDOK codes match, go to
        Step 3.

    b.  If the Smartcard does not belong to that precinct, the Smartcard
        is shipped to the correct one, based on the Smartcard recorded
        Information.

3)  If the Smartcard doesn't respond as expected, the BOE Rep sends the
    Smartcard to the Special Attention Desk (the Escalation Procedure
    gets underway).

4)  The BOE Rep verifies the Notary statement, Notary Verification Code
    and all other documentation, using Command 31. If every thing is OK,
    the Alpha PC execute the Command 20 and the Smartcard with all other
    paperwork is handed-over to the first Party Election Rep.

5)  The Election Rep verifies the Notary statement, Notary Verification
    Code and all other documentation, using Command 31. If every thing
    is OK, the Beta PC execute the Command 20 and the Smartcard with all
    other paperwork is handed-over to the next Party Election Rep.

6)  The next Election Rep verifies the Notary statement, Notary
    Verification Code and all other documentation, using Command 31. If
    everything is OK, the Beta PC executes Command 20 and the Smartcard
    will set the Voter Codes to a status of 3, and the Voter Information
    status to 5.

7)  All paperwork must be filed as part of the Voter's Record.

8)  The Smartcard is now ready for the next process: for voting if
    ballot loaded but not cast or for tallying. if ballot is cast.

9)  End of the procedure.

10) If any one of the three representatives rejects the case (doubts the
    validity of the information), the voter must be contacted and
    informed of the situation. Commands 2, 3, 4, 8, 17, 31 provide the
    relevant information.

11) All communication with the voter must form part of the Voter's
    Record.

12) The voter must re-start this process again.

13) End of the procedure.

## Tally Procedure:

1)  BOE Rep takes one Smartcard from the For-Tally-Box

2)  The BOE Rep uses an Alpha PC to verify that the Smartcard pertains
    to that precinct. (Command 15) and that it holds his/her IDOK code
    (Command 6).

    a.  If both tests pass, the BOE Rep executes Command 28 (1^st^ time)
        and hands over the Smartcard to the first Party Election Rep. If
        the voter belongs to the precinct and IDOK codes match, the
        Command 28 is executed and the Smartcard is handed-over to the
        first Party Election Rep; go to Step 3.

    b.  If the Smartcard belongs to a different precinct, the Smartcard
        is placed into a container marked "Stray Cards". At the end of
        the Tally Session, the container with all the stray cards will
        be taken to the Special Attention Desk for further
        investigation. End of procedure.

> This action is taken because by the time the counting started all
> precincts should be closed and counting as well.

c.  If the Smartcard doesn't respond as expected, the BOE Rep tags the
    Smartcard, writes down the tag number for his/her records, and sends
    the Smartcard to the Special Attention Desk (the Escalation
    Procedure gets underway). End of procedure.

```{=html}
<!-- -->
```
3)  On his/her Beta PC, the party Election Rep verifies that the
    Smartcard contains his/her IDOK codes; Command 6.

    a.  If it passes, Command 28 is executed (2^nd^ time) and the Party
        Election Rep hands over the Smartcard to the next Election Rep,
        If the third representatives codes are verified, s/he executes
        Command 28 (3^rd^ time); go to Step 4.

> Command 28 MUST be executed by three different Party Election Reps
> before the Smartcard can go to Step 4.

b.  If the IDOK code fails verification, the corresponding Party
    Election Rep protects his/her IDOK codes by taking possession of the
    Smartcard and saves it until the tallying is over. That Smartcard
    does not count and subject to further investigation by the Special
    Attention Desk. End of procedure.

```{=html}
<!-- -->
```
4)  The Smartcard reveals the ballot's content (cast votes) for the
    first time to the third representative that executes Command 28. The
    Beta PC sorts and tallies votes as Smartcards pass this point. Each
    subsequent Smartcard that passes this point gets counted by the same
    representative and the votes are being tallied by that Party
    Election Rep's Beta PC. Each Smartcard immediately after it is
    tallied, is handed over to the BOE Rep.

5)  On an Alpha PC, the BOE Rep executes Command 28 again and the
    Smartcard reveals the ballot's content for the second time, this
    time to an Alpha PC, which will produce the final and official
    tally. Immediately after a Smartcard is tallied, it is handed over
    to the following Party Election Representatives.

6)  On their Beta PC, each other Party Election Rep executes Command 28
    again and the Smartcard reveals the ballot's content for the third
    time, and so on.

> The Smartcards are handed over from representative to representative
> until they reach the last representative, who would drop the
> Smartcards into the Counted Ballots Box.

7)  At the end of the process, each PC will display the final count of
    Smartcards as well as the number of votes for each candidate. The
    displayed results should all coincide. If not, the owner of the PC
    that has different results has to go for another count. If it still
    differs, the representative has the right to impugn the results of
    the precinct. However, all the other representatives have the right
    to seize that PC (after burning 2 CD's with the results, one for the
    BOE Rep and one for the representative's party), box it, seal it,
    and hand it over to the Special Attention Desk for further
    investigation.

> All the PC's have CD burners and each one should record the results of
> the tally, including the computer suspected of tampering. If the
> results of the precinct were impugned, then the CD's would serve as
> evidence.
>
> If there were no discrepancies among the results, the CD copy of the
> BOE Representative is considered to be the official copy and each of
> the other CD's falls under the custody of the party representative.
> Usually that CD is taken back to their party headquarters.

8)  End of procedure.

## Retrieve Encrypted Cast Ballots Procedure:

As a confidentiality measure, all the Smartcards are scrambled or mixed
prior to extracting their encrypted ballots. This would prevent the
possibility associating a known Smartcard to an encrypted code.
Basically, all the Smartcards would be in a box and while being observed
by the other representatives, one of them would mix them up. Then, any
three of them would be in the position to attest to the fact that they
have been mixed. The ensuing steps are described below.

1)  Any Party Election Rep would take one Smartcard from the Counted
    Ballot Box and connect it to his/her Beta PC, then Command 29 (1^st^
    time) is executed and the Party Election Rep hands over the
    Smartcard to an Election Rep of a different party.

2)  On his/her own Beta PC the second Election Rep would execute Command
    29 (2^nd^ time) and likewise hands over the Smartcard to the BOE
    Representative.

3)  On an Alpha PC, the BOE Rep executes Command 29 (3^rd^ time) and the
    Smartcard responds with the Voter Verification Number, the encrypted
    cast ballot and the encrypted first number of the series. The
    encrypted cast ballot and its associated Voter Verification Number
    must be recorded in the BOE Rep's CD, which becomes the official
    encrypted data file.

4)  Party Election Reps that wish to obtain the encrypted cast ballot
    and the associated VVN must be allowed to execute Command 29 and
    create their party's own CD with the encrypted file.

5)  End of procedure.

## Impugned Smartcard Procedure:

Historically, there have been cases of voting fraud that have been
difficult, to detect, but even if detected, they had no cure, because
once a ballot is in the For-Tally-Box or in a DRE machine there is no
way to get a wrong ballot out of there. The most renowned cases are:

1)  Votes cast by impersonating a deceased citizen

2)  The survivor of twin's votes for both

3)  Validity of votes cast by voters who die during Election Day after
    voting

4)  Voters registered twice or more (in different precincts)

5)  A voter became a convicted felon and mailed the ballot prior to
    Election Day

6)  Unverified last minute registrations

Having one Smartcard per voter resolves this type of problems by
allowing the Board of Elections to unequivocally select these cast
ballots out from the For-Tally-Box.

First of all, it is a fact that only the Supreme Court of the State can
run Command 8 and retrieve the Voter's Identification Data after the
ballot has been cast. Let's now setup a scenario where it will be
required for the Supreme Court to act. Firstly, the current outcome of
the election shows that 1 or 2 impugned votes could turn the results
around. Secondly, some conditions (listed above) have arisen and the
names of the perpetrators (or deceased) have been identified. In this
case the interested party will prepare a list of voters (together with
their dates of birth) that should not be counted; places a complaint and
a hold on the results until these votes are found. The party submits the
complaint and the list to the Supreme Court of the State. Once the
Supreme Court agrees and authorizes the Impugned Smartcard Procedure,
the following actions take place:

1)  The custodian of the Supreme Court codes enters the list of names
    and their corresponding birth dates onto a Beta PC

2)  The custodian enters the Access code into the Beta PC

3)  The Beta PC is ready to scan the Smartcards (Command 8)

4)  The Supreme Court Representative starts to scan the Smartcards, one
    by one. Taking the Smartcards from one For-Tally Box to another

5)  The PC generates a Valid-Tone for each Smartcard that is not in the
    impugned list

6)  An Alert-Tone will indicate that the PC has found a Smartcard with
    matching information.

7)  The Smartcard is set aside and the Supreme Court Representative
    continues with the remaining cards until the For-Tally Box is empty
    or until the total number of impugned cards have been identified

8)  All the Smartcards, except for the impugned ones, are returned to
    the witnessing parties for a recount. See Tally Procedure.

Throughout the entire process, the cast votes were never revealed.

By providing the above capability, the Impugned Voters List is very
likely to grow and may taper off as time goes by, in the meantime, now
we can deal with them. The growth of this list will be largely due to
last minute registrations: the BOE cannot reject them, but it is likely
that not all will be verified on time for Election Day.

## Wrap-Up Procedure:

Upon finalizing the tally and producing the Results CD's, the following
steps are required for a smooth transition.

1)  Each Election Rep must produce a copy of his/her Results CD for the
    other Election Reps, label them, and distribute them

2)  The BOE Rep must print a copy of the final tally for each Election
    Rep and distribute them

3)  Each Election Rep must sign all copies and keeps one

4)  The BOE Rep must dial up the State Board of Election Headquarters
    (or to some other designated phone number) and transmit his/her CD
    for the information to be promptly published on their website

5)  One Election Representative from each party must be allowed to dial
    up to their party headquarters (or to some other designated phone
    number) to transmit their CD so it can be promptly published on
    their website, if they chose to.

6)  The BOE Rep coordinates the "Prepare for Next Election Procedure"

7)  Party Election Reps are entitled to leave the precinct with all
    his/her CDs, the signed printout of the total tally, impugned action
    notes, if any, and his/her personal belongings.

8)  The BOE Rep arranges to have the following secured, packed, and
    ready to transport to the State Board of Election Headquarters.

    a.  The Counted Ballot boxes

    b.  The Rejected Cards box (for investigation)

    c.  The Stray Cards box

    d.  The Prepped Cards box

    e.  His/her copy of the official results CD

    f.  The printout of the total tally

    g.  Other personal materials

## Prepare Next Election Procedure:

CAUTION: There is no way to recover the deleted information once this
procedure is completed and there is no way to turn the count back once
the commands have been executed, either. So please refrain from using it
if the outcome of the election is still questionable.

The BOE Election Representative responsible for coordinating the wrap-up
should be aware that there is no restriction on a representative to
execute Command 22 (or other commands requiring three representatives).
Therefore, it is assumed that whoever executes it is in agreement with
all other parties.

Three highest ranking Election Reps are required to complete the
procedure. This procedure describes a scenario having two Election Reps
at the end of one election and one Election Rep at the beginning of the
next election. The assumption is that the party members may not be
around for the following elections while the State BOE Election Rep more
likely will be.

1)  Once the outcome of the election is conclusive and final and a clear
    undisputable winner emerges, the Smartcards can be prepared for
    reuse in the following elections.

2)  On his/her Beta PC the first Election Rep executes Command 22 on
    each of the Smartcards, one by one. A tone advises the
    representative that it completed successfully. Each time the
    Smartcard is handed over to the second Election Rep.

3)  On his/her Beta PC the second Election Rep repeats the same
    activities as the first Election Rep. A tone advises the
    representative that it completed successfully. After the tone, the
    second Election Rep places the Smartcard into a box labeled
    "Prepped-Cards". Meaning that the high ranking BOE Election Rep that
    pulls out a Smartcard from this box needs to run Command 22 one more
    time to clear specific memory before reusing it.

4)  At any time after Steps 2 & 3 have been completed (most likely at
    the beginning of the following elections), the BOE Election Rep
    performs the same activities as described in Step 2 and the ballot
    questions get deleted, the Ballot Status is reset to 0, and the
    statuses of all Election Reps are reset to 0. A tone will indicate
    the command was completed successfully.

5)  End of procedure.

## Reused Smartcards Election Procedure:

At the beginning of an election process the following information is
required, but in the case where Smartcards are being reused, this
information is particularly important and handled separately:

-   A complete set of all ballot questions

-   A Precinct Information Record containing, address and other relevant
    information

-   A completed list of Active Registered Voters with updated
    information an voting preferences

It is the BOE Representative's, at the precinct level, responsibility is
to create a Master CD with the above information and reproduce the
required number of CD's for distribution. The copies of the Master CD
are to be handed over to each of the Party Election Reps.

Before starting this procedure, all Election Reps must have their PCs
initialized and with their IDOK codes loaded.

1)  Clear Smartcards to accept new ballot questions. See "Prepare Next
    Election Procedure". Place Smartcards that only have the Voter
    Identification Data into a box labeled "VID Cards" to separate them
    from virgin Smartcards, those without Voter Identification Data, and
    facilitate the verification process.

2)  The BOE Representative hands over a copy of the Master CD and an
    Election Instruction Booklet to each of the Party Election Reps
    participating in his/her precinct.

3)  Sufficient time must be allocated to all Party Election Reps so they
    can verify and validate the list of voters. Enough time should also
    be allocated in case last minute modifications of the ARV are
    required, in which case, a new Master CD needs to be burnt; new CD
    copies made, old copies recovered from all Election Reps and
    replaced by the new ones, and destroy all copies of the First Master
    CD.

> Parties presenting last minute voter registrations must provide a copy
> of the list to all other Party Election Reps for verification.

4)  The BOE Rep connects a Smartcard from the VID-Cards box to the Alpha
    PC.

> If the Software verification passes (Command 6), the Alpha PC
> retrieves voter's identification (Command 8). The BOE Rep compares it
> to the list of registered voters.
>
> If codes don't match or the voter's identification is not found, an
> Alert-Tone indicates the Smartcard should be rejected. End of
> procedure and the BOE gets another Smartcard from the VID-Cards box.
>
> If all are passes, the Alpha PC updates the voter's information, loads
> the BOE IDOK codes, the precinct information record, and all the
> ballot questions (Commands 7, 14 & 23). The BOE Election Rep hands
> over the Smartcard to the first Election Rep of the IDOK group.

5)  The Election Rep connects the Smartcard to his/her Beta PC and
    confirms the following:

    -   Software Verification Code (Command 6)

    -   Comparison of CD to Smartcard's content - voter's identification
        data (Command 8)

    -   Comparison of CD to Smartcard's content -- Precinct Information
        Record (Command 15)

    -   Comparison of CD to Smartcard's content -- Ballot questions
        (Command 24)

> An Alert-Tone notifies the Election Rep when a mismatch is
> encountered; the Election Rep takes possession of the Smartcard (pulls
> it out of the process) to protect the Party codes and investigate the
> card later. The alarm could have been caused by a code mismatch, a
> hardware malfunction or a wrongdoing by the BOE Election Rep.
>
> If they all pass, the Beta PC loads the Election Rep's IDOK codes
> (Command 9) and hands over the Smartcard to the next Election Rep.

6)  The Election Rep performs the same activity described in Step 5. It
    the Election Rep is the last in the process, s/he drops the
    Smartcard into a box labeled "For-Label".

7)  The BOE Rep connects a Smartcard from the For-Label box to the Alpha
    PC and prints out the corresponding label (and instructions for
    special services, if any) using the voter's information (See
    Commands 7 & 8).

8)  The label is affixed to an Election Package; the Smartcard is
    removed and inserted into the package and dropped into a box labeled
    "For Shipping".

9)  End of the procedure.

> Next step: Voting Procedures (at the precinct, or outside the Precinct
> or by Phone).

## Post-Election Voter Verification Procedure:

This procedure is designed to allow all voters to verify that their
Smartcard was in fact received on time at the precinct; that each party
has been entrusted with a responsibility to defend the integrity of
their Smartcard; and that it was included in the final tally.
Furthermore, the voter can verify that his/her Smartcard actually
recorded as s/he intended.

1)  After Election Day the voter visits the precinct website as
    indicated on the printout s/he obtained after voting. S/he would
    then type in a portion of the VVN and the site will display the
    remaining portion as evidence that his/her Smartcard was included in
    the final tally.

2)  The voter can find an encrypted file associated to his/her VVN,
    download that file into a floppy disk, and reconstruct his/her
    choices without loosing the secrecy of the vote.

3)  Using a Zeta PC the voter enters his/her PIN as the encrypted key
    and decrypts the downloaded file to verify his/her choices. The
    ballot choices will appear in the same way they were entered on
    Election Day. Since only the voter knows his/her Personal Voting
    Codes, only the voter knows the meaning of the display.

4)  In the event that the voter used written alternatives in any or all
    the ballot questions, either as a choice or as a decoy, the voter
    will see these choices, a stronger evidence that his/her Smartcard
    not only arrived on time but also got through in delivering his/her
    choices.

5)  If the voter doesn't find the information and doubts the process,
    s/he has all the right, and the obligation to make him/herself heard
    in any and all means available to him/her as a disenfranchised
    voter. The temporarily disenfranchised voter must request the Court
    and/or the BOE to find out what happened with his/hers Smartcard,
    which in the worst case may need to be replaced.

6)  A simple mathematical calculation can determine the margin of error
    and is based on the number of voters that verify and the number of
    voters that complain. That is, if all voters verify and only X
    complain; the error rate is X divided by the number of voters. If
    only one half (1/2) of the voters verify and the same number
    complain, the error rate is equal to 2X divided by the total number
    of voters. If only 1/n of the voters verify and the same number
    complain, the error rate is equal to nX divided by the total number
    of voters. The number of the voters that verify can easily be found
    at the precinct's website as well as the number of complains if the
    precinct website is setup to do that. This method of determining the
    "margin of error" compared to the currently accepted one in
    political polls, can easily result in an unbelievable improvement of
    a hundredth fold.

7)  End of procedure.

## Special Attention Desk -- Handling Procedure:

1)  If the Smartcard was rejected during codes verification it is likely
    that the card is a clone with corrupted software intended to copy
    the access code of an election rep to be use to copy the
    verification code using another Smartcard.

    a.  Take the voter's identity, party affiliation, address etc.

    b.  Ask the police to escort him/her to the captured address for
        verification

    c.  Allow the attacked party to investigate the incident further and
        prosecute. The information obtained with Command 31 and the
        information from the State BOE can help to determine the source
        of the attack.

2)  Using the Smartcard responses to Commands 1, 2, 3, and 4, the
    problem can be found.

    a.  If an electronic attack occurred, go to 1) a. b. & c.

    b.  If the Smartcard doesn't respond as expected issue a new card to
        the voter.

# HARDWARE DESCRIPTION

## ALPHA PC

This computer is controlled by the BOE Rep and is located at the
precinct and its main purpose is to perform the following
functionalities:

1)  Loads Smartcard Software into Smartcard

2)  Loads Voter Identification Data (VID) into Smartcard

3)  Matches Smartcard VID to list of Active Registered Voters

4)  Verifies Smartcards: software, codes, statuses, etc

5)  Creates and edits Ballot Questions

6)  Loads formatted Ballot into Smartcard

7)  Prints labels via printer

8)  Tallies votes, record them on a CD, and print the results

9)  Adds to the CD the encrypted cast ballots

10) Connects to BOE headquarters to transmit all the data storage on the
    CD-ROM

## BETA PC

These are battery operated owned and controlled by the Party's Election
Reps and their main purposes are to perform the following
functionalities:

1)  Loads Software codes into Smartcard

2)  Loads IDOK codes into Smartcard

3)  Verifies IDOK codes of Smartcard

4)  Verifies Software CDs

5)  Tally votes, record them on a CD and show the results

6)  Add to the CD the encrypted cast ballots

7)  Connects to Party headquarters to transmit all the data storage on
    the CD

8)  Find the impugned Voter's identification on any Smartcard

## GAMMA PC

These are desktop computers or touch screen DRE located at the precinct
and their main purpose is to load personal codes into Smartcards. They
provide the following functionalities:

1)  Loads Personal Identification Code (PIN)

2)  Loads Personal Voting Code (PVC)

## DELTA PC

These are desktop computer or touch screen DRE located at the precinct
and their main purpose is to cast votes. They provide the following
functionalities:

1)  Verifies voter's PIN

2)  Provides audible and visual instructions for voting

3)  Prints random Vote Verification Number

4)  Equipped to operate as a vote-verification machine

## EPSILON PC

These are desktop computers located at a Call-Center, either at a
service center or inside a precinct, and their main purpose is to enable
voting over a telephone call.

1)  Verifies voter's PIN by phone

2)  Provides audible instructions for voting

3)  Reads out random Vote Verification Number

## ZETA PC

These are personal computers located in homes, libraries or Notary
offices and their main purpose is to enable voting outside the precinct.

1)  Loads provisional Personal Identification Code (PIN)

2)  Loads provisional Personal Voting Code (PVC)

3)  Verifies voter's PIN

4)  Provides audible and visual instructions for voting

5)  Prints random Vote Verification Number

6)  Prints notarized statement

7)  Equipped to operate as vote-verification machine

8)  Decrypts and shows final votes after Election Day

## SMARTCARD

This is a microscopic portable computer with built-in security features
and programmed to perform commands (see Smartcard Commands section). All
electoral data required for an election, such as precinct address, party
codes, running candidates, ballot choices, and voter's information is
stored in these cards; each one of them is uniquely customized for each
voter. Due to the sensitive nature of this information and the high
level of confidentiality demanded of this application, only officially
certified Smartcards should be distributed and under the control of each
State Board of Elections. For the purpose of this description, we are
assuming that this solution will have national acceptance and it is
therefore reasonable to expect that The NIST could be responsible for
defining, testing, and standardizing the features that will be required
by the device and to issue the respective certifications prior to
deployment.

At a minimum, understanding that more stringent requirements may be
imposed and that a State BOE has final say on how best (economically,
logistically, etc.) to deploy the functions, the device must perform the
following functions or exhibit the following characteristics:

1)  Comply with EAL4+ security

2)  Application Software loaded into a One Time Programmable Read Only
    Memory (OTPROM)

3)  Equipped with on chip voltage regulators

4)  CPU clock derived from own internal oscillator

5)  Detection and notification of HW/SW tampering

6)  Out of frequency/voltage/temperature detection

7)  Unique chip identification number

8)  Supports SPA/DPA protection mechanisms

9)  On chip random number generator

10) More than 10 years data retention

11) Large flash memory to hold graphics (candidates and voter photos and
    party logos) and data (ballot questions, voter ID, etc)

12) Two serial interfaces are preferred: one contact less interface to
    expedite security checks and tallying procedures at the precinct and
    one ubiquitous-type port for outside the precinct, such as an USB
    port.

SMARTCARD COMMANDS

# INTRODUCTION

For the purpose of understanding the operations, two parties would have
sufficed. However, four political parties are used to show that there is
no limit to the number of parties this solution can serve.

All the information requested by the commands is stored inside the
Smartcards' non-volatile memory, together with internal counters for
read access, write access; and storage for internally generated numbers.
No information can be retrieved unless it is completely necessary and
does not infringe on the privacy of the voter. Most functions requiring
an exchange of confidential information can ONLY be accessed through
three valid representative codes.

The Smartcard software commands are performed internally and must be
simple, written in machine language, well documented, and posted
publicly for review and verification by all political parties,
government, and electoral organizations and by voters. Once verified,
security measures must be in full force from the point when Election
Reps load the software and access and verification codes into the
Smartcards.

The Smartcard commands are serially entered and instruct the Smartcard
to perform a specific task. Upon execution, the Smartcard outputs a
serial message as the response. Each input or output messages must
include overhead information to allow for error detection/correction.

# SYNTAX

The syntax is simple: the commands start with a number and followed by
parameters, if any. The responses start with an error code followed by
the coded value corresponding to each parameter.

# SECURITY

Since we could not rule out the possibility of malicious characters
modifying a PC to copy representative codes for later retrieval; the
only foreseeable way we have identified, at this time, to break the
built-in security of this system is allowing representatives to enter
their codes into the same PC at the precinct. No party in their right
mind would accept the risk of entering their codes into a PC which they
cannot ascertain as clean. Therefore, extreme care was exercised to
build into the process steps to prevent the possibility of copying
access codes. The resolution to the issue of sharing PC's is left to the
political parties. We can rest assured that when political distrust
pervades the elections atmosphere, sharing any equipment is very
unlikely.

In order to protect the confidentiality of representative's codes, an
indirect approach was adopted to determine the status of
representatives. Also, this new paradigm assumes that more than one
person's approval is needed to execute sensitive commands, throughout
this document we will assume that 3 representatives must agree and
sign-off (electronically) before sensitive commands can be executed. The
statuses of the representatives are checked prior to executing sensitive
commands. If the required status is not set, the command will not
execute.

# USER INTERFACE

The user interface (languages, logos, colors, etc.) is bound to have
different designs in order to accommodate the various types and
quantities of information required by each state. Because the user
interface will be customized, it is best to leave these details to the
State Board or Elections (BOE) and the chosen developers of the
Smartcard Software. Hence, it will not be addressed in this description.

# Commands List

## RetrieveStatus-ElectionReps:

Command 1:

Response:

C1: E, SCR, SBR, SMR, SSR, STR, SFR, SN

Parameters:

SCR: Status Code for the Supreme Court representative

SBR: Status Code for the BOE representative

SMR: Status Code for the Majority Party representative

SSR: Status Code for the Second Party representative

STR: Status Code for the Third Party representative

SFR: Status Code for the Fourth Party representative

SN: Status Code for the Notary

Error Codes (E):

0 No errors & command completed

1 Message corrupted

Status Codes for Notary (SN):

0 Notary inactive

1 Notary contacted the BOE Rep and loaded the Notary ID

2 Notary validated voter's identification and codes were entered
privately

Status Codes for each Representative:

0 All codes empty

1 Software codes loaded

2 Software and IDOK codes loaded

3 Software and IDOK codes loaded and ready to tally

4 Software and IDOK codes loaded and Mix OK

5 Software and IDOK codes loaded and ready to load provisional voter
codes

6 Software and IDOK codes loaded and ready to approve voter codes

7 Software and IDOK codes loaded and ready to delete ballot and IDOK
codes

8 Tampering detected

**Description:**

This command does not require input parameters. The Smartcard responds
by presenting a snapshot of the content of the specified registers (one
per representative).

**Purpose:**

This indirect approach was implemented to protect the confidentiality of
representatives' codes. This way more than one person's approval is
needed to execute sensitive commands. Three representatives must agree
and sign-off (electronically) before sensitive commands can execute. The
statuses of these registers are checked prior to executing sensitive
commands. If the required status is not set, the command will not
execute.

## RetrieveStatus-VoterID:

Command 2:

Response:

C2: E, SVI, SVP

Parameters:

SVI: Status Code for the voter's personal information

0 No voter information stored

1 Voter information loaded by BOE Rep

2 Voter information verified by three representatives before mailing

3 Voter information verified personally by Notary

4 Notary witnessed that PIN/PVC were entered privately

5 Notarized information and codes were approved by three representatives
at precinct

6 Voter information verified personally by three representatives at
precinct

7 Voter information reconfirmed and codes approved by three
representatives at precinct

SVP: Status Code for the voter's picture

0 No picture stored

1 Picture loaded by BOE Representative

2 Picture captured at the Notary's office

3 Picture captured at the precinct

Error Codes (E):

0 No errors & process completed

1 Message corrupted

**Description:**

This command does not require input parameters. The Smartcard responds
by presenting a snapshot of the content of SVI and SVP.

Note: Only Smartcards with SVI status of 5 or 7 can be counted or
encrypted.

**Purpose:**

These registers were designed as an audit trail of the voter's activity
with the Smartcard. It practically shows who (notary or precinct)
handled it, from empty to ready to vote, while identifying the key
intermediate steps. The progression of steps ensures that no one else,
but the legitimate Smartcard owner, is going through the validation
process. This command also serves as a quick and accurate tool to
resolve questions that may arise due to blank, partially loaded, or
corrupt Smartcards that may fall inadvertently into a ballot box,
without having to disclose any voter's information.

## RetrieveStatus-VoterCodes:

Command 3:

Response:

C3: E, SPN, APC

Parameters:

SPN: Status Codes for voter's PIN and PVC

0 No codes stored

1 PIN/PVC loaded outside the precinct, provisional

2 PIN/PVC loaded outside the precinct, provisional but approved by
Notary

3 Notarized PIN/PVC approved by three representatives at precinct

4 PIN/PVC loaded at the precinct, provisional

5 PIN/PVC loaded at the precinct and approved by three representatives

6 PIN tampering detected

7 Hardware tampering detected

APC: Quantity of PVC's remaining active

Error Codes (E):

0 No errors & command completed

1 Message corrupted

**Description:**

This command does not require input parameters. The Smartcard responds
by presenting a snapshot of the content of the SPN and APC register.

This command reveals where (inside or outside the precinct) the codes
were entered; while identifying the key intermediate steps. The
progression of steps ensures that no one else, but the legitimate
Smartcard owner, is going through the code entry process, heightening
the voters and the representatives confidence in the system.

The final checkpoint, approval by three Election Reps, is designed to
trap any attempt to drop in a fake Smartcard into the ballot box. If the
Smartcard were initialized with a single pass, a voter may walk into the
booth with a hidden Smartcard and switch it while inside the booth, drop
off the fake into the ballot box, and walk away with the good one, sell
it, and the buyer would load the codes and vote. Initializing the
Smartcard after a second pass traps this malicious behavior, if it were
to occur.

The APC represent the number of PVC's remaining active. It starts with
the number of PVC's entered with Command 12 or 18, maximum of 4. If one
PVC is used to select OPW and the OPW candidate turns out to be the
winner of the election, then Command 34 will decrement APC by 1 and the
PVC that was used is eliminated.

**Purpose:**

This register sets up an audit trail on the voter's most private
information, Personal Identification Number and Personal Voting Codes.
Using this indirect approach to check the status of personal codes
provides even more confidence in the voter, resting assured that no one
needs to or will see his/her codes.

## RetrieveStatus-Ballot:

Command 4:

Response:

C4: E, SB, QQ, NW, N1, N2

Parameters:

SB: Status Code for the Ballot

0 Ballot empty

1 Ballot loaded but not cast

2 Ballot loaded and cast

3 Ballot loaded, cast and protected

QQ: A number representing the amount of questions in the ballot

NW: The number of written choices entered by the voter

N1: Number of times the internal votes were reported; increments after
each report

N2: Number of times the encrypted internal votes were reported;
increments after each report

Error Codes (E):

0 No errors & command completed

1 Message corrupted

**Description:**

This command does not require input parameters. The Smartcard responds
by presenting a snapshot of the content of only the ballot registers and
counters, but the ballot area containing the votes and candidate choices
remain locked and hidden at all times.

**Purpose:**

These registers and counters were designed as an audit trail on the
ballot. The counters allow each Election Rep to perform a tally in
his/her own PC while ensuring that no representative can count the same
Smartcard twice and pass undetected.

This system is designed to allow each party to retrieve a tally result
and encrypted records of each and all the votes for posting on their own
party's web site after Election Day. In so doing, it may happen that the
resulting counts may differ among representatives. In such cases, this
command can determine which Smartcard was not counted, thus resolving
any discrepancy. In addition, this method protects both, the privacy of
the voter and the confidentiality of the vote.

## LoadCodes-Software:

Command 5: A, V, NG

Response:

C5: E

Parameters:

A: Access Code to be used in the future as an input parameter in Command
6 and Command 30

V: Verification Code to be used in the future as an output parameter of
Command 6

NG: Number indicating the representative's group

1 Supreme Court

2 BOE

3 Majority Party

4 Second Party

5 Third Party

6 Fourth Party

Error Codes (E):

0 No errors & command completed

1 Message corrupted

4 Data is already loaded

5 Invalid entry or out of range

**Description:**

This command requires representatives at the state level to enter two
codes and to identify which group of representatives s/he belongs to.
The codes entered for A and V enables the representative to execute the
"VerifyCodes-Software" command (Command 6) anytime in the future. These
two codes cannot be erased and reloaded nor can they be overwritten. The
V code is revealed only after the corresponding A code is entered with
Command 6.

After the representative at the state level loads his/her codes, the
corresponding Status Code for the Election Representative is set to 1
(Software Codes Loaded).

Note 1: Immediately after the software is burnt into the OTPROM of the
Smartcard, each state level representative that witnessed this operation
must execute this command from his/her own PC. Any lapse time between
these two events will introduce growing levels of uncertainty in the
electoral process.

Note 2: The A and V codes are owned by each of the parties and the
highest security procedures must be implemented by each party to ensure
that these most highly confidential codes are handled properly.

Note 3: Each representative must execute this command so that all Status
Codes for the Election Representatives change from 0 to 1, otherwise
Command 9 cannot be executed.

**Purpose:**

This command enables Election Reps, at the State level, to perform
future verifications of the Smartcard software.

This command is used in conjunction with Command 6 to prove that the
Smartcard in question contains software that was sealed with a code only
known by the representative, therefore containing the original software.
A No-Match could be interpreted as a Smartcard that was not loaded in
that state or that it is corrupt and should be destroyed.

## VerifyCodes-Software:

Command 6: A, NG

Response:

C6: E, V

Parameters:

A: Access Code previously loaded with Command 5

NG: Number indicating the representative's group

1 Supreme Court

2 BOE

3 Majority Party

4 Second Party

5 Third Party

6 Fourth Party

V: Verification Code previously loaded with Command 5

Error Codes (E):

0 No errors & command completed

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

5 Invalid entry or out of range

**Description:**

This command requires the representative, at the state level, to enter
the Access code (loaded with Command 5) and to identify which group of
representatives s/he belongs to. The Smartcard responds by displaying
the Verification code (loaded with Command 5). This command can be
executed anytime after Command 5 was executed.

**Purpose:**

This command allows the Election Reps, at the State level, to verify the
Smartcard software. By confirming that the response is identical to the
one in his/her PC (the same V code entered with Command 5), the
representative rests assured that the Smartcard was "sealed" by him/her
when the original software was loaded. A No-Match could be interpreted
as a Smartcard that was not loaded in that state or that it is corrupt
and should be destroyed.

## LoadVoterID:

Command 7: A, V, RVI, RVP

Response:

C7: E

Parameters:

A: Access Code of the BOE representative at the precinct level

V: Verification Code of the BOE representative at the precinct level

RVI: Record containing all required voter information

RVP: File containing the voter's digital picture

Error Codes (E):

0 No errors & command completed

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

6 IDOK codes active (greater than one)

**Description:**

This command performs two functions: 1) it is used by the BOE
representative, at the precinct level, to enter his/her two IDOK codes
and 2) to enter the voter's information and, if available, his/her
picture also.

The codes entered for A and V enables the BOE representative to execute
the "VerifyCodes-IDOK" command (Command 10) anytime in the future.

These two codes cannot be overwritten. The V code is revealed only after
the corresponding A code is entered in Command 10.

If the picture was loaded, the Smartcard changes the Voter's Picture
status from 0 to 1, see SVP parameter of Command 2. Otherwise it remains
0 and the picture could be loaded at a later time either at the Notary's
office or at the precinct, if they were equipped to do so.

If the Election Rep's Status is 2 or greater, this command will not
execute and will respond with an E=2.

Note 1: The A and V codes are owned by the representative and the
highest security procedures must be implemented to ensure that these
most highly confidential codes are handled properly.

Note 2: The number of times that a mismatch is permitted, as well as the
handling procedure, are determined by the respective State Boar of
Elections.

Note 3: The personal information loaded with this command becomes locked
and inaccessible after the Ballot Status reaches 2 or greater.

Note 4: The registered voter number and the name of the voter are
entered only once and can never be overwritten. This command can be
reused to update changes of address, etc. except these two items. If the
voter changes name due to a change in civil status, a new Smartcard must
be issued.

**Purpose:**

To personalize each Smartcard, this command is used to enter the voter
information starting with his/her registered voter number, name,
address, floor, room, phone number, signature, fingerprint, picture, and
picture status. The State BOE may also decide offer value added services
and collect the required information using this command. For instance,
special shipping carriers, a different mailing address, special voting
preferences, such as voting by phone, etc.

## RetrieveVoterID:

Command 8: \[A\]

Response:

C8: E, RVI, RVP

Parameters:

A: Supreme Court Access code, required only after the ballot is cast

RVI: Record containing all of voter's identification

RVP: File containing the voter's digital picture

Error Codes (E):

0 No errors & command completed

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

7 Protecting cast ballot or Rep Status invalid

**Description:**

This command does not require input parameters when executed before
casting the vote. Once the vote is cast, only the Supreme Court Access
code can retrieve the personal information (as loaded with Command 5),
but not the vote. Upon execution of this command, the Smartcard responds
with the voter's personal information as loaded with Command 7.

If the Ballot Status is 2 or greater, this command will not execute and
will respond with an E=7.

**Purpose:**

This command is used to retrieve Voter's information for verification
purposes. However, after the vote is cast questionable Smartcards, for
valid reasons and upon a party's request, can only be opened by the
Supreme Court representative. All this information is kept secret when
the Ballot Status is 2 or greater, except when using the Supreme Court
access code.

## LoadCodes-IDOK:

Command 9: A, V, NG

Response:

C9: E

Parameters:

A: Access Code to be used in the future as an input parameter in
Commands 10, 11, 13, 20, 22, 28, 29, 31, and 34

V: Verification Code returned by the Smartcard upon executing Command 10

NG: Number indicating the representative's group

1 (Code Not Used)

2 (Code Not Used)

3 Majority Party

4 Second Party

5 Third Party

6 Fourth Party

Error Codes (E):

0 No errors & command completed

1 Message corrupted

4 Data is already loaded

5 Invalid entry or out of range

7 Protecting cast ballot or Reps Status invalid

**Description:**

This command requires the representative, at the precinct level, to
enter two codes and to identify which group s/he belongs to. The codes
entered for A and V enables the representative to execute the
"VerifyCodes-IDOK" command (Command 10) anytime in the future. These two
codes cannot be overwritten. The V code is revealed only after the
corresponding A code is entered with Command 10.

Note 1: This command can only be executed after Command 7 and when
Election Rep Status Codes are set to 1(Software codes loaded).

Note 2: The A and V codes are owned by each of the parties and the
highest security procedures must be implemented by each party to ensure
that these most highly confidential codes are handled properly.

**Purpose:**

This command enables Election Reps, at the precinct level, to perform
future verifications of the Smartcard itself.

This command is used in conjunction with Command 10 to prove that the
Smartcard in question pertains to the original list of active registered
voters and sealed with a code only known by the representative,
therefore a valid Smartcard. A No-Match could be interpreted as a
Smartcard clone, that it was loaded in a different precinct or that it
is corrupt and should be destroyed.

When voter's information is no longer available, as it occurs after the
vote is cast, Commands 9 and 10 play a major role in dispelling doubts
about the authenticity of the Smartcard.

## VerifyCodes-IDOK:

Command 10: A, NG

Response:

C10: E, V

Parameters:

A: Access Code loaded with Command 9

NG: Number indicating the representative's group

1 (Code Not Used)

2 BOE

3 Majority Party

4 Second Party

5 Third Party

6 Fourth Party

V: Verification Code previously loaded with Command 7 or 9

Error Codes (E):

0 No errors & command completed

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

5 Invalid entry or out of range

**Description:**

This command requires the representative to enter the Access code
(loaded with Command 9) and to identify which group of representatives
s/he belongs to. The Smartcard responds by displaying the Verification
code (loaded with Command 9). This command can be executed anytime after
Command 9 was executed.

**Purpose:**

This command allows the Election Reps, at the precinct level, to verify
the Smartcard's authenticity. By confirming that the response is
identical to the one in his/her PC (the same V code entered with Command
9), the representative rests assured that the Smartcard was "sealed" by
him/her before it was mailed. A No-Match could be interpreted as a
Smartcard that was not mailed out from that precinct (use Command 15 for
precinct location) or that it is corrupt (use Command 6) and should be
destroyed.

When voter's information is no longer available, as it occurs after the
vote is cast, Commands 9 and 10 play a major role in dispelling doubts
about the authenticity of a Smartcard.

## SetupVoterCodes-Precinct:

Command 11: A, NG, \[RVP\]

Response:

C11: E

Parameters:

A: Access Code as loaded with Command 9

NG: Number indicating the representative's group

1 (Code Not Used)

2 BOE

3 Majority Party

4 Second Party

5 Third Party

6 Fourth Party

RVP: File containing the voter's digital picture

Error Codes (E):

0 No errors & command completed

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

5 Invalid entry or out of range

**Description:**

This command requires the representative to enter their Access code and
to identify which group of representatives s/he belongs to.

The first representative executing this command must also prepare the
voter's picture, if the PC is equipped for doing so. Upon completing the
command, and assuming that the picture was loaded, the SVP would be
changed to a 3 (Picture captured at the precinct). Otherwise, the
Smartcard would automatically detect the absence of the file and would
leave the SVP parameter unchanged, a value of 0 (No picture stored).

After execution, this command changes the Election Rep Status Code to a
value of 5 (Software, IDOK codes loaded and ready to load provisional
voter codes).

As the Smartcards goes from representative to representative, their
corresponding Election Rep Status Code changes to 5. After the third
representative, the Smartcard will set SPN to 0 (No Codes Stored) and
SVI to 6 (Voter's information verified personally by three precinct
representatives).

Voter PIN and PVC codes cannot be entered unless the above conditions
have been met.

**Purpose:**

This command sets up the scenario for three different party
representatives, at the precinct level, to verify the voter's proof of
identity by comparing it to the Smartcard's stored information; meaning
that the Smartcard will see this command executed three times, once by
each representative. Only then, will the Smartcard be enabled to load
the voter's provisional PIN and PVC.

## EnterVoterCodes-Precinct:

Command 12: PIN, PV1, PV2, PV3, PV4

Response:

C12: E

Parameters:

PIN: Voter's Personal Identification Number

PV1: Voter's 1st Personal Voting Code

PV2: Voter's 2nd Personal Voting Code

PV3: Voter's 3rd Personal Voting Code

PV4: Voter's 4th Personal Voting Code

Error Codes (E):

0 No errors & command completed

1 Message corrupted

4 Data is already loaded

5 Invalid entry or out of range

7 Protecting cast ballot or Rep Status invalid

**Description:**

This command requires the voter to enter his/her PIN and the required
quantity of PVC codes (varies from BOE to BOE, four are implemented in
our example).

This command can only be executed after Command 11 was completed.

If three Election Reps' Status Codes are not set to 5 the codes will not
be loaded and an E=7 is returned.

If the voting codes are repeated (PV1=PV2, etc) or if they exhibit some
other unacceptable condition (determined by the BOE) an E=5 is returned
by the Smartcard.

Upon completion of this command, the status of the Election Rep is set
to 6 (Codes loaded and ready to approve voter codes); SPN is set to 4
(PIN/PVC loaded at the precinct, provisional); and APC is set to the
number of PVC's that are filled.

**Purpose:**

This command provides the freedom to host the PIN/PVC collection
function on a different PC. The voter's identity is confirmed by party
representatives before allowing him/her to enter his/her personal codes
(PIN and PVC's). Once the three representatives have confirmed that the
voter is who s/he says s/he is, the voter proceeds to enter the codes
privately and directly into the Smartcard.

## ApproveVoterCodes-Precinct:

Command 13: A, NG

Response:

C13: E

Parameters:

A: Access Code loaded with Command 9

NG: Number indicating the representative's group

1 (Code Not Used)

2 BOE

3 Majority Party

4 Second Party

5 Third Party

6 Fourth Party

Error Codes (E):

0 No errors & command completed

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

7 Protecting cast ballot or Rep Status invalid

**Description:**

This command requires the representative to enter the Access code and to
identify which group of representatives s/he belongs to. If the entries
match, the Smartcard responds by changing the Election Rep Status to 6
(. . . ready to approve voter codes).

As the Smartcards is passed on from representative to representative,
the corresponding Election Rep Status code changes to 6. Once the
Smartcard detects that the status of the third Election Rep changes to
6, the Smartcard also sets SVI to 7 (Voter information reconfirmed and
codes approved by three representatives at precinct) and Voter Codes
(SPN) to a status of 5 (PIN/PVC loaded at precinct and approved by three
precinct representatives).

The Smartcard is now initialized and ready for casting votes.

**Purpose:**

This command allows three different party representatives, at the
precinct level, to verify the voter's proof of identity by comparing it
to the Smartcard's stored information before it is initialized, i. e.,
making the provisional PIN/PVC codes permanent. The voter can now cast
votes.

The approval by three Election Reps in two passes was designed to trap
any attempt to sell initialized Smartcards. See description of Command
3.

## LoadPrecinct:

Command 14: A, RPI

Response:

C14: E

Parameters:

A: Access Code of the BOE representative; loaded with Command 7

RPI: Record containing all required precinct information, including the
Notary Unlock Code

Error Codes (E):

0 No errors & command completed

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

**Description:**

This command requires the BOE representative at the precinct level to
enter his/her Access code and to have the precinct data file ready for
loading into each Smartcard of their locality.

**Purpose:**

This command is used to assign Smartcards to precincts by entering the
corresponding precinct information. All precinct information required by
the BOE of the locality and by the Notary needs to be stored in a file
and ready to load before executing this command. Some pieces of
information that come to mind are the precinct number, the Notary Unlock
Code (NUC), the precinct address, floor, room, the precinct phone
number, and the BOE Representative's cellular phone number, any
additional information is determined by the Board of Elections.

The NUC is loaded into the Smartcard to serve as a verification number;
this is why it is not retrieved with Command 15. The procedure requires
that the Notary call the Precinct or the BOE Representative to obtain
the NUC. Where and how the Notary Unlock Code or codes are kept and
protected are responsibility of the BOE. Whichever method is selected is
far better than to expect all people to use a NUC retrieval command
honestly.

## RetrievePrecinct:

Command 15:

Response:

C15: E, RPI

Parameters:

RPI: Record containing all the precinct information, except the Notary
Unlock Code (NUC)

Error Codes (E):

0 No errors & command completed

1 Message corrupted

**Description:**

This command does not require input parameters. The Smartcard responds
by providing all the precinct information, except for the Notary Unlock
Code; see Command 14.

**Purpose:**

This command is used to display all the stored precinct information
loaded with Command 14, except for the NUC.

## LoadNotary:

Command 16: NUC, RNI

Response:

C16: E

Parameters:

NUC: Notary Unlock Code; provided by BOE Rep to Notary over the phone
after verifying identity

RNI: Record containing all the required Notary information

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

**Description:**

In order to complete this command the Notary must have first called the
precinct or BOE Representative to obtain the Notary Unlock Code (NUC).
The same information that was given to the representative as proof of
identity will be requested by the Zeta PC software to form the Notary's
personal information record; which contains data such as country, state,
county, Notary Certification number, Certification expiration date,
Notary's name, address, phone number and any other information
determined by the State Board of Elections.

Upon the completion of this command the Notary Status code (SN) changes
to 1 (Notary contacted the BOE Rep and loaded the Notary ID).

**Purpose:**

The purpose is to provide a means for the Smartcard to collect the
Notary's information required by the Notary Statement; which will be
signed and sealed by the Notary and the voter at the end of their
session.

## RetrieveNotary:

Command 17:

Response:

C17: E, RNI

Parameters:

RNI: Record containing all the required Notary information

Error Codes (E):

0 No errors & command complete

1 Message corrupted

**Description:**

This command does not require input parameters. The Smartcard responds
by providing all of Notary's information: country, state, county, Notary
Certification number, Certification expiration date, Notary's name,
address, phone number and any other information as entered in Command
16.

**Purpose:**

This command is used for obtaining Notary information from the
Smartcard. In order to match the voter to the Smartcard, the three
precinct representatives need to verify that the Notary Statement was in
fact printed out with the information contained in the Smartcard they
have in their hands.

Other users, who may need to contact the Notary or verify where the card
comes from, are also allowed to have access to the information.

## SetupVoterCodes-Notary:

Command 18: NUC, PIN, PV1, PV2, PV3, PV4, \[RVP\]

Response:

C18: E

Parameters:

NUC: Notary Unlock Code; provided by BOE Rep to Notary over the phone
after confirming identity

PIN: Voter's Personal Identification Number

PV1 to PV4: Different Personal Voting Codes the voter could use, as
required by the BOE

RVP: File containing the voter's digital picture

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

5 Invalid entry or out of range

7 Protecting cast ballot or Rep Status invalid

**Description:**

This command is executed once all the required information has been
collected by the Zeta PC. Three types of input are required: a picture,
taken at the Notary's office, the Notary's unlock code, obtained earlier
from the precinct, and the voter's PIN and PVC codes. If the Notary's PC
is equipped for taking pictures, s/he would proceed with taking the
picture of the voter and follow the instructions of the PC to store the
file in preparation to uploading. Next, the PC will ask the Notary for
the NUC. After s/he enters the code, s/he will be asked to leave the
office to grant privacy to the voter so s/he can enter his/her PIN and
PVC codes. Then the PC will send Command 18 to the Smartcard.

In response, the Smartcard compares the NUC entered with the one stored
internally (from Command 14). If there is a match, the Smartcard checks
to see if the Notary Status is equal to 1 (Notary called BOE Rep &
loaded Notary ID). If true, the status of the Voter Code (SPN) will be
set to 1, the status for Voter Information (SVI) will be set to 3, and
the status for the Voter Picture will change from 0 to 2, if a picture
file was detected. All the data has not been loaded into the Smartcard
memory yet. See Command 19.

**Purpose:**

This command allows the voter to prepare his/her PIN and PVC's in
private. The Notary is expected to verify the voter's proof of identity
by comparing it to the Smartcard's stored information, and then s/he
will follow the PC's instructions to allow the voter to enter his/her
PIN and PVC.

## NotarizeVoterCodes-Notary:

Command 19: NUC

Response:

C19: E, NVC

Parameters:

NUC: Notary Unlock Code; provided by BOE Rep to Notary over the phone
after verifying identity

NVC: Notary Verification Code is a random number printed out on the
Notary Statement

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

**Description:**

After Command 18 is executed the PC will instruct the voter to ask the
Notary to return to the office and the Notary will confirm one last time
that the voter's information in the Smartcard has not changed, meaning
it is the same Smartcard that was connected to the PC before he left the
office. Once confirmed, the Notary executes this command by entering the
NUC. In return, the Smartcard will store the collected information;
change SN status to 2 (Notary validated voter's identification and codes
were entered privately); SVI status to 4 (Notary witnessed that PIN/PVC
were entered privately); SPN status to 2 (PIN/PVC loaded outside the
precinct, provisional and approved by Notary); randomly generate an NVC
number; store the NVC and output it to the PC.

At the precinct, any representatives can run Command 31 to retrieve the
NVC and thus prove that the Smartcard is in fact the one that produced
the Notary Statement at the Notary's office.

**Purpose:**

This command is designed to protect against the possibility of a
Smartcard being switched by the voter at the Notary's office. Since the
Notary scenario is the most prone to security attacks, this procedure
setups a trap to detect these cases, in case they were to happen. Up to
this point the Smartcard NOT initialized, it still needs to pass the
scrutiny of three representatives at the precinct before the voter PIN
and PVC's are approved and become permanent (ready to vote).

## ApproveNotarizedVoter-Precinct:

Command 20: A, NG

Response:

C20: E

Parameters:

A: Access Code loaded with Command 9

NG: Number indicating the representative's group

1 (Code Not Used)

2 (Code Not Used)

3 Majority Party

4 Second Party

5 Third Party

6 Fourth Party

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

**Description:**

This command requires the representative to enter the Access code and to
identify which group of representatives s/he belongs to. If the entries
match, the Smartcard responds by changing the Election Rep Status to 6
(. . . ready to approve voter codes).

As the Smartcards is passed on from representative to representative,
the corresponding Election Rep Status code changes to 6. Once the
Smartcard detects that the status of the third Election Rep changes to
6, the Smartcard also sets SVI to 5 (Notarized information and codes
were approved by three representatives at precinct) and Voter Codes
(SPN) to a status of 3 (Notarized PIN/PVC approved by three
representatives at precinct).

The Smartcard is now initialized and ready for casting votes.

**Purpose:**

This command is provided as a checkpoint for notarized Smartcards, which
normally arrive at the precinct in the Election Package mailed by the
voter. The package contains enough information for the representatives
to confirm beyond a shadow of a doubt that the Smartcard is valid and
the voter and Notary are who they say they are.

Only after the representative is fully satisfied with his/her
assessment, will s/he execute this command and passes it on to the next
representative for him/her to do the same. After passing the scrutiny of
three representatives the Smartcard is initialized (PIN and PVC's become
permanent) and the voter can vote. In the case where the votes were
already cast at the Notary's office the votes are also accepted as final
and ready to be counted.

## VerifyVoterPIN:

Command 21: PIN

Response:

C21: E

Parameters:

PIN: Voter's Personal Identification Number

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

**Description:**

This command requires the voter to enter his/her Personal Identification
Number (PIN) as loaded with Command 12 or 18. If the Smartcard responds
with E=0, it means that the PIN was a match.

**Purpose:**

This command is convenient for the voter since it provides the assurance
that the Smartcard has accepted and recognizes the PIN s/he selected.
However, at the same time, it opens up the possibility for a potential
buyer to have control over the Smartcard (but not over the vote, because
the PVC cannot be verified ever). Even with those odds, the possibility
still exists that some may choose to buy Smartcards to cast random
votes.

In summary, even if this command is not implemented (a decision that
pertains to the BOE), who is to say that this code cannot be obtained in
some other malicious way? The Board of Elections should consider both
alternatives before deciding to implement this command or not.

## SetupNewElections:

Command 22: A, NG

Response:

C22: E

Parameters:

A: Access Code as loaded with Command 9

NG: Number indicating the representative's group

1 (Code Not Used)

2 BOE

3 Majority Party

4 Second Party

5 Third Party

6 Fourth Party

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

4 Invalid entry or out of range

**Description:**

This command requires each representative to enter their Access code and
to identify which group of representatives s/he belongs to. For the
first two representatives, the Smartcard sets the corresponding Election
Rep status to 7 and responds with E=0. The Smartcard keeps count of how
many representatives have executed this command, by counting how many
representatives have their Election Rep status on 7. Once the third
representative executes this command, the Smartcard deletes the ballot;
sets the SB status to 0 (Ballot empty); deletes all IDOK codes; and sets
the Election Reps status to 1.

**Purpose:**

This command is designed for reusing the same Smartcards in subsequent
elections. However a word of caution is at hand. Because current Access
codes are required for the execution of this command, we recommend that
a criteria be set by the BOE for deciding at the end of elections when
to proceed with the deletion of codes and ballots. This will allow a
clean handover from one election staff to the next.

This command is also useful for determining the Smartcard's
manufacturer, since Command 30 (Retrieve Smartcard Serial) can only be
executed when all the Election Reps status is 1.

## LoadBallotQuestion:

Command 23: A, Q#, QT, OP1, OP2, OP3, OP4, \[OPW\]

Response:

C23: \[E\]

Parameters:

A: Access Code of BOE Rep at the precinct level

Q#: Question number

QT: Question Text

OP1: First available choice for the current question

OP2: Second available choice for the current question

OP3: Third available choice for the current question

OP4: Fourth available choice for the current question

OPW: Fifth choice for the current question; it consists of a string of
space-characters used as place holder for the voter's written entry

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

4 Data is already loaded

6 IDOK codes active (greater than one)

**Description:**

This command requires the BOE Rep to enter his/her access code, the
question number, the question, and the available choices for the
question. If only two choices exist, the unused parameters should be
empty. In the case of parameter OPW, the length of the string determines
the number of characters available for the written name. No
spaces-characters in the OPW position indicate that a written entry does
not apply to the current question.

When the Smartcard receives the command, it checks the Access Code. If
it is a match, it checks that all Election Reps have a status of 1. If
so, it stores the parameters into memory; sets SB to a status of 1
(Ballot loaded but not cast); and increments QQ (number representing the
amount of questions in the ballot) by 1.

**Purpose:**

This command is the path through which questions are loaded into the
Smartcard. Since only one question can be entered with this command, the
PC software is responsible for creating the desired format as well as
the sequence of LoadBallotQuestion commands sent to the Smartcard.

**RetrieveBallotQuestion:**

Command 24: Q#

Response:

C24: E, QT, OP1, OP2, OP3, OP4

Parameters:

Q#: Question number

QT: Question Text

OP1: First available choice for question Q#, as entered with Command 23

OP2: Second available choice for question Q#, as entered with Command 23

OP3: Third available choice for question Q#, as entered with Command 23

OP4: Fourth available choice for question Q#, as entered with Command 23

Error Codes (E):

0 No errors & command complete

1 Message corrupted

5 Invalid entry or out of range

**Description:**

This command requires a single parameter, the question number (Q#). In
response, the Smartcard provides the text for the question and the
options available for that question.

**Purpose:**

This command provides a peek at the ballot by displaying a single
question and its available choices.

## WriteBallotUnlistedChoice:

Command 25: PIN, Q#, OPW

Response:

C25: E

Parameters:

PIN: Voter's Personal Identification Number

Q#: Question number

OPW: The name of the candidate typed-in by the voter

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

5 Invalid entry or out of range

**Description:**

This command requires the voter's PIN, the question number (Q#) and the
written choice (OPW). If the PIN matches the one stored in the
Smartcard, it returns E=0; the written choice overwrites the
space-characters set aside for this purpose (see Command 23); and the
internal register NW is incremented by 1.

Purpose:

This command allows the voter to select a candidate different from the
four available choices offered by the question.

The voter might want to use the OPW to store a name s/he does not intend
to vote for, thus serving as a decoy or as a proof after Election Day
that his/her vote was not tampered with.

The number of written choices (NW) is incremented whenever a question
receives an entry for OPW. This is used internally to simplify
programming routines.

## CastBallotQuestion:

Command 26: PIN, Q#, FSN

Response:

C26: E, \[VVN\]

Parameters:

PIN: Personal Identification Number

Q#: Question number

FSN: First number of the series that contain a PVC in one of the
available choices offered by the question

VVN: Voter Verification Number; randomly generated by the Smartcard for
use after Election Day

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

5 Invalid entry or out of range

**Description:**

This command requires the voter's PIN, the question number (Q#) that is
being voted on, and the first number of the series (FSN) that contains a
valid PVC.

If the PIN matches the one stored in the Smartcard, it stores the FSN.
The Smartcard knows that the FSN corresponds to position 1 (OP1) and
that each of the subsequent position (OP2, OP3, OP4, and OPW) are
referenced to FSN. For instance, if the stored FSN was 27, OP2=28,
OP3=29, OP4=30, and OPW=31. Immediately after that, the Smartcard sets
the Ballot Status (SB) to 2 (Ballot loaded and cast), and checks the
internal FQ flag. If FQ is 0, it will store Q# and FSN and only send an
E=0 to the PC.

If all FQs are 0, it will generate a VVN for that voter, store VVN (only
once per election), Q# and FSN; send E=0 and VVN to the PC; and change
FQ to 1.

The voter will not be able to change any of his/her choices for this
question after this point, but at least s/he can review his/her choices.
See Command 27.

Note: This description assumes that every CastBallotQuestion command
contains a PVC.

**Purpose:**

The PC uses this command to store the voter's choice into the Smartcard.
During the voting process the PC presents individual questions to the
voter and the available choices for that question in a human friendly
format. Upon confirming his/her final choice for each question, the PC
sends individual CastBallotQuestion commands to the Smartcard. When all
the questions have been voted for, the PC prints out the "I-Voted" card
containing the VVN and instructions for verification of his/her vote
after Election Day.

## VerifyCastBallotQuestion:

Command 27: PIN, Q#

Response:

C27: E, FSN, OPW

Parameters:

PIN: Personal Identification Number

Q#: Question number

FSN: First number of the series that contains a PVC under one of the
five possible choices offered by the question

OPW: Voter's written alternative as was loaded if any

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

5 Invalid entry or out of range

**Description:**

This command requires the voter's PIN and the question number (Q#)

If the PIN matches the one stored in the Smartcard, it responds with
E=0, the firs number of the series (FSN), and the OPW, if any. The PC
would then recreate the ballot with this information.

**Purpose:**

After casting the votes, this command is used to verify the votes,
question by question. The voter will not be able to change any of
his/her choices after this point, but at least s/he can verify his/her
choices.

## CountBallotQuestion:

Command 28: A, NG, Q#, N3

Response:

C28: E, OPS

Parameters:

A: Access Code loaded with Command 9

NG: Number indicating the representative's group

1 (Code Not Used)

2 BOE

3 Majority Party

4 Second Party

5 Third Party

6 Fourth Party

Q#: Question number

N3: Times the Ballot is being uploaded

OPS: Selected Option; 1-out-of-5 positions or 0 if no selection

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

5 Invalid entry or out of range

7 Protecting cast ballot or Rep Status invalid

**Description:**

The PC generates sequential CountBallotQuestion commands containing the
representative's Access code, his/her party, the question number (Q#
increments as each command is generated), and the number for the times
counted (N3).

The Smartcard goes through each of the following steps for each command
(one command per ballot question).

1)  Access-code and NG match internal data. If not, E=2, end

2)  Party Status is set to 3, go to next step

3)  Verify how many reps have Party Status set to 3. If less than 3,
    E=7, end

4)  Verify N3 is 1 greater than N1 (Times internal vote reported). If
    not, E=5, end

5)  Verify QF (Internal Question Flag) is 0. If not E=5, end

6)  Prepare Response Message and set QF to 1, go to next step

7)  Verify that QF for all questions is 1. If not E=0, end

8)  Reset QF to 0 for all questions, increment N1 by 1, and E=0, end

Step 1 validates the authenticity of a representative. Step 2 moves the
Smartcard forward towards releasing the locked in votes. Step 3 decides
if the votes have been authorized for release (3 representatives
required). Step 4 makes sure that the representative and the Smartcard
are in synch. Step 5 makes sure that the response message is not given
out a second time (counting twice). Step 6 prepares the response for the
PC to store and tally. Step 7 tracks whether or not the responses for
all the questions have been requested. If not, the response to the
question is sent to the PC. Step 8 confirms that all questions have been
requested and the Smartcard resets the QF of all questions to 0;
prepares for the next count by incrementing N1 by 1; and sends the
response of the final question to the PC.

Notice that the count is based on the OPS code and that the Personal
Voting Code (PVC) is not disclosed (actually it is never disclosed, thus
allowing for it to be used in subsequent elections). In cases where OPS
is 5 (voter's candidate was unlisted), the name entered by the voter is
NOT provided in the response. The PC will tally the Position 5 for a
final count and only if they become a winner will Command 34 be executed
to identify the winner.

It is also worth mentioning that anytime after the third representative
(the holder of the official count) each subsequent representative can
execute this command as described above and the same set of responses
would be provided. The only difference, and a desired one, would be that
each representative would use the following N3 value; i. e. if the
previous representative used 1, the next representative would use 2, and
so on. At the end of the evening, each representative would compare
their results with each other and all would have the same results. If
not they would all investigate what caused the discrepancy; on a case by
case basis.

**Purpose:**

This command works in conjunction with the PC software to produce the
tally of all of the ballot questions in a few short steps. First we need
to understand that 1) the official results will be provided, firstly, to
the BOE representative; 2) afterwards, each party representative will
obtain their results from the same set of Smartcards; 3) a counter (N1)
within the Smartcard is incremented after each representative uploads
all the questions from the Smartcard into his/her PC; 4) the PC software
queries each Smartcard with QQ (number representing the amount of
questions in the ballot) sequential questions and tabulates the
corresponding QQ responses for a final count; and 4) that the Smartcard
truly serves as a building block which holds each voter's vote securely
for as long as required for as many recounts as required by party or BOE
representatives (to answer any claims of impugned votes or miscounts).

## RetrieveEncryptedBallotQuestion:

Command 29: A, NG, Q#, N4

Response:

C29: E, VVN, ESN, EWO

Parameters:

A: Access Code loaded with Command 9

NG: Number indicating the representative's group

1 (Code Not Used)

2 BOE

3 Majority Party

4 Second Party

5 Third Party

6 Fourth Party

Q#: Question number

N4: Times the Encrypted Ballot is being uploaded

VVN: Voter Verification Number; randomly generated by the Smartcard when
the vote was cast

ESN: Encrypted first number of the series that shows the position of the
cast vote.

EWO: Encrypted voter's written option

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

5 Invalid entry or out of range

7 Protecting cast ballot or Rep Status invalid

**Description:**

The PC generates sequential RetrieveEncryptedBallotQuestion commands
containing the representative's Access code, his/her party, the question
number (Q# increments as each command is generated), and the number for
the times retrieved (N4).

The Smartcard goes through each of the following steps for each command
(one command per ballot question).

1)  Access-code and NG match internal data. If not, E=2, end

2)  Party Status is set to 4 (Mix OK), go to next step

3)  Verify how many reps have Party Status set to 4. If less than 3,
    E=7, end

4)  Verify N4 is 1 greater than N2 (Times encrypted internal vote
    reported). If not, E=5, end

5)  Verify EQF (Internal Encrypted Question Flag) is 0. If not E=5, end

6)  Prepare Response Message and set EQF to 1, go to next step

7)  Verify that EQF for all questions is 1. If not E=0, end

8)  Reset EQF to 0 for all questions, increment N2 by 1, and E=0, end

Step 1 validates the authenticity of a representative. Step 2 moves the
Smartcard forward towards releasing the encrypted votes. Step 3
determines if the Smartcards have been mixed thoroughly before
authorizing the release of encrypted votes (3 representatives required).
Step 4 makes sure that the representative and the Smartcard are in
synch. Step 5 makes sure that the response message is not given out a
second time. Step 6 prepares the response for the PC to store encrypted
voting data for publishing in the Internet. Step 7 tracks whether or not
the responses for all the questions have been requested. Step 8 confirms
that all questions have been requested and the Smartcard resets the QF
of all questions to 0; prepares for the next count by incrementing N2 by
1; and sends the encrypted response of the final question to the PC.

At anytime after the third representative (the BOE representative) each
subsequent representative can execute this command as described above
and the same set of responses would be provided. The only difference,
and a desired one, would be that each representative would use the
following N4 value; i. e. if the previous representative used 1, the
next representative would use 2, and so on. At the end of the evening,
each representative could compare samples of their results with each
other to verify that the encryption works. If there are discrepancies
they would all agree to investigate the cause(s); on a case by case
basis.

In the unlikely event that someone is trying to match the known voting
information from a Smartcard to the encrypted code, scrambling the
Smartcards prior to running this command will discourage those who may
have thought of it. This is the reason for Status 4 in Steps 2 and 3.

To confirm that their vote was counted and not altered, the voter must
first lookup their VVN on the Internet. If it is not on the Internet,
their vote was not counted. If it is found, it was counted and the voter
can proceed to check for alterations. For that, the voter needs to copy
the two codes (ESN and EWO) corresponding to their VVN. The voter would
then, enter his/her PIN, the VVN, ESN, and EWO into a Zeta PC, which
will in turn display his/her ballot exactly as when s/he cast his/her
vote.

Note: It is of utmost importance to publish VVN, ESN, and EWO on the
Internet after Election Day so voters can verify their votes. Even
though it falls within the jurisdiction of the BOE to perform this task,
each party can also publish it on their own website. Their constituents
may deem their party's website to be more "trustworthy", especially
because it was extracted independently.

**Purpose:**

This command allows the Election Reps to upload the encrypted votes from
each question on the ballot for publishing on their own website,
independently from the other party representatives. Once published, each
and every voter can, for the first time in history, confirm after
Election Day that their vote was counted and their choice was not
altered.

## RetrieveSmartcardSerial:

Command 30: A, NG

Response:

C30: E, HSN

Parameters:

A: Access Code previously loaded with Command 5

NG: Number indicating the representative's group

1 Supreme Court

2 BOE

3 Majority Party

4 Second Party

5 Third Party

6 Fourth Party

HSN: Smartcard's unique Serial Number

Error Codes (E):

0 No errors & command complete

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

**Description:**

The statuses of all Election Reps must be set to 1 in order for this
command to execute. This restriction is imposed to protect the voter's
information and cast ballot. There are two instances in the lifetime of
the Smartcard when all Election Rep have a status of 1: immediately
after loading the Smartcard software and immediately after the execution
of Command 22 (Setup New Elections). At any other time, this command
will not work.

This command requires the representative, at the state level, to enter
the Access code (loaded with Command 5) and to identify which group of
representatives s/he belongs to. If the Access code matches the one
stored by the Smartcard, it responds with the Serial Number of the
Smartcard.

Purpose:

This command is used to retrieve the serial number of the Smartcard,
which is unique and is provided by all legal device manufacturers.

The usefulness of the information disclosed at this stage of the process
may be limited. However, two applications come to mind: 1) to detect
clandestine Smartcards or 2) to create an inventory of all the
Smartcards purchased from a particular vendor prior to distributing them
to the counties.

## RetrieveNVC:

Command 31: A, NG

Response:

C31: E, NVC

Parameters:

A: Access Code loaded with Command 9

NG: Number indicating the representative's group

NVC: Notary Verification Code is a random number printed out on the
Notary Statement

Error Codes (E):

0 No errors & command completed

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

**Description:**

This command requires the precinct representative to enter the Access
code (loaded with Command 9) and to identify which group of
representatives s/he belongs to. The Smartcard responds by displaying
the Notary Verification Code (loaded with Command 19).

**Purpose:**

This command is used by the precinct representatives when verifying the
Notary Statement to confirm that the random number printed on it, is
identical to the one stored in the Smartcards memory. See Command 19.

This notary verification number was designed to prevent voting frauds
using a Notary. Let's suppose that Citizen K agreed to sell his/her vote
to Citizen X. Citizen K takes a clone which contains all his/her
personal information to a Notary's office. The Notary performs his/her
job unbeknownst of the fact that all the work was being done on a clone.
The Notary Statement is printed out, the Notary signs, seals, and
returns it to Citizen K. Citizen X goes through this process just to get
the NUC and the official Notary Statement. We assume that the clone was
tweaked by Citizen X to copy the NUC when the Notary entered it. Now
Citizen X can pretend to be the Notary and enters his/her own PIN and
PVC's and votes with the legitimate Smartcard. Without a randomly
generated NVC stored in memory, Citizen X might have succeeded. However,
the existence of this randomly generated number makes it almost
impossible for it to be identical to the one printed on the Notary's
Statement.

## DeleteCastBallot:

Command 32: PIN

Response:

C32: E

Parameters:

PIN: Voter's Personal Identification Code

Error Codes (E):

0 No errors & command completed

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

7 Protecting cast ballot or Rep Status invalid

**Description:**

This command requires the voter to enter his/her PIN. In return, the
Smartcard checks the status of the Protect Ballot (PB) register. If it
is 1, the Smartcard responds with E=7. If PB has a status of 0, it
deletes the responses to all questions entered so far; sets the ballot
status to 1; sets FQ to 0 in all questions; and restores the OPW of
every question to their initial condition. VVD is not affected by this
command.

**Purpose:**

This command allows the voter to restart voting from the beginning,
excluding the VVD.

## ProtectCastBallot:

Command 33: PIN

Response:

C33: E

Parameters:

PIN: Voter's Personal Identification Code

Error Codes (E):

0 No errors & command completed

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

**Description:**

This command requires the voter to enter his/her PIN. In return, the
Smartcard checks the status of the Protect Ballot (PB) register. If it
is 0, it changes it to 1. If it is 1, it takes no action and returns
E=0.

**Purpose:**

This command allows the voter to lock his cast ballot personally. No
other changes are admitted after this point. It is best to use this
command moments before mailing the Election Package or seconds before
dropping the Smartcard into the For-Tally Box.

## RetrieveVoterWrittenChoice:

Command 34: A, NG, Q#

Response:

C34: E, OPW

Parameters:

A: Access Code loaded with Command 9

NG: Number indicating the representative's group

1 (Code Not Used)

2 BOE

3 Majority Party

4 Second Party

5 Third Party

6 Fourth Party

Error Codes (E):

0 No errors & command completed

1 Message corrupted

2 Access code mismatch

3 Exceeds the number of permissible attempts

7 Protecting cast ballot or Rep Status invalid

**Description:**

Three representatives at the precinct level are required to run this
command before it is executed on the third count. Each representative
enters his/her Access code, the number representing the group s/he
belongs to, and the number for the same question they want to see the
written choice from. If the entries match, the Smartcard responds with
E=0 and the name of the candidate written into OPW of the current
question.

CAUTION: This command should ONLY be used when the 5^th^ choice wins the
elections, because it deletes the PVC code that was used and decrements
APC by 1. See Command 3. This command is required because the PVC that
was used to vote for OPW could be compromised. In cases where the OPW
was used but without PVC, it means OPW was used as a decoy.

**Purpose:**

This command allows the written choices to be viewed one by one, but
only in the presence of other representatives.

WARNING: In the next mailing, the State BOE must notify the voter that
the PVC s/he used to select OPW in the past election was deleted and can
no longer be reused. The voter must use a different PVC for subsequent
elections. If the value of APC is 0, the voter must be advised to reload
his/her PVC's prior voting in the next Election Day.

ACRONYMS, TERMS AND DEFINITIONS:

The purpose of this section is not to redefine commonly accepted terms
but to clarify the meaning with which it is used in this document and to
introduce new terminology as required by this document.

**BOE**: The city, county, or state Board of Elections or other
equivalent organization performing similar functions.

**EAC**: Election Assistance Commission

**ACTIVE REGISTERED VOTERS (ARV)**: The list generated by the BOE of the
locality containing all the active voters who are going to participate
in the upcoming elections. Each citizen in this list will receive a
Smartcard by mail.

**ELECTION REP**: BOE officials and duly identified party
representatives fairly representing the participating political parties
of the locality, there should be at least two. The function of this
representative is to oversee and participate in the activities related
to the election and in an assigned precinct. The number of officials and
party representatives may vary depending on the locality and their
internal regulations.

**ELECTION REP-SOFTWARE (ERS)**: BOE officials and duly identified party
representatives fairly representing the participating at least two
political parties of the locality. The functions of this representative
to oversee the activities related to the Smartcard software. The number
of officials and party representatives may vary depending on the
locality their internal regulations.

**ELECTORAL SOFTWARE**: The complete set of electoral software modules
and the software tools used to ensure their authenticity, security and
performance. It includes, but is not limited to the Precinct, Smartcard,
website, Voter and Comparator software modules.

**IDOK CODES**: A pair of codes: Access and Verification. These codes
are created, owned and entered by each Election Rep into the Smartcard.
They are used at a later time in the process to authenticate themselves
to the Smartcard and to authorize critical electoral functions. Once the
Access and Verification codes are loaded, at any time thereafter, the
same Election Rep enters his Access codes to execute commands or to
verify if the Smartcard pertains to his/her locality.

**LOCALITY**: The jurisdiction where the citizen is registered to vote,
be it the precinct, city, county, or the state in which the electoral
system is being implemented.

**NIST**: National Institute of Standards and Technology

**PERSONAL IDENTIFICATION NUMBER (PIN)**: An alphanumeric code, more
than 3 and less than 5 characters in length, selected by the voter and
entered by him/herself into the Smartcard. After the VID is entered into
the Smartcard each Election Rep must load these codes into the
Smartcard. . This code is locked inside and is one of the two factors
used to establish the one-to-one relationship between the voter and the
device. In order to cast a vote or to verify the vote, the entered PIN
must match the one stored in the Smartcard. In order to allow the voter
to verify, after Election Day, that his/her vote was counted correctly,
this PIN must be use to decrypt the voting data published on the web
site of the precinct.

**PERSONAL VOTING CODES (PVC)**: A one or two-digit code selected by the
voter and entered by him/herself into the Smartcard. These codes are
locked inside and are the other factor used to establish the one-to-one
relationship between the voter and the device. These codes serve as
pointers to select options when casting votes. However, they are only
known by the voter because they are usually displayed/transferred
together with other numbers, thus clouding the choice in uncertainty to
any watching bystanders.

**PRECINCT SOFTWARE**: The electoral software programs running on
computers that are under the direct responsibility of the Election Reps.

**SMARTCARD**: An electronic storage device specifically designed to
interface with Precinct and Voter computers. The device is
recommended/certified/authorized by the EAC/TGDC/NIST and political
parties for safekeeping of voter information and to guarantee the
integrity of the whole election process.

**SMARTCARD SOFTWARE**: The electoral software programs running on the
Smartcard that is mailed to/from registered voters.

**SOFTWARE AV CODES**: A pair of codes: Access and Verification. These
codes are created, owned and entered by State level Election Reps into
the Smartcard to confirm at any time that the software inside the
Smartcard has not been replaced nor modified since it was originally
stored. After the software is loaded into the Smartcard each State level
Election Rep must load these codes into the Smartcard. Any time
hereafter, the Election Rep enters a command using the Access Code, and
the Smartcard will respond with the corresponding Verification code.
Seen from a different perspective, this same action also proves that the
Smartcard is authentic, meaning one that was initialized and witnessed
by that representative.

**SOFTWARE COMPARATOR MODULE**: The software program that serves as a
tool for comparing any questionable Electoral Software module with an
authenticated and certified copy, which has been all the time under the
custody of the Election Reps. This tool is the only way to assure
Election Reps that a CD copy of the electoral software module is
official or not.

**TGDC**: Technical Guidelines Development Committee

**VOTER IDENTIFICATION DATA (VID)**: The set of personal information
released by a citizen to establish identity and other required
information for the purpose of voting. Typically, this information
includes, but is not limited to, name, sex, date of birth, address,
phone number, SS#, voter #, digital photograph, signature, and
fingerprints.

**VOTING VERIFICATION NUMBER (VVN)**: A randomly generated number is
printed out by the computer immediately upon casting a vote. This
printout, if voting at the precinct, is picked-up by the voter from the
printer at the voting desk. If the ballot was mailed, the voter's or the
Notary's PC would have printed it out. The voter must save this number
in a secure place for later use. After the election, the BOE will
publish this number on the party's website together with instructions on
how to verify your vote. The voter will then follow the corresponding
instructions to verify if his/her vote was counted as intended.

[^1]: There is a variety of ways to implement this operation. We
    recommend that it be determined by the BOE. In this operation we
    assume there is no mouse and that there are only three key
    functions: Move-Left, Move-Right, and Enter.

[^2]: There is a variety of ways to implement this operation. We
    recommend that it be determined by the BOE. In this operation we
    assume there is no mouse and that there are only three key
    functions: Move-Left, Move-Right, and Enter.

[^3]: There is a variety of ways to implement this operation. We
    recommend that it be determined by the BOE. In this particular
    operation we assume that only four key functions are used:
    Move-Left, Move-Right, Confirm, and Enter. **Voice recognition
    software** should also be considered as an optional enhancement for
    voting by phone.