MR. KING: Thank you, Chairman Schutzer, Commissioner Martinez, and
members of the TGDC Committee. I appreciate the opportunity to present
testimony here today.

My name is Merle King. I\'m Chair of the Department of Computer Science
and Information Systems at Kennesaw State University, but I\'m also the
Executive Director of the Georgia Center for Election Systems, and by
virtue of those two appointments, I am both academician and
practitioner.

Today, in fact, one of the reasons that Brit Williams is not here is
that we are certifying a new system in Georgia and we\'re conducting
county elections today. So, we have a full plate.

In addition, my department houses the Center for Information Security
Education. We\'re an NSA Center of Academic Excellence. So, we deal a
lot with security issues related to voting system.

My remarks today are in the context of Georgia law, Georgia election
code, and Georgia practices. I will leave it to the Committee and other
members of the audience to generalize my comments as it applies to
national issues.

Before I address the questions that were asked in the solicitation which
deal with core requirements, I wanted to share some observations as a
person who works in elections, but also a person responsible at the
state level for development of certification standards.

There are many laws that govern the development of systems, and those
are things like Moore\'s Law, which talk about the shelf life of
systems, Ashby\'s Law of Requisite Variety, but the most important law,
I think, for this Committee and for NIST to consider is the law of
unintended consequences. I see that everyday overrunning election
issues, that proposals are made, changes are made without full view of
the future implications.

I heard Allan\'s comments this morning about the obscurity of NIST.
There may well be a day that NIST craves that obscurity again. I think
one thing that characterizes the behavior of people in the election
community is given the choice of notoriety or obscurity, we will all
choose obscurity; for our jobs to not be the center of attention.

I also encourage technologists who review voting systems to avoid
analogous thinking. Elections are not like ATM\'s. Elections are not
like retail systems. Elections are like elections. If you find yourself
tempted to use analogies to describe elections, you may want to rethink
that approach.

Having said that, I also note the parable of the seven blind men and the
elephant is very appropriate in computing. What we find is that people
who have stumbled onto one aspect of elections have declared that the
entire body of elections conforms to that perception.

Another aspect of election officials is that we are incrementalists in
that revolutionary change is rarely preferred over evolutionary change.
Election officials are pragmatists. A great deal of the work done by
election officials is in exception handling and the pursuit of better
systems is preferred to the pursuit of perfect systems in our world.

Also, there is no downtime for elections. Changes that are made to
systems, changes that are made to the mechanics of testing systems must
be done concurrent with the administration of systems. People outside
the election community do not realize that there is no downtime with
elections. If we were not preparing for elections, we\'re conducting
them. If we\'re not conducting them, we are recounting them. If we are
not recounting them, we\'re defending the procedures.

I think another important aspect that seems to be poorly understood from
outsiders is the business models that prevail with the vendors in this
industry. I, myself, had a learning curve. The vendors that populate
this industry are unlike other vendors that I have dealt with in
information technology fields. The final thing that I would encourage
members of NIST and of this Committee to do is to listen carefully to
the softest voices. The election community is not used to speaking with
a strident voice. They speak quietly and they speak confidentially. I
find that the loudest voices are often the least informed.

The question that was posed to me in the solicitation is what are the
core functional requirements of an overall voting system. Ultimately, in
Georgia that\'s determined as a system that can implement the myriad of
federal, state, and local laws, rules and regulations that apply to that
jurisdiction. In other words, in Georgia that means the system is
capable of implementing the requirements of Georgia\'s election code.

I think that it\'s important, that particularly the scientists that are
becoming involved, appreciate the autonomy of jurisdictions in
determining what constitutes election system requirements. In Georgia,
we articulated the requirements of our system in a 65-page document that
was an RFP issued in 2002. That document is available to the Committee.
Perhaps one approach the Committee might take is to find the
intersection of recent RFP\'s. If you take a number of RFP\'s from
representative jurisdictions, the intersection of those requirements
might constitute a valid starting point for determining overall
requirements.

I won\'t go into great detail, but the requirements that we list are
things like FEC VSS compliance, State of Georgia certifications,
something that Brit is involved with today. There are accuracy
requirements that must accommodate write-ins, permit recounts, produce
precinct-, county- and state-level detailed reports, print a record of
each ballot cast, tamper-evident controls, on and on. I think those
things are best transmitted to the Committee by a separate document.

However, since our initial deployment, we have collected a growing list
of requirements that we will look for. I think these may be valuable to
consider as emerging requirements in subsequent systems.

We have used the analogy in Georgia that we were once a flotilla of
different voting systems, very nimble, with a lot of variety. We are now
an aircraft carrier, it and takes us two miles to stop and five miles to
turn when we make changes to our system. Because of that, the forward
compatibility of existing systems is something that I think is an
emerging concern and emerging requirement.

The state invests tens of millions of dollars in voting equipment. How
will we transition legacy technology into future requirements? Requiring
a disclosure of the full manufacturing supply chain, understanding what
will be the availability of spare parts into the future of equipment.
The integration of voter registration systems is an important
requirement that was not in our initial RFP but should be considered.

Expanded flexibility and report generation is something that we will
come back and review. Power consumption and status indicators for
systems, improved methods for securing deployed units. When units are
used in large jurisdictions, units have to be left the night before the
election often in unsecured areas. We need better methods for securing
those.

The criteria for choosing the system is often different than the
criteria for sustaining the system. We want to re-explore requirements
in that area in the future.

The testing of voting systems is also a requirement, and I know that\'s
being addressed by another committee in another meeting, but it\'s an
important consideration. In the 2002 roll-out in the State of Georgia,
we failed over 1,000 pieces of equipment in our testing. That\'s fairly
rigorous testing. It provided a baseline of data for us to predict
maintenance issues for that system.

Another issue that is raised in the requirements is the training of
people. In Georgia, we have a law that requires election officials to
complete 64 hours of training in law, ethics, procedures, knowledge of
GRE\'s. This has, again, some unintended consequences. One is, because
we do the training, it enables to us identify potential problems
throughout the state as observed that particular unit\'s absorption.

MR. HARDING: Excuse me. What is GRE? Is it a vernacular for voting
booth?

MR. KING: I\'m sorry. DRE, I meant to say. Excuse me.

MR. HARDING: Oh, DRE.

MR. KING: The third question in the solicitation was can compensatory
controls and procedures and processes, overcome deficiencies in hardware
and software design. I believe that is true. Compensatory controls can
address some deficiencies. It can be argued that the defense of the
voting system is best accomplished by overlapping a series of controls
that are protective, detective and corrective.

Protective controls are those that prevent system anomalies. They are
generally expensive to design and create, and they are difficult to
implement. When they are done well, the designers of the protective
controls should not be responsible for the implementation.

Examples of protective controls would be hardened storage facilities for
DRE\'s and training. The challenge to designing protection and
preventative controls is that you must have future knowledge of the
operating environment of the system, and that can be a challenge.

Detective controls are those that detect anomalies and direct the system
to related corrective controls. These are less expensive. In Georgia,
our approach has been primarily to focus on detective controls.

We think of voting systems as being tamper evident rather than tamper
proof. Once we have detected an anomaly, the corrective control is
implemented by the appropriate election official or action by the state
board. Examples would be the structured process of proofreading ballots
that detects misspelling or typographical errors.

The last question in the solicitation was should the overall system
requirements differ from the technology. I believe there are certain
core system requirements that are universal to all systems. However, the
complexity and the lack of transparency of DRE\'s requires additional
considerations. This is especially true in the area of training and
testing.

Most of the people here are familiar with the Georgia model. I will be
happy to answer any questions regarding our implementation of a uniform
state voting system. Thank you.

????Just two questions. One is, just out of curiosity, were there some
types of failures that are more common than others?

MR. KING: I think the most common errors that we have are calibration
errors. Our position in testing, as I think it should be, was we made no
corrections to the systems, that our job was simply to test each
individual unit. In the Georgia model, every piece of equipment is
tested in-place in the field. In a large state like Georgia, that is a
logistic challenge.

We made no attempt to fix calibration. We made no attempt to fix
inaccurate date settings, time settings. We simply failed the unit, and
we felt it would inappropriate for testers to implement the corrective
controls. So, I would say the calibration, date and time settings were
the most common failures. Behind that, a smaller group is failure to
boot in the system. We also looked at even some safety issues, if there
were cracks in the cases that could snag a person\'s clothes or cut an
individual, if there were crimps in the legs of the units. There is a
very broad range of criteria.

MR. CRAFT: I\'d like to do a follow-up question to that. This is Paul
Craft, State of Florida. I\'m assuming, then, that your RFP and contract
requires the vendor to deliver the units, set it up and calibrate it in
advance. I guess my confusion, I think of calibration and date settings
is basically a routine function. Every time you go into an election
site, you test the equipment.

MR. KING: In Georgia, we monitored performance at the distribution
center, and we would do spot checks and random checks on the quality of
the vendor\'s set-up of the system, and make recommendations back to the
secretary of state for improvements in this process. Then we also test
it in the field.

An important aspect of calibration, as I\'m sure you know, is the plane
in which the voting unit is set during an operation. If the unit is flat
versus in a slanted position, the calibration can be done improperly.

MR. SCHUTZER: One last question. You mentioned that each state has their
own set of requirements and so forth. Could you give some examples just
of what might be a unique state requirement?

MR. KING: Full-faced ballot in New York, and in Pennsylvania,
deselecting are classic examples.

MR. SCHUTZER: Any other questions? People on the phone?

MR. HARDING: One last one, Mr. Chairman?

MR. SCHUTZER: Sure.

MR. HARDING: This is J. R. Harding. Would there be one item that the
State of Georgia would really like to see to include persons with
disabilities for the highest level of participation?

MR. KING: I\'m sorry. I\'m not sure I understand your question.

MR. HARDING: I guess not being a voting expert here, coming just as a
lay person, what kind of a requirement would Georgia see that would
facilitate persons with disabilities voting at the highest level
possible besides actually getting there? Other than, say, absentee
ballots, actually participating on election day like everybody else.

MR. KING: I would concur with Mr. Craft. I think the thing that I\'m
concerned about, and perhaps I can only speak for myself, is the
preservation of the secrecy and the independence of the ballot that
DRE\'s provide. A concern that we have with the discussion that has
occurred about the various forms of paper that have been proposed to run
concurrent with the DRE\'s, is whether it will ensure voters that same
level of independence and secrecy of ballots that we can now provide
with the system in Georgia.

MR. HARDING: Thank you.