U. S. ELECTION ASSISTANCE COMMISSION 

 OFFICE OF THE EXECUTIVE DIRECTOR

 1225 New York Avenue, NW, Suite 1100 

 Washington, DC. 20005 

 

November 14, 2008 

Mr. Randolph C. Hite, Director 

Information Technology Architecture and Systems 

United States Government Accountability Office 

Dear Mr. Hite: 

 

This letter is intended to serve as the required written response to the Government Accountability 

Office’s (GAO) Report 08-814, Federal Program for Certifying Voting Systems Needs to be 

Further Defined, Fully Implemented, and Expanded. 

As required by 31 U.S.C. 720 I am submitting the attached document, on behalf of the 

Commission, as a written statement of the actions taken on GAO’s recommendations. The EAC 

appreciates GAO’s recommendations and takes very seriously its HAVA mandated 

responsibility for the certification testing of voting systems under the EAC’s Voting System 

Testing and Certification Program. 

If you should have any questions about the steps the EAC is taking to implement GAO’s 

recommendations or any aspect of the EAC’s Testing and Certification Program, please do not 

hesitate to contact me at any time. We appreciate the chance to respond and look forward to 

talking further about the work of the EAC’s Testing and Certification Program. Thank you. 

Sincerely, 

Thomas R. Wilkey 

 Executive Director 
EAC Response to Findings Reported in GAO-08-814

Federal Program for Certifying Voting Systems Needs to be Further 

Defined, Fully Implemented, and Expanded 

Pursuant to 31 U.S.C. §720, the purpose of this response is to provide an update on U.S. 

Election Assistance Commission (EAC) efforts to implement Government Accountability 

Office (GAO) recommendations in its report regarding federal certification of voting 

systems (GAO-08-814). 

As the GAO report notes, “EAC has defined an approach to testing and certifying voting 

systems that follows statutory requirements reflected in HAVA and a range of relevant 

practices associated with a product certification program, including those published by 

U.S. and international standards organizations.” (GAO-08-814, pg 2 – 3). In addition, 

the EAC has generally “provided clear procedures, in the form of its recently published 

Voting System Test Laboratory Manual (Manual), that outline the certification process 

and its requirements for participating manufacturers.” (GAO 08-814, pg 19). However, 

GAO’s report also noted that EAC’s Certification Program would be improved by the 

development of internal procedures to better implement and document EAC actions. 

In order to assist the EAC in building upon and evolving its voting systems testing and 

certification program, GAO offered specific recommendations in three areas. The 

recommendations instructed the EAC to prepare, approve and implement plans to: 

1. Develop detailed procedures, review criteria, and documentation requirements to 

ensure that voting system testing and certification review activities are conducted 

thoroughly, consistently, and verifiably; 

2. Develop and implement an accessible and available software repository for testing 

laboratories to deposit certified versions of voting system software, as well as 

procedures and review criteria for evaluating related manufacturer-provided tools to 

support stakeholders in comparing their systems with this repository; 

3. Develop detailed procedures, review criteria, and documentation requirements to 

ensure that problems with certified voting systems are effectively tracked and 

resolved, and that the lessons learned are effectively used to improve the certification 

program. 

The EAC has already begun efforts to address each of these areas. 

Develop detailed procedures, review criteria, and documentation requirements to 

ensure that voting system testing and certification review activities are conducted 

thoroughly, consistently, and verifiably. 

The EAC has initiated the development of standard operating procedures (SOPs) for each 

of the major tasks outlined in the Testing and Certification Program Manual (Program 
Manual). The primary purpose of these SOPs is to provide the EAC the framework and 

specific procedures to follow in administering the Voting System Testing and 

Certification Program. The development of these procedures will allow the EAC to better 

1) define procedures and establish criteria for performing evaluation activities, 2) 

document evaluation steps and related decisions, and 3) develop benchmarks and a 

quality assurance plan for measuring program performance. These procedures will help 

ensure compliance with the policies and procedures set out in EAC’s Program Manual. 

Separate SOP chapters will be dedicated to EAC review of manufacturer registrations; 

voting system testing applications; and voting system testing. In addition, other chapters 

will deal with the internal procedures for the grant or denial of system certifications; 

decertification; quality monitoring; and requests for interpretation of voting system 

standards. As of this date, two SOP chapters have been drafted. EAC expects adoption of 

all SOPs in final from by the end of May 2009. 

In addition, to further improve EAC’s review of applicant voting systems, the 

Certification Division has budgeted $120,000 in FY 2009 for the development of a 

technical reviewer training handbook, and to provide additional training to reviewers. 

The handbook will formally document the processes, standards, responsibilities, timelines 

and best practices relating to the technical reviewer’s role and responsibilities under the 

EAC Voting System Testing and Certification Program. The EAC will also create a 

training handbook to formalize its process for training technical reviewers. The EAC 

intends to have the handbooks implemented by the end of calendar year 2009. 

Develop and implement an accessible and available software repository for testing 

laboratories to deposit certified versions of voting system software, as well as 

procedures and review criteria for evaluating related manufacturer-provided tools 

to support stakeholders in comparing their systems with this repository. 

On October 16, 2008, the EAC notified voting system manufacturers that the EAC 

Testing and Certification Division would temporarily act as the official repository 

required in Sections 5.6.2.4 and 5.7 of the EAC’s Testing and Certification Program 

Manual. To meet its responsibilities during this time, the Division has procured secure 

storage and will implement interim internal procedures to ensure the information held 

will be properly and safely maintained. The October letter also noted that the EAC 

would be contracting with an outside party to provide permanent repository services. The 

contract agreement between the EAC and the repository will explicitly outline the 

services to be provided. Such services will include procedures for maintaining the 

integrity of the deposited material, procedures for controlling access to the deposited 

materials, and chain of custody controls. The EAC anticipates transferring repository 

responsibilities by the end of the 2009 calendar year. 

The GAO report also recommended that EAC make the repository accessible to state and 

local election officials, so that they may compare the software received from a 

manufacturer with that held by the EAC. While EAC’s Program Manual neither requires 

nor prohibits such access, it provides state election officials an alternative means to check 

2
the validity of purchased software through the use of system identifications tools. In fact, 

the Manual requires manufacturers to create such tools, which enable election officials to 

ensure that fielded software is unmodified from that Certified by the EAC. This is 

usually accomplished by providing a self booting disk or device that verifies file 

signatures in a system’s software. 

Notwithstanding the Manual’s system identification requirement, the EAC intends to 

make its repository accessible to state officials per GAO recommendation. The Testing 

and Certification Division will meet with stakeholders to determine how and if changes 

should be made to the existing framework. The agency will consider the needs, 

capabilities and resources of the states in making its determination. Additionally, the 

agency will need to consider a number of practical barriers, from controlling access and 

facilitating various state processes to statutory prohibitions. For example, federal law 

(Trade Secrets Act) prohibits the release of certain commercial information. Because the 

information to be stored in EAC’s repository will likely be protected by this statute, 

releasing it without permission would be a crime. 

Finally, GAO has recommended that the EAC create procedures and criteria for the 

review of System Identification Tools. As noted above, the EAC will provide internal 

procedures for this program requirement in its SOPs. EAC plans on implementing these 

requirements in May of 2009. 

Develop detailed procedures, review criteria, and documentation requirements to 

ensure that problems with certified voting systems are effectively tracked and 

resolved, and that the lessons learned are effectively used to improve the 

certification program. 

This recommendation provides guidance in two parts. It advises the EAC to create 

internal procedures regarding how the agency will (1) deal with problems found in 

certified voting systems and (2) use lessons learned in dealing with such problems to 

improve the Certification Program. As noted in the response to the first recommendation 

above, the EAC is in the process of drafting SOPs to document the agency’s internal 

procedures for administering the requirements of our Program Manual. These SOP will 

include detailed procedures, criteria, and documentation requirements regarding the 

above. 

 

With respect to EAC’s efforts to track and resolve problems in systems it has certified, 

there are a number of program elements in our Program Manual which touch on these 

issues, including EAC’s informal inquiry and formal investigation processes in Chapter 7 

of the Program Manual. These investigations and their resolution are the primary tools 

EAC uses to determine system noncompliance and require the appropriate remedy. 

Additional program elements that deal with voting system problems may be found in the 

Quality Monitoring Program found in Chapter 8 of the Program Manual. These elements 

include manufacturing site reviews, fielded system review and testing, and field anomaly 

reporting. These programs provide additional means for the EAC to identify problems so 

that it may initiate an investigation and resolve problems. 

3
4

The SOPs in all the areas identified above will formalize the internal procedures, review 

criteria and documentation requirements necessary to effectively resolve problems 

consistent with the Program Manual. In addition, the EAC will coordinate the various 

procedures noted above to ensure that the all program elements work together to 

comprehensively meet agency goals. As noted above, the SOPs are expected to be 

adopted by the end of May, 2009. 

Regarding the development of internal procedures for the utilization of lessons learned, 

the EAC has, from the very beginning, been committed to creating a program which 

identifies problems and solutions, and shares this information with interested parties. The 

EAC believes that the information it collects and the lessons it learns should not only be 

used to improve its certification program, but shared with other organizations to improve 

voting system design and election administration nationwide. The EAC recognizes the 

importance of documenting anomalies so that design engineers, election officials and 

other stakeholders may take advantage of lessons learned. 

This concept is reflected in EAC’s Program Manual, which notes that information it 

gathers pursuant to its Quality Monitoring Program will be used to “[i]dentify areas of 

improvement in the EAC Testing and Certification Program,” “[i]mprove manufacturing 

quality,” “[i]nform manufacturers, election officials, and the EAC of issues associated 

with voting systems,” “[s]hare information among jurisdictions that use similar voting 

systems,” “[p]rovide feedback to the EAC and the Technical Guidelines Development 

Committee (TGDC) regarding issues that may need to be addressed through a revision to 

the Voluntary Voting System Guidelines,” and “[i]nitiate an investigation when 

information suggests that Decertification is warranted.” (Certification Manual Section 

8.8). The EAC will create SOPs documenting procedures that are necessary to achieve 

these requirements. As noted above, these SOPs are expected to be implemented by May 

2009. In developing these procedures, the Program Director is considering new 

initiatives, including building stronger partnerships with election officials through groups 

like the National Association of State Election Directors (NASED), the National 

Association of Secretaries of State (NASS) and the International Association of Clerks, 

Recorders, Election Officials and Treasurers (IACREOT) and The Election Center. In 

addition, the Program Director will create an anomaly database and is considering the 

publication of a “Lessons Learned” bulletin which would be available to all interested 

stakeholders. 

The EAC is committed to developing a world class testing and certification program. The 

only way this can be achieved is through continuous improvement. In implementing the 

changes discussed in this response, the EAC continues towards its goal. The EAC 

appreciates the work of GAO and looks forward to its ongoing collaboration with its 

stakeholders in the area of voting system certification.