a |] |

Management Info Systems

Electronics, Metal and Plastic

Memorandum:
To: Election Assistance Commission (EAC)
From: Jacques Hulshof < Jacques.hulshof@nedap.com>
Member IEEE and member of the IEEE P1583 Standards group.
Date: January 7", 2005
Subject: Single solution character of the IEEE P1583 Draft 5.3.2 Voting System
Standards

The draft Voting System Standard you received from the P1583 working group is the
product of many years of effort. The draft has been preceded by the voluntary 1990
voting system standards and the 2002 voting system standards both published by the
Federal Election Committee. Nedap as the largest and most experienced European
voting system manufacturer (since 1967) contributed to these standards by giving
comments and sending translations of European standards to the FEC. We joined the
IEEE P1583 working group in May 2002 and are pleased to have been allowed to share
our knowledge and experience on DRE voting systems with the group of fine engineers
and scientists, that strives to develop the high quality standards necessary to give the
voters trust and confidence in the election results. Nedap introduced its first generation
DRE’s in 1978 and the present generation DRE’s rooted in 1991. The design is based
on propriety hard - and firm ware, and is transparent and can be verified and tested by
ITA’s. The system does not use COTS operating equipment or does not apply COTS
application software, of which is known that most COTS software cannot be verified or
tested line by line because of there complexity or commercial restraints.

Normally generic standards should describe functionality only, but in this case there
should be a distinction between the different types of DRE’s. Unfortunately we didn’t
succeed in convincing the FEC 2002 development group and the IEEE P1583 WG that
DRE’s with proprietary hardware and proprietary software are regarded as a separate
group of DRE’s.

Both FEC 2002 and IEEE P1583 Draft 5.3.2 are written with PC or PDA like systems
operated by COTS operating systems in mind, with or without touch screens. By some
advocacies these system designs initiated the call for a Voter Verifiable Audit trail. This
is a step back into the troubles associated with paper voting. Additionally the voting
process is made more complex for voters and election staff.

The firm - and hardware development costs for propriety based systems are relatively
high. PC based systems are avoiding development risks and are saving money since
they use a COTS pc-board as basis (for a cost effective) DRE. However this disregards
the extra measures you have to take to get the same security of your end product.

Also an important aspect is the lifecycle of a COTS product compared to industrial
electronics where legal requirements ask for 15 years+ as a minimum.

“Nedap” F (01544 4)

www.nedap.com


a | |

Security Systems
Management Info Systems
Election Systems

Electronics, Metal and Plastic

We recommend the EAC to specify a clear definition on groups of voting system
designs, making distinction between DRE’s using non verifiable COTS for the critical
functions of recording and storing cast vote records (CRV) and systems using verifiable
transparent designs.

A suggestion for the nomenclature of the groups could be:

Partly Verifiable DRE (PVDRE) and Full Verifiable DRE (FVDRE).

The verification of a FVDRE can be done by an ITA. An ITA can conduct a line by line
software check in addition to hardware reliability, - usability, - durability etc tests.

Test methods and conclusions can be made public available in the form of reports. In
Europe and in our more than 37 years of experience it has guaranteed voter trust and
confidence. This has been and still is the proven and accepted method of testing and
certifying DRE systems.

The general public is accustomed to institutions like the FDA, FAA (Federal Aviation
Administration) etc. watching over their interests. They trust these institutions and for
their money, health and even their lives the public rely on the expertise and integrity of
these institutions.

In addition rules for DRE’s could include parallel testing on election day, where at
random selected DRE’s, intended to be applied for actual election, preset votes are cast
on the machines under supervision of all parties involved while video taping the action
and comparing the final results with preset results. Extensive tests on various systems in
California and our system in Ireland conducted by MIT, using this method have proven
that the system operates flawless.

Conclusion:

The Voting System Standards should distinguish between voting machines or voting
systems using non verifiable COTS for the critical functions of recording and storing cast
vote records (CRV) and systems using verifiable transparent designs both in hardware
and in software.

The standards could only give functional specifications with an appendix for every
identified existing solution giving specific requirements and test rules for that solution. A
Voting System Standard structured in such a way gives the users maximum insight and
antee that the systems perform their tasks in a perfect and desired way and will not

'V. Nederlandsche Apparatenfabriek "Nedap"

31 (0) 544 471 162 (Phone); + 31 (0) 544 463 475 (Fax)

+ 31 (0) 6 53718821 (Mobile); jacques. hulshof@nedap.com
P.O. Box 6, NL-7140 AA Groenlo, The Netherlands

www.nedap.com

Apparatenfabr

NL-7141 DC Groenic nde: ter 801383)

BN-AMRO 59.16.32.330 BA JABNADS1632330 IC ABNANL2A W NL 006456285801