2011 Initiatives 2011 Initiatives

Technical Guidelines Developmen

Committee

NIST

-EAC

July 26th 2011
What is the Key 

Election System Iss

 Military Voter Registration 

Not the Problem Not the Problem 2008 Elect

 71% = General Electorate 77% = Military voters

 Voter Participation Rates not 

2008 Elect

Stage of voting 

Number of addit

failures over gen

i l 

the problem 

 64% = General Electorate 53% = Military voters 71% = Adjusted military voters

process voting populat

Registration Failure 4,057 

j y

 Overwhelming voting failure 

is in ballot delivery and return times

Ballot Delivery Failure 20,068 Ballot Return 

 Absentee Ballot Return Failure 206 771 

Rates:

 91% = General Population 67% = UOCAVA voters

Failure 206,771 Ballot Casting Failure 35,645 

67% UOCAVA voters

 62% = Military Voters Total 266,540
FVAP Key Initiativ

• Direct to the Voter Assistance

• Eliminate much of the need for Voting Assistance Officers• Make the process easy, quick, intuitive and seamless• Communicate in effective terms and modes

• Expanded Assistance for Election Officials:

- Provide voters tools that States will use- Assist in compliance Assist in compliance

• Transparency and Data-Driven Operations: 

• Improve Post Improve Post-Election Surveys to correct incorrect policies b

Election Surveys to correct incorrect policies b

poor data

• Post all data and methodology online• Combine data collection with EAC
Leverage Technol

• Focus

• Improve ballot delivery and return times

– 30 milliseconds to voter; not 30 days– 45 days prior (MOVE Act)– <7 days back from voter <7 days back from voter

• Reduce voter error; easy voter use• Tailor to State requirements• All available through FVAP gov All available through FVAP.gov

• Tools

• Online FPCA } All use hard‐copy print‐out • Online FPCA • Online FWAB• Online delivery and marking of full, precinct-level ballots• Electronic Absentee Voting Demonstration & Pilot Progra

} All use hard copy print out wet signature, postal return

Electronic Absentee Voting Demonstration & Pilot Progra
Online Tools

Back

‐U

Wizard

Full BallotWizard

RegistrationWizard

• All Sta• 20,53

(2010)

• 17 States participated• 3,097 ballots downloaded

• Online delivery of blank 

b ll t

• All States• 92,565 Downloaded 

(2010)

• Online 

races 

− B

D

b

allot

• ALL races and candidates

– Federal, State and local 

elections

B it

• Online registration and 

absentee ballot request

• Only have to know 

addresses and personal 

information

−

A

wloS

P id 

–

By precinct

• Online marking option• Provides complete 

instructions, pre-addressed 

envelopes

information

• Automatically 

completes all forms

• Provides complete 

instructions, pre- • Provid

instrucaddres

• Print o

mail

envelopes

• Print out, sign, send in by 

mail

instructions, preaddressed envelopes

• Print out, sign, send in 

by mail

mail
Demonstration a

Pilot Projects

• DoD required by law to conduct electronic absentee votin

d t ti emonstration proj t ec

– 42 USC 1073ff note; 2002 and 2005 NDAAs

– Mandates

• Cast Ballots Ballots through through electronic electronic voting system• Only Uniformed services voters specified• States must agree to participate• Report afterwards• St ti ti ll Statistically si ifi t ignificant number of parti i t c pan s

• DoD allowed to wait for EAC certified guidelines

– EAC establishes guidelines guidelines

• EAC also certifies it will assist in project

• Different requirement than MOVE Act

– DoD may further delay implementation
2011 Efforts

• Wounded Warrior Research Wounded Warrior Research

– Disability Analysis– Voting y Assistance Analysis– Operation Vote

• VSTL Testing• Penetration Testing• Grants• Cyber Security Analysis Group• UOCAVA Solutions Summit
Wounded Warrio

Research Initiativ

Purpose: To analyze voting assistance requirements for wound

i j d ilit t injured military voters

• Individual Interviews

– Wounded Warrior – Voting Assistance Officers

– Coordinated with EAC and Heroes Grant recipient

• 1st phase complete: phase complete:

– Over 100 interviews – Assess current level of accessibility and engagement wit

Assistance Program

• 2nd phase in-process: 

– Execution of Operation VOTE – Validate research findings 

– ob bilit h ll ith i ti f t l 

bserve usability challenges with existing fvap.gov tools 

implementation
VSTL Testing

Purpose: Establish System Security Baseline• Evaluate the quality of testing across VSTLs Evaluate the quality of testing across VSTLs• Evaluate the sufficiency of the EAC 2010UOCAVA Pilot Prog

Testing Requirements

• Identify common gaps across vendors• Establish a baseline on how well vendors are complyingExecution:• FVAP F nded Testing at W le Laboratories Inc and SLI Glo

FVAP Funded Testing at Wyle Laboratories, Inc. and SLI Glo

Solutions

EVSW Systems EVSW Systems Voting Systems

– Credence– Democracy Live– Everyone Counts

Voting Systems– Dominion Voting– ES&S– Scytl

– Konnech

• Results will not be vendor-specific
Penetration Test

Establish System Security Baseline (cont’d)• Active Penetration Testing

– Conducted during “mock” election with votes being cast online

• Dominion Voting• Everyone Counts• Scytl

– Three Red Teams

• Air Force Institute of Technology Center for Cyber Space Research

• RedPhone, LLC

• DoD

– 72‐hour testing period

• Evaluate the sufficiency of the UOCAVA Pilot Program Testing

Requirements

• Identity common vulnerabilities across vendors

• Results will not be vendor specific
Grants Proces

Grants Proces

General Info• Multi

ple com

petitive awards 

Technical Criteria

p p

• Significance: Addresse

totaling $16,200,000 

• State and local 

governments

problems

• Sustainability: Available 

of grant

g

• Impact: Number of UOC

• Full Grant notice available 

from www.Grants.gov

Impact: Number of UOC

served;

• Strategic Approach: We

hypothesis and plan to te

from www.Grants.gov hypothesis

• Announcement Number 

BAA HQ0034-FVAP-11-BAA0001 

hypothesis

• Innovation: Discovery o

implementation of new te

• Scalability: application a

• Or go to Grants.gov and 

search under “FVAP” keyword search

jurisdictions

• Collaboration: Involvem

election jurisdictions/partn

• Cost B

e

n

efi

t An

alysis: 

• Applications closed 13 July

Cost e e t a ys s Return on Investment
Grants Technical R

Chairperson 

(GO)

Government Review Technical 14 Panelists

Liaison (GO)

Assistant (GO) (NGOs & GO)

Nat

Organ

Former

Election

Elections Research

Election

Technology Military Organ

Affi

Election

Officials

Research

Academicians

Technology

Experts Personnel

SoS SED LEO
Cyber Security

Analysis Group

• Government-only Review Group

– P id i d d t i d d i FVAP ff t Provides independent review and advice on FVAP efforts

– review cyber security efforts in support of the remote electronic v

demonstration project

NIST EACFVAP FBIAir Force Institute of Defense Information SystemsTechnology AgencyDefense Intelligence Agency Defense Technical Information

Center

National Security Agency Naval Research LaboratoryDoD Chief Information Officer Under Secretary of Defense

(Personnel & Readiness)

• Raised the idea of developing a Concept of Operations
UOCAVA Solutions Su

Purpose: Provides for an open dialogue and exchange of ideas on ele

voting properties and build out of risk matrix for current UOCvoting properties and build out of risk matrix for current UOC

Absentee voting environment. 

Invitees :

• Public advocates and critics• Advocacy groups• Service providers• Government agencies

– EAC– NIST

– M b f C b S it R i G Members of Cyber Security Review Group

Next meeting: 

• San Francisco 6 San Francisco, 6-7 AUG 2011 7 AUG 2011• Prior to EVT/WOTE and USENIX• Topic: Identify risk drivers to allow for comparative risk & policy anal
How Electronics Stand

D l eve opment Sh ld ou Be F 

GAO Guidance GAO Guidance Risk = % x im FVAP & EAC need detailed plans Necessary plan elements:

Risk % x im Acceptable risk level 

decision already mad

It IS th t t

Necessary plan elements:

 results-oriented action plan  Goals, tasks, milestones, timeframes, 

and contingencies

 It IS the current vot

 Accepts 1/3 of abse

never returned

 FVAP-EAC Memorandum of 

Understanding

 EAC-NIST Interagency Agreement

 We should accept eq

risk in new UOCAVA 

g yg  May have different 

 MOVE Act also requires EAC to 

develop detailed timeline for 

development of electronic absentee

impact

 Can reduce probab

mitigate impact

development of electronic absentee  Goal is to keep risk 

ballot guidelines

 Goal is to keep risk 

the same, if not bet
Path Forward

Define the Risk Use the EAC Risk

Establish Properties What “properties”

Establish 

Use the EAC Risk  IntegraAssessment Tool & NIST IT Risk Assessment Tools

What properties

are unique to an 

electronic absentee 

voting system?

Integra

work atimelin

 Evaluate the current 

UOCAVA absentee ballot system as the baseline

voting system?

 To achieve the 

same level of risk

 Also e

nationa

system as the baseline risks

 Develop comparable 

measures for future voting

same level of riskas current system

 Even if DON”T

risks

 Develo

measures for future voting points systems

 Even if DON T

believe properties are technologically feasible

points 

develo

feasible  Attach 

 Not system specific

Attach 

those dand m
Comparative Ris

Assessment

• FVAP conducting a Comparative Risk Analysis

– EAC Risk Assessment Tool and NIST Risk Management Fra– Initial Risk Assessment by March 12– Comparative Risk Assessment by August 12

• Assess risks associated with the current UOCAVA Voting 

Environment

• Compare to risks associated with remote electronic voting• TDGC Support Needed

– Review methodologies– Comment on preliminary results– Incorporate results into High Level Guidelines
Timeline for discussion only – not approved by DoD, EAC, 
Recommended Nex

1. Complete the comparative risk assessment2. Develop High Level Guidelines to frame testable st

for demonstration project

• Differentiate thresholds from aspirational goals Differentiate thresholds from aspirational goals• Refrain from “fixing” voting• Refrain from prescribing specific technologies• High Level Guidelines are not complete until linked back t

risk levels in Step #1.

• Trade-offs are needed between current level of military vo

disenfranchisement vs. future benefits

3. Incorporate FVAP findings from FY 10 and FY 11 re4. Revise Joint EAC Revise Joint EAC-NIST-FVAP Roadmap FVAP Roadmap
F d l V ti A i t P F

e

deral Voting 

Assis

tance 

Progr

Department of Defense

Bob Carey, Director

1777 North Kent St., #14003

Arlington, VA 22209

Phone: 703-588-8118

Fax: 703-696-1352

Email: Robert.Carey@fvap.gov