Elections: Action Plans Needed to Fully Address Challenges in Electronic Absentee Voting Initiatives for Military and Overseas Citizens
Published: 2007-06-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) protects the rights of military personnel, their dependents, and overseas citizens to vote by absentee ballot. The Department of Defense (DOD) and others have reported that absentee voting, which relies primarily on mail, can be slow and may, in certain circumstances, serve to disenfranchise these voters. In 2004, Congress required DOD to develop an Internet-based absentee voting demonstration project and required the Election Assistance Commission--which reviews election procedures--to develop guidelines for DOD's project. In 2006, Congress required DOD to report, by May 15, 2007, on plans for expanding its use of electronic voting technologies and required GAO to assess efforts by (1) DOD to facilitate electronic absentee voting and (2) the Commission to develop Internet voting guidelines and DOD to develop an Internet-based demonstration project. GAO also assessed DOD's efforts to develop plans to expand its use of electronic voting technologies. GAO interviewed officials and reviewed and analyzed documents related to these efforts.
section_title: What GAO Found
paragraphs: Since 2000, DOD has developed several initiatives to facilitate absentee voting by electronic means such as fax or e-mail; however, some of these initiatives exhibited weaknesses or had low participation rates that might hinder their effectiveness. For example, the 2003 Electronic Transmission Service's fax to e-mail conversion feature allows UOCAVA voters who do not have access to a fax machine to request ballots by e-mail and then converts the e-mails to faxes to send to local election officials. DOD officials told us, however, they have not performed, among other things, certification tests and thus are not in compliance with information security requirements. The 2004 Interim Voting Assistance System (IVAS)--which, DOD reported, enabled UOCAVA voters to request and receive ballots securely--cost $576,000, and 17 citizens received ballots through it. The 2006 Integrated Voting Alternative Site (also called IVAS)--which enabled voters to request ballots using one tool, by mail, fax, or unsecured e-mail--raised concerns, from Congress and others, that using unsecured e-mail could expose voters to identity theft if they transmit personal data. While this IVAS displayed a warning that voters had to read to proceed, it did not advise them to delete personal voting information from the computers they used. DOD spent $1.1 million, and at least eight voted ballots were linked to this 2006 IVAS. Both the 2004 and 2006 IVAS were each implemented just 2 months before an election. DOD also has a Web site with links to guidance on electronic transmission options, but some of this guidance was inconsistent and could be misleading. DOD officials acknowledged the discrepancies and addressed them during GAO's review. The Election Assistance Commission has not developed the Internet absentee voting guidelines for DOD's use, and thus DOD has not proceeded with its Internet-based absentee voting demonstration project. Commission officials told GAO that they had not developed the guidelines because they had been devoting constrained resources to other priorities, including challenges associated with electronic voting machines. Furthermore, they have not established--in conjunction with major stakeholders like DOD--tasks, milestones, and time frames for completing the guidelines. The absence of such guidelines has hindered DOD's development of its Internet-based demonstration project. To assist the Commission, however, DOD has shared information on the challenges it faced in implementing prior Internet projects--including security threats. GAO observed that DOD was developing, but had not yet completed, plans for expanding the future use of electronic voting technologies. Because electronic voting in federal elections involves numerous federal, state, and local-level stakeholders; emerging technology; and time to establish the initiatives, developing results-oriented plans that identify goals, time frames, and tasks--including addressing security issues--is key. Without such plans, DOD is not in a position to address congressional expectations to establish secure and private electronic and Internet-based voting initiatives.

section_title: Letter
paragraphs: A citizen’s right to vote is one of the hallmarks of a democratic society; yet  exercising this right can be a challenge for millions of military personnel  and their dependents of voting age who live away from their legal  residences (in or outside the United States) and for overseas citizens.  These individuals are eligible to vote by absentee ballots in federal  elections. This eligibility is established by the Uniformed and Overseas  Citizens Absentee Voting Act (UOCAVA), which is administered by the  Department of Defense’s (DOD) Federal Voting Assistance Program  (FVAP). Through this program, DOD provides assistance to UOCAVA  voters to facilitate opportunities for them to exercise their right to vote.  The absentee voting process requires the potential voter to register to  vote, request an absentee ballot, receive the ballot, correctly complete the  ballot, and return it to the appropriate local election official. However,  DOD and groups that represent voters covered under the act have  reported that, because the multistep process of absentee voting relies  primarily on mail, in some instances it can take so long to complete that  these voters may, in effect, be disenfranchised.
To address concerns about mail-based absentee voting, Congress has  enacted several laws to promote electronic means for voters to register,  request and receive ballots, and transmit voted ballots to local election  officials. These laws include (1) the Help America Vote Act of 2002, which  established the Election Assistance Commission to serve as a national  clearinghouse for election information and to review election procedures;  develop voluntary voting system guidelines; and study, among other  things, electronic voting—particularly Internet voting technology;   (2) section 1604 of the National Defense Authorization Act (NDAA) for  Fiscal Year 2002, which required DOD to carry out a secure Internet-based  electronic demonstration project in the general election for federal office  in 2002 or 2004; and (3) section 567 of the Ronald W. Reagan NDAA for  Fiscal Year 2005, which amended Congress’s mandate for DOD to develop  a secure, Internet-based, absentee voting demonstration project—by  requiring DOD to implement the project during the first general election  for federal office that occurs after the Election Assistance Commission  establishes Internet voting guidelines for the absentee voting process.  Section 596 of the John Warner NDAA for Fiscal Year 2007 required DOD  to submit, not later than May 15, 2007, a detailed plan to expand the use of  electronic voting technology.
Section 596 of the John Warner NDAA for Fiscal Year 2007 also required  GAO to review DOD’s electronic and Internet-based voting initiatives. This  report assesses (1) DOD’s efforts to facilitate registration, ballot  transmittal, and voting by electronic means, such as e-mail and fax, for  UOCAVA voters and (2) the Election Assistance Commission’s efforts to  develop Internet absentee voting guidelines and DOD’s efforts to develop a  secure, Internet-based, absentee voting demonstration project. The report  also discusses DOD’s efforts to develop plans to expand the use of  electronic voting technology in the future.
To address our objectives, we reviewed and analyzed laws, directives,  reports, and plans related to DOD’s efforts to provide electronic voting  capabilities for UOCAVA voters. We also examined the Election Assistance  Commission’s efforts to develop Internet absentee voting guidelines. We  reviewed and analyzed information regarding any benefits and challenges  that we, DOD, and others had identified related to DOD’s Internet-based  electronic demonstration project and new electronic voting initiatives,  along with the steps DOD had taken to mitigate those challenges.  Additionally, we interviewed and obtained documentation from officials in  several offices within DOD, the Election Assistance Commission, selected  state and local election jurisdictions, and some independent groups  concerned with the interests of UOCAVA voters. We performed our work  in accordance with generally accepted government auditing standards,  from August 2006 through April 2007. Appendix I provides detailed  information about our scope and methodology.
subsections: section_title: Background
paragraphs: The U.S. election system is highly decentralized and relies on a complex  interaction of people, processes, and technology. Voters, local election  jurisdictions (which number over 10,000), states and territories, and the  federal government all play important roles in the election process. The  process, however, is primarily the responsibility of the individual states  and territories and their election jurisdictions. As we reported in our 2006  testimony, states and territories have considerable discretion in how they  organize the elections process; this is reflected in the diversity of  procedures and deadlines that states and jurisdictions establish for voter  registration and absentee voting. Furthermore, these states and  jurisdictions use a variety of voting techniques, from paper ballots to faxes  and e-mails. We also reported that the voter is ultimately responsible for  being aware of and understanding the absentee voting process and taking  the actions necessary to participate in it.
The UOCAVA established that members of the military and their  dependents of voting age living away from their legal residences (in or  outside the United States) and American citizens who no longer maintain a  permanent residence in the United States are eligible to participate by  absentee ballot in all federal elections. According to DOD, the act covers  more than 6 million people. Executive Order and DOD guidance related to  the act include the following:    Executive Order 12642, dated June 8, 1988, made the Secretary of Defense,  or his designee, responsible for carrying out the federal functions under  UOCAVA, including (1) compiling and distributing information on state  absentee voting procedures, (2) designing absentee registration and voting  materials, (3) working with state and local election officials, and   (4) reporting to Congress and the President after each presidential  election on the effectiveness of the program’s activities (including a  statistical analysis of UOCAVA voters’ participation).
DOD Directive 1000.4, updated April 14, 2004, assigned the Office of the  Under Secretary of Defense for Personnel and Readiness responsibility for  administering and overseeing the program, and it established the FVAP to  manage the program. In 2006, FVAP officials told us that they were  authorized a full-time staff of 13 and had a fiscal year budget of  approximately $3.8 million.
FVAP facilitates the absentee voting process for UOCAVA voters; its  mission is to (1) inform and educate U.S. citizens worldwide about their  right to vote, (2) foster voter participation, and (3) enhance and protect  the integrity of the electoral process at the federal, state, and local levels.  FVAP also, among other things, provides training opportunities for Voting  Assistance Officers (service, State Department, and overseas citizen  organization officials who carry out the implementation of their respective  voting assistance programs); prescribes, coordinates, and distributes  voting materials, such as the Federal Post Card Application (the  registration and absentee ballot request form for UOCAVA voters); and  provides for alternatives to regular mail, including Express Mail and the  use of electronic solutions.
The Election Assistance Commission, which was established by the Help  America Vote Act of 2002, also contributes to the absentee voting process.  The act specifically established the Commission as a national  clearinghouse for election information and procedures and assigned it  responsibility for developing voting system guidelines for the entire  election process. The act also specifies that the development of voluntary  voting system guidelines should be informed by research and development  in remote access voting, including voting through the Internet, and the  security of computers, networks and data storage. In 2005, the  Commission issued guidelines that, among other things, addressed gaps in  the security measures of prior standards. However, these guidelines do not  comprehensively address telecommunications and networking services or  their related security weaknesses, such as those related to the Internet.  The act also amended UOCAVA to require states to report to the  Commission, after each regularly scheduled general election for federal  office, on the aggregate number of (1) absentee ballots transmitted to  absentee uniformed services voters and overseas voters for the election  and (2) ballots returned by those voters and cast in the election. The  Commission collects this information through its biennial state surveys of  election data.
DOD, the Commission, and organizations representing UOCAVA voters  have noted that these voters may effectively become disenfranchised  because the multistep process for voting by absentee ballot—which relies  primarily on mail—can take too long, especially for mobile  servicemembers and overseas citizens or those deployed to or living in  remote areas. Congress and DOD have taken action to facilitate the use of  alternatives to mail, including electronic means such as fax, e-mail, and the  Internet. Figure 1 shows (1) the laws designed to facilitate the use of  electronic capabilities for UOCAVA voters and (2) some of DOD’s efforts,  either voluntary or in response to a statute, to provide electronic  capabilities to these voters during fiscal years 2000 through 2007.
FVAP stated that it implemented the Voting Over the Internet project in  2000 as a small-scale pilot project to provide military personnel and their  dependents and overseas citizens covered under UOCAVA the ability to  securely register to vote, request and receive ballots from local election  officials, and vote via the Internet. DOD voluntarily developed the project  as a small-scale proof-of-concept Internet voting project. This project  enabled 84 voters to vote over the Internet—the first time that binding  votes were cast in this manner. While the project demonstrated that it  was possible for a limited number of voters to cast ballots online, DOD’s  report concluded that security concerns needed to be addressed before it  could expand remote (i.e., Internet) voting to a larger population.
In 2001, Congress noted that the Voting Over the Internet project had  demonstrated that the Internet could be used to enhance absentee voting.  To continue the examination of a secure, easy-to-use Internet voting  system as an alternative to the regular mail process, Congress mandated,  in the NDAA for Fiscal Year 2002, that DOD conduct a large-scale Internet- based absentee voting demonstration project to be used for the 2002 or  2004 federal election. DOD responded to this mandate by creating the  Secure Electronic Registration and Voting Experiment (SERVE) for  Internet-based absentee registration and voting; SERVE used a system  architecture similar to the one used for the Voting Over the Internet  project. However, as we previously reported, a minority report published  by four members of the Security Peer Review Group—a group of 10  computer election security experts that FVAP assembled to evaluate  SERVE—publicly raised concerns about the security of the system  because of its use of the Internet. The four members suggested that  SERVE be terminated because potential security problems left the  information in the system vulnerable to cyber attacks that could disclose  votes or personal voter information. Furthermore, they cautioned against  the development of future electronic voting systems until the security of  both the Internet and the world’s home computer infrastructure had been  improved. Because DOD did not want to call into question the integrity of  votes that would have been cast via SERVE, the Deputy Secretary of  Defense terminated the project in early 2004, and DOD did not use it in the  November 2004 election.
The points raised in these security reviews are consistent with concerns  we raised in our 2001 reports. We found that broad application of Internet  voting presented formidable social and technological challenges. In  particular, we noted that challenges to remote Internet voting involve  securing voter identification information and ensuring that voters secure  the computer on which they vote. We also reported that because voting  requires more stringent controls than other electronic transactions, such  as online banking, Internet voting systems face greater security challenges  than other Internet systems. Furthermore, we found that remote Internet  voting was recognized as the least protective of ballot secrecy and voter  privacy and was most at risk from denial of service and malicious  software, such as computer viruses. While opinions of groups considering  the pros and cons of Internet voting were not unanimous, we found that  they agreed in principle on major issues, including considering security to  be the primary technical challenge for Internet voting. Because of serious  concerns about protecting the security and privacy of the voted ballot, we  concluded that Internet-based registration and voting would not likely be  implemented on a large scale in the near future.
In the Ronald W. Reagan NDAA for Fiscal Year 2005, Congress amended  the requirement for the Internet-based absentee voting demonstration  project by permitting DOD to delay its implementation until the first  federal election after the Election Assistance Commission developed  guidelines for the project. The conference report for the act stated that,  although Congress recognized the technical challenges of Internet voting,  SERVE was an important prototype that should not be abandoned.
section_title: DOD Initiatives Assist UOCAVA Voters, but Certain Weaknesses May Limit Their Effectiveness
paragraphs: Since the 2000 federal election, DOD has established several initiatives as  alternatives to the by-mail process to facilitate voter registration and ballot  request, receipt of a ballot, and submission of a voted ballot by electronic  means—such as fax and e-mail—for UOCAVA voters. These include the  Electronic Transmission Service’s fax to e-mail and e-mail to fax  conversion enhancement (hereafter referred to as the e-mail to fax  conversion feature); the 2004 Interim Voting Assistance System (IVAS); the  2006 Integrated Voting Alternative Site (also called IVAS); DOD’s online  voting assistance guidance; and online forms to register, request, receive,  or submit ballots. While these efforts provide valuable guidance, services,  and information to UOCAVA voters, some of them had limited  participation rates or exhibited weaknesses in security, consistency, and  accuracy that might hinder their use and effectiveness. DOD officials have  acknowledged these weaknesses and they began taking action to address  them during the course of our review.
subsections: section_title: Electronic Transmission Service’s E-mail to Fax Conversion Capability Facilitates Transmission of Voting Materials but Does Not Fully Comply with Information Security Requirements
paragraphs: The electronic transmission service is a fax forwarding system, established  by FVAP in 1990, that allows UOCAVA voters and state and local election  officials, where permitted by law, to fax election materials to each other.  These voters and election officials can use this service and do not have to  pay long distance fees for faxing out of state, because DOD provides the  service through a toll-free line. In 2003, after discussions with Mississippi  state officials and a Mississippi National Guard unit, FVAP added the   e-mail to fax conversion capability to its electronic transmission service.  These officials asked FVAP for help in transmitting voting materials  because, by state law, Mississippi allowed only faxing as an electronic  means of transmission—a capability that the Guard unit would not have  while it was deployed to Iraq. The e-mail to fax conversion feature allows  UOCAVA voters who do not have access to a facsimile machine to send  ballot requests, via e-mail, to DOD’s Electronic Transmission Service,  which converts e-mail attachments to faxes and sends them to local  election officials. In return, local election officials can send ballots to the  Electronic Transmission Service conversion feature by fax; the conversion  feature then converts the fax to an e-mail attachment and sends it to the  voter.
FVAP stated that it notifies states and territories whenever it converts an  e-mail containing voting materials to a fax, or vice versa, so that the state  or territory can decide whether or not to accept it. Table 1 shows  Electronic Transmission Service activity for the conversion feature for  2004 and 2006.
Although FVAP has made progress in assisting servicemembers to  transmit voting materials with the e-mail to fax conversion enhancement,  FVAP officials told us they have not fully complied with certain  information security requirements in the Interim DOD Information  Assurance Certification and Accreditation Process. This guidance  requires DOD components, among other things, to implement controls and  to certify and accredit such e-mail systems.
FVAP officials initially stated that the information security guidance did  not apply to the conversion feature; they saw it as an enhancement to the  original Electronic Transmission Service’s fax system. During the course  of our review, however, FVAP officials said they consulted with officials  responsible for DOD’s information assurance certification and  accreditation and concluded that the requirements did, in fact, apply.  These officials stated that, by the end of fiscal year 2007, they plan to  award a contract to obtain services to meet the information security  requirements. The FVAP officials further stated that, while they do not  have the required documentation—such as risk assessments or  certification tests and accreditations—they have taken some measures to  ensure security. We note that the statement of work for FVAP’s April 29,  2005, contract for the Electronic Transmission Service recognizes the  sensitivity of the data associated with election materials and includes  provisions for certain security functions, such as ensuring that adequate  steps are taken to prevent unauthorized access or manipulation of the  data. Until FVAP performs and documents the security assessments and  certifications, however, it has not taken all the necessary measures to  secure its system and comply with DOD’s information security  requirements.
Federal law includes a number of separate statutes that provide privacy  protections for certain information. The major requirements for the  protection of personal privacy by federal agencies come from two laws:  the Privacy Act of 1974 and the privacy provisions of the E-Government  Act of 2002. Section 208 of the E-Government Act of 2002 requires  agencies, among other things, to conduct privacy impact assessments  before developing, upgrading, or procuring information technology that  collects, maintains, or disseminates personally identifiable information.  DOD developed departmentwide guidance—the DOD Privacy Impact  Assessment Guidance—for implementing the privacy impact assessment  requirements mandated in the E-Government Act of 2002. In this guidance,  DOD directs the components to adhere to the requirements prescribed by  the Office of Management and Budget (OMB)—Guidance for  Implementing the Privacy Provisions of the E-Government Act of 2002.  FVAP officials stated that they had not conducted a privacy impact  assessment for the Electronic Transmission Service’s e-mail to fax  conversion enhancement, but they told us that a privacy impact  assessment will be done as part of the previously mentioned contract to  meet information security requirements. A privacy impact assessment  would identify specific privacy risks to help determine what controls are  needed to mitigate those risks associated with the Electronic  Transmission Service. Furthermore, building in controls to mitigate risks  could ensure that personal information that is transmitted is only used for  a specified purpose. FVAP noted that when information is sent by e-mail,  the conversion feature retains the following information: full name, fax  number, city, state, zip code, and e-mail addresses. FVAP’s Electronic  Transmission Service retains this personally identifiable information both  to provide transmission verification or confirmation to users and to  comply with election document retention requirements under the Civil  Rights Act of 1960.
section_title: DOD’s Electronic Ballot Request and Receipt Initiatives Had Limitations in Participation and Security
paragraphs: In September 2004, just 2 months prior to the election, DOD voluntarily  implemented what it reported as a secure electronic system for voters to  request and receive ballots—the Interim Voting Assistance System  (IVAS)—as an alternative to the traditional mail process. IVAS was open to  active duty servicemembers, their voting age dependents, and DOD  overseas personnel who were registered in a state or territory participating  in the project and enrolled in the Defense Enrollment Eligibility  Reporting System—a DOD-managed database that includes over 23 million  records pertaining to active duty and reserve military and their family  members, retired military, DOD civil service personnel, and DOD  contractors. DOD had limited IVAS participation to UOCAVA voters who  were affiliated with DOD because their identities could be verified in the  Defense Enrollment Eligibility Reporting System. Voters obtained their  state or territory ballots through IVAS by logging on to a special Web site  and then requesting ballots from their participating local election  jurisdictions. After the local election officials approved the requests and  the ballots were finalized, IVAS notified voters via e-mail that the ballots  were available to download and print. DOD reported that 108 counties in  eight states and one territory agreed to participate in this 2004 IVAS;  however, only 17 citizens downloaded their ballots from the site during the  2004 election. FVAP officials noted that participation was low, in part  because this IVAS was implemented just 2 months before the election.  FVAP further reported that many states did not participate—for a variety  of reasons, including state legislative restrictions, workload surrounding  regular election responsibilities, and lack of Internet access. FVAP  officials noted that this system, which was maintained through the  conclusion of the election, cost $576,000.
In September 2006—again, just 2 months before the next general  election—FVAP launched a follow-on Integrated Voting Alternative Site,  also called IVAS, in response to a June 2006 legislative mandate to  reestablish the 2004 IVAS. This 2006 IVAS expanded on the 2004 effort, by  providing information on electronic ballot request and receipt options for  all UOCAVA citizens in all 55 states and territories.  It also provided two  tools that registered voters could access through the FVAP Web site, using  DOD or military identification, to request or receive ballots from local  election officials. As with the 2004 IVAS, local election officials used  information in these tools to verify the identity of UOCAVA voters who  used them. The first tool—called Tool 1—contained a ballot request form  only, accessed through DOD’s Web site, which voters could fill out and  download to their computers. Voters could then send the downloaded  form to the local election officials either by regular mail, fax, or unsecured  e-mail, per state or territory requirements. FVAP officials reported to  Congress that no information on the number of users was available on the  use of Tool 1 because the department was no longer involved in the  process once the voter downloaded the ballot request and they,  essentially, had no visibility into what transpired directly between the  voter and the election officials.
The second tool—called Tool 2—provided a ballot request and receipt  capability for voters, similar to the 2004 IVAS, which also allowed voters to  fill out ballot request forms online, send them to local election officials  through a secure line, and receive their state or territory ballots from the  local election officials through a secured server. Again, no voted ballots  were transmitted through this IVAS system given that it was not designed  for that purpose. Absentee voters, instead, would return voted ballots,  outside of IVAS, in accordance with state law. Tool 2 had a tracking  feature which showed that 63 voters had requested ballots through the  system. Of these, local election officials approved and made their state or  territory ballots available to 35 UOCAVA voters. However, of the 35 sent  out, local election officials reported that only 8 voted ballots were traced  back to the IVAS Tool 2, in part because this IVAS was implemented just   2 months before the election. DOD reported that the total cost for the 2006  IVAS was about $1.1 million, and given that the tools were used only to  request or receive ballots for the November 2006 elections, DOD removed  the tools from FVAP’s Web site in January 2007. Table 2 compares and  provides additional details on the two tools.
Officials within Congress, and others, have expressed concerns that voters  could be exposed to a heightened risk of identity theft if they used Tool 1  to send voting materials that contain personally identifiable information  (including Social Security number, date of birth, and address), by  unsecured e-mail. FVAP officials acknowledged in their December 2006  report to Congress that Tool 1 was less secure, but said (1) DOD was  providing access to a capability that states already provide, (2) most  states and territories only required the last four digits of the Social  Security number on the ballot requests, and (3) Tool 1 displayed a  cautionary statement that voters had to read to go on with the request  process; this cautionary statement explained the risk associated with   e-mailing ballot requests and that the government assumed no liability if  voters did so. While we confirmed a cautionary statement related to the  transmission of personal data did exist for Tool 1, it did not advise voters,  after submitting their ballot request, to remove voting materials that they  have stored on their computers. For example, voters using Internet cafes  overseas could have been subject to identity theft if they did not delete  their personal information from the computer and a subsequent user  gained access to the stored file. FVAP officials acknowledged that users  were not advised of the risks of storing personal voting information on  their computers, and these officials stated that they will incorporate  lessons learned, such as adding a cautionary statement in any future ballot  request system.
section_title: Online Voting Guidance Is Useful but Some Inconsistencies Exist in the Links
paragraphs: In addition to these initiatives, DOD also has established the FVAP Web  site, which contains information on FVAP programs and links to assist  UOCAVA voters in the voting process. Specifically, these links access  FVAP’s online guidance, including several versions of FVAP’s biennial  Voting Assistance Guide, shown in figure 2.
This guide tells the UOCAVA voter how to register, request a ballot,  receive a ballot, and vote the ballot electronically—including by e-mail or  fax—where state or territory law allows this. One link on FVAP’s Web site  had a full-text version of the guide, so that a Voting Action Officer or  other user could download and print the entire guide and use it to provide  assistance to absentee voters from various states and jurisdictions.  Another link goes to a Web page containing “State-by-State Instructions,”  where two additional links—one a PDF guide, the other an HTML  version—are provided for each state or territory. This allows voters to  read or print off only their own state’s or territory’s instructions and to  have a choice of formats. Another link goes to the Integrated Voting  Alternative Site—this site provides information for the 55 states and  territories regarding the electronic ballot request and receipt options  available to UOCAVA voters. FVAP’s Web site also has another link to  News Releases, which contains updates on changes to the guidance,  including changes to state laws that affect UOCAVA voters. Finally, a link  goes to FVAP’s Voting Assistance Guide Errata Sheets—this contains  changes that have been made to the archived Voting Assistance Guide  since its last printing.
Our review of the FVAP Web site, however, revealed inconsistencies in  some of the information about electronic transmission options that the  voters could access through different links on the site. Our analysis  specifically showed that, while not widespread, for 14 of the 55 states or  territories, some of the guidance regarding requirements for electronic  transmission was inconsistent and could be misleading, as the following  examples illustrate:    For the state of California, we found that three of the FVAP links correctly  stated that only overseas military and overseas civilian voters were eligible  to receive or return a ballot by fax; a fourth link, however, did not include  this restriction. As a result, military personnel stationed in the United  States, but away from their state of residence, might conclude— incorrectly—that they were eligible to vote by fax. FVAP officials  acknowledged this discrepancy and updated the information reached from  the fourth link on January 25, 2007, to reflect the fact that uniformed  servicemembers must be residing or deployed overseas to be able to  receive and send ballots by fax.
For the state of Colorado, we identified a news release that was issued on  October 18, 2006, announcing a new initiative to allow uniformed  servicemembers deployed outside the United States to request, receive,  and return absentee ballots via e-mail. One other FVAP link reflected this  change; however, four other links did not capture this change. FVAP  officials acknowledged this discrepancy, updated two of the links, and  issued an errata sheet on January 22, 2007. FVAP officials did not update  the third link—the 2006-2007 Voting Assistance Guide accessed through  the publications link on their Web site—stating that it was considered an  archive document and was not intended for update. However, DOD did not  clearly identify this link as an archived document; as a result, this link  could mislead voters who relied on it. FVAP officials later acknowledged  that the archived version of the 2006-2007 Voting Assistance Guide could  have been labeled better, and eventually deleted this version from their  Web site.
Appendix II provides details on the inconsistencies we found on FVAP’s  Web sites for 14 states and identifies the links, along with DOD’s  responses regarding each. Under internal control guidance, organizations  are to apply policies and procedures consistently. As noted previously,  while the inconsistencies were not widespread, the fact that  inconsistencies exist at all could lead UOCAVA voters— especially busy  voters residing or deployed in remote locations—to rely on incorrect  information and therefore adversely affect their ability to vote. Agency  officials acknowledged these discrepancies and addressed them during the  course of our review.
section_title: Online Voting Forms
paragraphs: In addition, FVAP administers two online forms, (1) the Federal Post Card  Application, which allows absentee voters to register to vote or request  ballots; and (2) the Federal Write-in Absentee Ballot, which allows  absentee voters to vote even if they have not yet received the absentee  ballot they requested from their state or territory. The Federal Post Card  Application has been online since 1999, in PDF format, and is postage-free  within the U.S. mail system when appropriate markings, provided on  FVAP’s web site, are used. The online Federal Post Card Application  allows voters to download a PDF version to their computers to complete,  e-mail, print, sign, and send to their local election official via mail. Some  state and local election officials we spoke with indicated that the online  version of the Federal Post Card Application has many benefits because it  is easy to fill out and read, and it provides sufficient space for the voter to  write in.
A UOCAVA voter can also use the Federal Write-in Absentee Ballot as a  backup ballot when the state or territory has not sent a regular absentee  ballot in time for the voter to participate in the election. On October 21,  2004, just a few weeks before the national election, FVAP issued a news  release announcing the electronic version of the ballot as an emergency  ballot. The Ronald W. Reagan NDAA for Fiscal Year 2005 amended the  eligibility criteria in UOCAVA to allow states and territories to accept the  Federal Write-in Absentee Ballot under a broader range of circumstances.  Prior to the change, a UOCAVA citizen had to be outside of the United  States, have applied for a regular absentee ballot early enough to meet  state election deadlines, and not have received it from the state. Under the  new criteria, the Federal Write-in Absentee Ballot can be used by military  servicemembers and their dependents stationed in the United States, as  well as by military personnel, their dependents, and citizens living  overseas.
section_title: Absence of Internet Absentee Voting Guidelines Has Hindered Development of the Mandated Internet- Based Absentee Voting Demonstration Project
paragraphs: The Election Assistance Commission has not yet developed the Internet  absentee voting guidelines, and because it is required by law to develop  them for DOD’s use in the secure, Internet-based, absentee voting  demonstration project, DOD has not moved ahead with the project.  Commission officials told us that they have not yet developed the required  Internet absentee voting guidelines because the Commission has been  working on other priorities—including standards for electronic voting  machines, challenges associated with these electronic voting machines,  and a process for certification and accreditation—and it lacks the  resources to work on the Internet absentee voting guidelines or the  mandated study of the issues and challenges for Internet technology at the  same time. Although the Internet voting study is now underway, the  Commission has said that it will not be completed until September 2007  and thus does not have the results it needs to establish time frames or a  plan for developing the guidelines. Regarding the demonstration project,  DOD officials stated that they had not taken action to develop this project  because the Ronald W. Reagan NDAA for Fiscal Year 2005 requires the  Commission to develop the guidelines first. DOD officials stated that, in an  effort to assist the Commission in developing the Internet absentee voting  guidelines, they have provided information on prior Internet voting efforts,  along with challenges associated with these Internet voting efforts and  views on how to mitigate those challenges.
subsections: section_title: The Commission Has Not Developed Internet Absentee Voting Guidelines because of Other Priorities, Constraints on Resources, and Lack of DOD Information
paragraphs: Commission officials stated that they have not developed Internet  absentee voting guidelines because the Commission and the organizations  that would normally provide assistance to it are directing their constrained  resources to other priorities. This includes addressing challenges  associated with electronic voting machines and establishing a process for  certification and accreditation. Additionally, the Help America Vote Act of  2002 requires the Commission’s Technical Guidelines Development  Committee to assist the Executive Director of the Commission in  developing voluntary voting system guidelines. The act also requires the  Director of the National Institute of Standards and Technology to provide  the Development Committee with technical support in developing those  guidelines, including research and development related to computer and  network security, voter privacy, remote access voting (including voting  through the Internet), and voting fraud.
Commission officials told us, however, that the Development Committee  has not been able to work on Internet absentee voting guidelines for  UOCAVA voters because it had other priorities and constraints on its  resources. In light of the Development Committee’s low priority for  working on the Internet absentee voting guidelines, officials from the  Commission asked officials from the National Institute of Standards and  Technology to assist with developing the guidelines. However, officials  from the National Institute of Standards and Technology said that they  could not provide support because they also lacked sufficient resources at  the time. Commission officials told us that, at the time of our review, the  National Institute of Standards and Technology was also using its  resources to work with the Development Committee on the current  voluntary voting guidelines and would not have sufficient resources to  work on Internet absentee voting guidelines until after July 2007.
Additionally, Commission officials stated that they were waiting for DOD  to provide information that describes the type of system around which the  guidelines should be developed. DOD officials, however, stated that they  gave the Commission reports that provided the framework for the  Internet-based absentee voting system they envisioned. Specifically, these  DOD officials told us that they provided the Commission, in 2004, with a  report on their 2000 proof of concept for Internet-based voting called  “Voting Over the Internet,” and in March 2006, they provided the  Commission with an internal DOD document assessing the terminated  SERVE project. DOD and Commission officials told us that they had not  communicated in depth on the guidelines and the DOD system before our  review.
section_title: The Election Assistance Commission Has Started a Study as a Precursor to the Internet Absentee Voting Guidelines
paragraphs: To gain a better understanding of the Internet voting environment, in  September 2006, the Commission started an Internet voting study as a  precursor to developing the Internet absentee voting guidelines. The Help  America Vote Act of 2002 required the Commission to conduct this study  to determine the issues and challenges presented by incorporating  communications and Internet technology into elections, including the  potential for election fraud, and to issue a report no later than June 29,  2004. However, the Commission did not meet this reporting date.  Commission officials told us that they were unable to complete the study  sooner—or even begin it—because of the resource constraints they have  worked under since the Commission’s inception, and because they were  working on other priorities. They noted, for example, that under the act,  the Commission was to be established by February 26, 2003, but the  Commissioners were not appointed until almost a year later, in December,  2003. They also told us that, although 23 employees were allocated to the  Commission, they had to build up staff gradually, starting in January 2004,  by hiring two employees each month. Accordingly, Commission officials  testified in June 2004 that, as a result of these constraints, the  Commission was able to meet only some of its mandates, such as  developing the 2005 Voluntary Voting System Guidelines. As a result, the  Commission was not able to conduct the Internet voting study in a timely  manner.
Commission officials stated that the Internet voting study, which was  underway during the course of our review, includes several case studies to  monitor current Internet voting usage and electronic transmission of  ballots. The four states participating in this part of the study are Florida,  Montana, South Carolina, and Illinois. The study also includes (1) a survey  of UOCAVA voters to collect information on their level of interest in  electronic voting and (2) a conference to gather states’ experiences on  topics such as Internet voting, electronic transmission of ballots, security  risks for voting systems, and verification of voters’ identities. Commission  officials told us that they plan to issue a final report on the Internet voting  study in September 2007.
section_title: The Commission Does Not Have a Plan for Assessing Security Issues and Developing Internet Absentee Voting Guidelines
paragraphs: The Ronald W. Reagan NDAA for Fiscal Year 2005 did not establish a  deadline by which the Commission was to complete the Internet absentee  voting guidelines, and the Commission has not set time frames for itself,  primarily because it has been working on guidelines for current voting  systems. Additionally, as stated previously, the Commission has not  completed the precursor Internet voting study to identify critical issues  and challenges such as those related to security and privacy. Also, it has  not established a plan, in conjunction with major stakeholders like DOD,  to develop appropriate guidelines for Internet voting with specific tasks  that would address security risks such as those identified in its study and  other security evaluations and reports, as well as time frames and  milestones.
In previous reports, we have noted that leading organizations develop  long-term results-oriented plans that involve all stakeholders and identify  specific tasks, milestones, time frames, and contingency plans; this  practice is also embodied in the underlying principles of the Government  Performance and Results Act of 1993. Similarly, without a plan for the  UOCAVA Internet absentee voting guidelines—including specific tasks,  time frames, milestones, necessary resources, and alternatives—the  Commission cannot inform Congress, FVAP, and local election officials  when it will meet the mandate to develop the required guidelines. As we  previously noted, some technologies may not yet be mature enough to  support Internet voting. Therefore, the plan for developing Internet  absentee voting guidelines may require an incremental approach that  reflects emerging solutions to security and privacy challenges, as well as  changing views on acceptable levels of risk and cost.
section_title: DOD Has Not Developed a Secure, Internet-based, Absentee Voting Demonstration Project
paragraphs: Similarly, DOD has not developed a secure, Internet-based absentee voting  demonstration project, as Congress mandated in the Ronald W. Reagan  NDAA for Fiscal Year 2005. DOD reported that the principal objective of  the Internet-based electronic demonstration project was to assess the use  of such technologies to improve UOCAVA participation in elections. The  department planned to conduct the project during the first general  election for federal office after the Commission has established Internet  voting guidelines for the project. However, DOD has not moved forward  with the electronic demonstration project because, by law, the  Commission must first develop the Internet absentee voting guidelines.
DOD officials stated, as mentioned previously, that they provided  information to assist the Commission in developing the guidelines, and  Commission officials acknowledged that DOD had provided them with a  report on “Voting Over the Internet,” DOD’s assessment of its November  2000 Internet-based voting project, in 2004—the first year of the  Commission’s operation. DOD also provided the Commission with an  internal document that contained information on its SERVE project.  However, Commission officials told us that they did not receive the  SERVE document until June 2006. This document discussed challenges  DOD identified with Internet voting, which included security threats such  as computer viruses, malicious insider attacks, and inadvertent errors that  could disrupt system performance.
In 2001, we also identified several challenges to Internet voting, such as  privacy and security. As previously mentioned, we reported that broad  application of Internet voting faced formidable challenges, including the  difficulty of providing adequate voter privacy—that is, protecting the  voter’s ability to cast a ballot without being observed. We further reported  that, although not unanimous on all issues, groups considering the pros  and cons of Internet voting were in consensus in identifying security as the  primary technical challenge for Internet voting. We also reported that,  because of the security risks involved, Internet voting would not likely be  implemented on a large scale in the near future. Moreover, DOD officials  told us that even if the Commission had developed Internet voting  guidelines at the time of our review, DOD would not have been able to  develop a secure, Internet-based, electronic demonstration project in time  for the 2008 presidential election. DOD officials said that—depending on  the Internet voting guidelines provided by the Commission—the final  system design, full development, testing and deployment phases would  take an estimated 24 to 60 months. Furthermore, deployment of any  system requires participation of the military services, which have many  additional, competing priorities that may cause delays in deployment.  Given that less than 17 months remain before the November 2008 election,  FVAP officials said there is insufficient time to advertise and launch the  Internet-based electronic demonstration project.
section_title: DOD Was Developing Plans to Expand the Use of Electronic Voting Technology in the Future, but Sound Management Practices Are Key
paragraphs: We observed that DOD was developing, but had not yet completed, plans  to expand the use of electronic voting technology for UOCAVA voters use  in federal elections through November 2010, as required by the John  Warner NDAA for Fiscal Year 2007. DOD officials told us that they  anticipated providing the plans to Congress, in accordance with the act, by  May 15, 2007. Because electronic voting initiatives for the absentee voting  process (fax, e-mail, and Internet) involve numerous stakeholders at the  federal level—including DOD and the Commission—as well as the various  state and local levels, developing a plan is key. Implementation of new  electronic voting initiatives requires careful planning, particularly in light  of the remote location of troops, the application of new technology, and  the lead time required for implementation. As DOD develops these plans,  employing a comprehensive strategic approach that incorporates sound  management principles could provide a framework for DOD’s plans. Our  analyses of DOD and Commission documents and our interviews— including those with officials from these agencies, organizations  representing UOCAVA voters, and state and local election officials—show  that DOD did not obtain sufficient stakeholder involvement in planning its  recent electronic voting initiatives—the 2004 and 2006 IVAS initiatives. In  fact, Commission officials mentioned that DOD’s recent initiatives took a  “top down” approach and did not seek input from the Commission or from  local jurisdictions during the planning stage. DOD officials noted that both  the 2004 and 2006 IVAS initiatives were planned, designed, advertised, and  implemented just months before those two elections. In the case of the  2006 IVAS, however, the department reported that it developed the system  within 79 days of passage of the mandate—June 2006—and noted that it  was in fact responsive to that mandate. The Commission and state and  local election officials noted that the aggressive schedules for these latest  electronic initiatives did not allow sufficient time to enable full  participation, training, and dissemination of information on the efforts.  Additionally, at the time of our review, DOD officials said they had not yet  established interim tasks that address issues such as security and privacy,  milestones, time frames, and contingency plans.
The principles of sound management used by leading organizations and  embodied in the Government Performance and Results Act of 1993  provide a methodology to establish a results-oriented framework for DOD  to develop its detailed plans. Such a framework would provide a firm  foundation for DOD’s long-term plan for electronic voting initiatives. Some  of the key management principles include (1) involving stakeholders when  defining the mission and outcomes, (2) identifying specific actions and  tasks, such as monitoring and assessing security of the initiatives,   (3) developing schedules and time frames for tasks, and (4) evaluating the  overall effort, with specific processes to allow for adjustments and  changes. Furthermore, as we reported in one of our executive guides,  leading organizations plan for a continuous cycle of risk management. This  includes determining needs, assessing security risks, implementing  policies and controls, promoting awareness, and monitoring and  evaluating controls. Combined with effective leadership, these principles  provide decision makers with a framework to guide program efforts and  the means to determine if these efforts are achieving the desired results.
In its December 2006 report to Congress on IVAS, DOD stated the  following:    Development of a long-term strategic plan was necessary to ensure that all  related initiatives were effectively integrated, but this was dependent on  having sufficient time to assess, improve, and evaluate new or evolving  electronic alternatives.
Major recommendations for its future electronic voting projects would  include, for example,  recognizing the variation in state and local laws, procedures, and  systems;  identifying and mitigating actual and perceived risks, by educating  people about risk management practices; and    building consensus among key stakeholders.
As stated previously, Commission officials told us that, for recent  initiatives, DOD did not seek input from the Commission or local  jurisdictions during the planning stage of these efforts. Without a  proactive, integrated, long-term, results-oriented plan that involves all  major stakeholders; includes goals, interim tasks—such as identifying  security risks and addressing privacy concerns—milestones, time frames,  and contingency plans; and follows the sound management practices used  by leading organizations, DOD is not in a position to address congressional  expectations to establish secure and private electronic and Internet-based  voting initiatives.
section_title: Conclusions
paragraphs: It is imperative that the 6 million Americans who are covered under the  Uniformed and Overseas Citizens Absentee Voting Act have the  opportunity to exercise their right to vote—one of the hallmarks of a  democratic society. The fact that time is an issue with absentee voting by  regular mail has led many to look toward electronic and Internet voting,  which represent the next generation of voting technology, as alternatives.  While these alternatives may expedite the absentee voting process, they  are more vulnerable to privacy and security compromises than the  conventional methods now in use. Electronic and Internet voting require  safeguards to limit such vulnerabilities and prevent compromises to votes  from intentional actions or inadvertent errors. However, available  safeguards may not adequately reduce the risks of compromise. To date,  the Election Assistance Commission has not assessed the risks or possible  safeguards for Internet voting, nor has it developed corresponding  guidelines that define minimum Internet voting capabilities and safeguards  to be considered by the election community. Furthermore, electronic and  Internet-based absentee voting can be challenging for UOCAVA voters,  who reside at multiple locations across the globe. These voters are also  registered to vote in thousands of local jurisdictions across 55 states and  territories that employ varying levels of technology—from paper ballots to  faxes and e-mail. DOD faces significant challenges in leveraging electronic  and Internet technology to facilitate this complex, global absentee voting  process. Delays in developing guidelines and a demonstration project have  resulted in two presidential elections passing without significant progress  in moving toward expanded use of electronic and Internet absentee voting.  DOD officials told us it is now too late in the cycle to implement  significant changes before the 2008 election. The challenges of  coordinating among numerous stakeholders—including DOD, the  Commission, and state and local election officials, as well as organizations  representing UOCAVA voters—are substantial, and, to date, efforts to  involve stakeholders in the planning stage of DOD’s recent initiatives have  fallen short. This delay has left an expectation gap between what Congress  required and what has been accomplished so far. Several steps would have  to be taken to overcome these challenges, including better coordination  between the Commission and DOD regarding their complementary roles in  developing Internet voting guidelines and the mandated demonstration  project. Unless the Commission and DOD move in a timely manner to  assess the technology risks, develop guidelines that address the risks,  coordinate among election stakeholders, and establish and execute  prudent plans, they are unlikely to meet the expectations of Congress and  military and overseas voters to establish a secure and private electronic  and Internet-based UOCAVA voting environment.
section_title: Recommendations for DOD
paragraphs: To improve the security and accuracy of DOD’s electronic and Internet  initiatives, we recommend that the Secretary of Defense direct the Under  Secretary of Defense for Personnel and Readiness to take the following  four actions:    Comply with the information security requirements in the DOD  Certification and Accreditation Process guidance.  Incorporate lessons learned into plans for future systems such as those we  identified, including adding cautionary statements to future ballot request  and receipt systems to warn UOCAVA voters to remove personal data  from their computers.  Institutionalize a process to review online UOCAVA guidance to ensure  that DOD provides accurate and consistent information to UOCAVA  voters.
Create an integrated, comprehensive, long-term, results-oriented plan for  future electronic voting programs that specifies, among other things, the  goals to be achieved along with tasks including identifying safeguards for  the security and privacy of all DOD’s voting systems—both electronic and  Internet. The plan should also specify milestones, time frames, and  contingencies; synchronize them with planned development of the  Commission’s guidelines for Internet voting; and be developed in  conjunction with major stakeholders—including state and local election  officials, the Election Assistance Commission, overseas voting groups, and  each of the armed services. The plan should also include initiatives that  will be done well in advance of federal elections, to allow adequate time  for training and dissemination of information on the options available to  UOCAVA voters.
section_title: Recommendations for the Election Assistance Commission
paragraphs: To improve the Election Assistance Commission’s efforts to comply with  the direction from Congress to develop the Internet absentee voting  guidelines, we recommend that the Commission take the following two  actions:    Determine, in conjunction with major stakeholders like DOD, whether the  Commission’s 2007 Internet voting study and any other Commission  efforts related to Internet or electronic voting are applicable to DOD’s  plans for Internet-based voting, and incorporate them where appropriate.    Develop and execute, in conjunction with major stakeholders—including  state and local election officials and DOD—a results-oriented action plan  that specifies, among other things, goals, tasks, milestones, time frames,  and contingencies that appropriately address the risks found in the  UOCAVA voting environment—especially risks related to security and  privacy.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report, DOD concurred with our  recommendations to (1) comply with the information security  requirements, (2) incorporate lessons learned into plans for future  systems—to include adding cautionary statements to warn UOCAVA  voters to remove personal data from their computers, (3) institutionalize a  process to review online UOCAVA guidance, and (4) create a  comprehensive, results-oriented, long-term plan for future electronic  voting initiatives.  The department said that it will contract for services to  comply with the information security requirements and will incorporate  identified lessons learned into future registration, ballot request, and ballot  receipt systems.  The department said that it has already streamlined its  online guidance by, among other things, eliminating the archived  “Publications” version of the Voting Assistance Guide entirely; it will also  establish a revised review process for online information.  DOD noted that  these changes will reduce the possibility of human error and simplify the  review and verification process of online information.  Finally, DOD stated  that it was in full support of a long-term, comprehensive plan for future  electronic voting projects that would allow for sufficient time to involve  the major stakeholders, train, and disseminate information and ultimately  serve UOCAVA voters.  The department said it looked forward to working  on this multiyear project plan in cooperation with the Election Assistance  Commission, the National Institute of Standards and Technology, and  other major stakeholders.  It further stated that FVAP, the Commission,  and the National Institute of Standards and Technology are scheduling a  meeting to lay the groundwork for the plan. DOD’s comments are  reprinted in appendix III.  DOD also provided technical comments, which  we incorporated in the final report, as appropriate.
In its written comments, the Election Assistance Commission concurred  with our recommendations to (1) determine the applicability of the  Commission’s 2007 Internet voting study and other Commission studies to  DOD’s plans for Internet-based voting, and (2) develop and execute a  results-oriented action plan to provide guidelines that appropriately  address the risks found in the UOCAVA voting environment. The  Commission stated that it has already met with FVAP and the National  Institute of Standards and Technology and agreed to develop a time line  for creating the UOCAVA guidelines. The Commission’s comments are  reprinted in appendix IV.
We are sending copies of this report to the Secretary of Defense and the  Under Secretary of Defense (Personnel and Readiness) and the  Commissioners of the Election Assistance Commission. We will also make  copies available to others upon request. In addition, the report will be  available at no charge on the GAO Web site at http://www.gao.gov.
Should you or your staff have any questions about this report, please  contact me at (202) 512-5559. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report are listed in appendix V.
section_title: Appendix I: Scope and Methodology
paragraphs: To assess DOD’s electronic initiatives, we reviewed and analyzed relevant  laws, directives, and guidance. These included DOD Directive 1000.4,  Federal Voting Assistance Program (FVAP), updated April 14, 2004; and  DOD’s Interim Department of Defense (DOD) Certification and  Accreditation (C&A) Process Guidance, dated July 6, 2006. We also  reviewed applicable requirements documents for DOD’s electronic efforts,  as well as relevant reports by GAO, DOD, FVAP, the DOD Inspector  General, and others, including A Security Analysis of the Secure  Electronic Registration and Voting Experiment (SERVE), dated January  21, 2004. In addition, we reviewed FVAP’s 2006-2007 Voting Assistance  Guide and its Web site to ascertain what type of information on electronic  voting alternatives is provided to UOCAVA citizens.
We interviewed key program officials at the Office of the Under Secretary  of Defense for Personnel and Readiness’s Federal Voting Assistance  Program (FVAP), the Business Transformation Agency, the Defense  Manpower Data Center, and Voting Action Officers from several service  headquarters. We also contacted officials from (1) election organizations,  including the National Association of Secretaries of State and Joint  Election Officials Liaison Committee and (2) organizations representing  UOCAVA voters, including those from the National Defense Committee  and the Overseas Vote Foundation. We made contact with officials from   14 of the 16 state and local election offices we called to obtain their  perspectives on DOD’s initiatives. Specifically, we included all 11 states  that had participated in DOD’s 2006 Integrated Voting Alternative Site— some of which participated in SERVE and other DOD programs and  initiatives. We also included three other states that had 10 or more military  bases and had participated in SERVE though not in IVAS. Table 3 lists the  states we contacted and the programs in which these states participated.
To determine the Commission’s efforts to develop Internet voting  guidelines and DOD’s efforts to develop the secure, Internet-based,  absentee voting demonstration project, we reviewed and analyzed relevant  laws, Commission reports, and to the extent they existed, the  Commission’s strategic plan and other documents to ascertain its plans  and efforts to develop Internet voting guidelines for UOCAVA voters. We  also reviewed and analyzed various DOD requirements documents, GAO  reports, internal DOD reports, and other reports related to DOD’s prior  Internet-based absentee voting initiatives—Voting Over the Internet and  SERVE—to ascertain, among other things, challenges and benefits  associated with Internet voting efforts. Additionally, we interviewed key  program officials within FVAP, including the Director and Deputy Director  of FVAP and the Project Manager for SERVE, who is currently retired,  along with officials on DOD’s private sector Security Peer Review Group.  We also spoke with officials on the Commission’s Technical Guidelines  Development Committee and with the National Institute of Standards and  Technology.
To ascertain DOD’s efforts to develop plans to expand the use of  electronic voting technologies in the future, we reviewed and analyzed  laws, guidance, and reports to determine DOD’s current and future plans  for the Internet-based absentee voting demonstration project. Additionally,  we examined, to the extent they existed, DOD’s strategic plan and other  documentation to determine its current and future plans for the Internet- based absentee voting demonstration project. We also interviewed  responsible officials within DOD about these plans—including the  Principal Deputy Under Secretary of Defense for Personnel and Readiness  and the Director and Deputy Director of FVAP.
We conducted our work from August 2006 through April 2007 in  accordance with generally accepted government auditing standards.
section_title: Appendix II: Examples of the Inconsistent Voting Assistance Guidance on DOD’s Web Site
paragraphs: During the course of our review, we compared and analyzed the voting  assistance guidance provided on DOD’s Federal Voting Assistance  Program (FVAP) Web site that covered electronic alternatives to mail. The  online links we reviewed included FVAP’s: (1) 2006-2007 Voting Assistance  Guide (VAG)—a PDF version; (2) 2006-2007 VAG—an HTML version;    (3) the archived 2006-2007 VAG—a PDF version dated October 25, 2005;  (4) changes to the archived 2006-2007 VAG—called Errata Sheets;   (5) News Releases; and (6) the 2006 Integrated Voting Alternative Site  (IVAS). While not widespread, for 14 of the 55 states and territories, we  found differences in some of the guidance provided on these links. Table  4 shows the differences we identified.
section_title: Appendix III: Comments from the Department of Defense
section_title: Appendix IV: Comments from the Election Assistance Commission
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: Acknowledgments
paragraphs: In addition to the individual named above, David E. Moser, Assistant  Director; Marion A. Gatling; Pawnee A. Davis; Amber M. Lopez; Joanne  Landesman; Paula A. Moore; John K. Needham, John J. Smale; and Julia C.  Matta made key contributions to this report.
section_title: Related GAO Products
paragraphs: Elections: All Levels of Government Are Needed to Address Electronic  Voting System Challenges. GAO-07-576T. Washington, D.C.: March 7, 2007.
Elections: DOD Expands Voting Assistance to Military Absentee Voters,  but Challenges Remain. GAO-06-1134T. Washington, D.C.: September 28,  2006.
Elections: The Nation’s Evolving Election System as Reflected in the  November 2004 General Election. GAO-06-450. Washington, D.C.: June 6,  2006.
Election Reform: Nine States’ Experiences Implementing Federal  Requirements for Computerized Statewide Voter Registration Lists.  GAO-06-247. Washington, D.C.: February 7, 2006.
Elections: Views of Selected Local Election Officials on Managing Voter  Registration and Ensuring Eligible Citizens Can Vote. GAO-05-997.  Washington, D.C.: September 27, 2005.
Elections: Federal Efforts to Improve Security and Reliability of  Electronic Voting Systems Are Under W ay, but Key Activities Need to Be  Completed. GAO-05-956. Washington, D.C.: September 21, 2005.
Elections: Additional Data Could Help State and Local Elections  Officials Maintain Accurate Voter Registration Lists. GAO-05-478.  Washington, D.C.: June 10, 2005.
Department of Justice’s Activities to Address Past Election-Related  Voting Irregularities. GAO-04-1041R. Washington, D.C.: September 14,  2004.
Elections: Electronic Voting Offers Opportunities and Presents  Challenges. GAO-04-975T. Washington, D.C.: July 20, 2004.
Elections: Voting Assistance to Military and Overseas Citizens Should  Be Improved. GAO-01-1026. Washington, D.C.: September 28, 2001.
Elections: The Scope of Congressional Authority in Election  Administration. GAO-01-470. Washington, D.C.: March 13, 2001.