The Hart InterCivic eSlate is a direct recording electronic voting device. The eSlate is typically used in polling places that have implemented a fully electronic voting experience as an alternative to hand marked paper ballots. The eSlate electronic voting device allows voters to navigate through an electronic ballot presented on a display screen to mark their choices. After voters are finished marking all their preferred choices, the device presents a “summary page” that allows voters to double-check their choices on their ballot. If voters skip any contests, the screen indicates “No selection.” After voters have had the opportunity to review all choices on the summary page, they next “Cast Ballot,” which causes their choices to be recorded directly in the voting device’s electronic memory.

Although eSlate is an electronic device, it is not a touch screen. Instead, the eSlate’s interface is dominated by a rotary wheel marked “Select,” which the voter uses to navigate and highlight different choices, and an “Enter” button, to mark choices. The eSlate device includes additional tactile buttons to page forward and back, to request help, and to cast the ballot.

eSlate devices can also be configured to support additional accessible features for voters with disabilities. Machines that are configured as “disabled access units” or DAUs, permit voters with visual, dexterity, or cognitive impairments to mark choices using audio and/or alternatives to the Select Wheel, such as paddles, or sip-and-puff devices.

eSlate voting devices are typically set up in polling places in a “daisy chain” — like conntected Christmas lights —on a single long chain of connected cords. The chain of voting devices is, in turn, connected to a poll worker console called the Judge’s Booth Controller. After voters check in at the polling place, poll workers use the Judge’s Booth Controller to select the electronic ballot style that each voter needs. Poll workers also issue each voter a randomly generated, anonymous four-digit Access Code, which corresponds to each voter’s ballot style. To start an electronic voting session on an individual eSlate device, each voter simply inputs the Access Code, and the ballot is displayed.

In most jurisdictions, the eSlate is deployed as an electronic-only device, with no paper records of each voter’s choices. In this paperless configuration, at the conclusion of each voting session, the voter’s choices are recorded directly in the voting device’s memory. However, a minority of eSlate jurisdictions deploy the voting device with an attached voter-verifiable paper audit trail (VVPAT). This enclosed unit, which is installed alongside the eSlate screen, has a spool-to-spool paper record under a clear plastic window, which allows voters to verify their choices on paper before casting the ballot. Once the ballot is cast, the VVPAT advances the paper through the motorized spool until blank paper is displayed to protect the privacy of the voter’s choices. The paper records of all electronic ballots cast are stored in the self-enclosed VVPAT unit, which is retained by election officials in case a post-election audit or recount is necessary.

Individual eSlate devices do not have tabulating capabilities; instead, after the polls close, poll workers use the attached Judges’ Booth Controller to tabulate results from all eSlate devices in the attached daisy chain. The Judge’s Booth Controller consolidates the results and can print out the race results and other information on a paper tape (if configured to do so).

In 1997, Neil McClure and Kermit Lohry led a patent application for a new networked voting machine. In conception, the network-based aspects of the machine were not very different from the Fidlar ES 2000, but it was a full-face push-button machine. Initially, the developers founded their own company, Worldwide Election Systems, to market the machine they named The Elector. When it came time to market their system, they needed a partner. Hart Information Services, an established Texas ballot printer, bought several small election companies in the late 1990s, including Worldwide, before reorganizing as Hart InterCivic.

With support from Hart, McClure and his associates redesigned their system using an at-panel display, producing the machine they dubbed the eSlate. The eSlate saw successful use in the 2000 presidential election in Tarrant County, Texas and several other counties. It attracted significant attention with its features supporting the needs of voters with disabilities. A few months later, the inventors applied for a patent for the eSlate.

When a voter enters the polling place, they register as usual with a poll worker and sign their name into the poll book. If the voter wants to use the eSlate, a poll worker selects ”Add Voter” from the main menu on the Judge’s Booth Controller (JBC). The JBC produces a four-digit access code, which the poll worker prints for the voter on a small printout, which looks like a traditional register receipt. The printout includes the date, time, location, precinct, and voter’s access code. The voter then goes to the eSlate, and ducks under a privacy screen that shields their actions from others’ views. The eSlate greets the voter with a welcome screen and provides basic instructions on how to operate the device.

The voter has the option to navigate the eSlate using the wheel and buttons on the face of the device or to use an alternate input device. The eSlate is pre-equipped with two large buttons, called jelly switches, as an accessibility aid to those whose tactile skills do not lend easily to operating the eSlate with the embedded buttons. The jack into which these tactile inputs are plugged is a standard 3.5mm jack, allowing those who prefer to provide their own input device (such as a sip/puff device) to do so. Also available to the voter are a pair of standard headphones, or the option to plug in their own headphones, through which all operations on the eSlate will be narrated. This allows a voter with vision impairments to navigate the eSlate without assistance from a third party. The narration is given even if headphones are not used, but in that case the voter cannot hear the narration.

After the voter has selected the input and feedback options best suited for their use of the eSlate, the voter is prompted to enter the access code she received from the poll worker. The eSlate verifies that the code is authorized by communicating with the attached JBC. After the voter’s access code has been verified, the eSlate displays the first page of the voter’s ballot. The voter can navigate through the ballot at their own speed by manipulating the wheel and buttons, or an assistive device. Once the voter has filled out the ballot to their satisfaction, the voter advances to the first ballot verification screen. If the voter has made a selection for every contest on the ballot, the eSlate will automatically advance to this screen; the voter can also press the ”Cast Ballot” button to manually advance and cast a ballot with fewer selections.

The eSlate next displays the first ballot verification screen, called the Ballot Summary Page. A two-column table presents every ballot contest and the voter’s selection for that contest, including a listing of ”No Selection” where applicable, in the order in which the contests appeared on the ballot. If the voter is using headphones, the eSlate reads the ballot to the voter. The voter can choose to make changes to selections, in which case the eSlate returns the voter to the ballot make these changes. Or, the voter can choose to accept the ballot as-is. In this case, the voter advances to a second verification screen where the contents of the ballot selections are printed on the Verified Ballot Option (VBO) printer, which is situated directly next to the eSlate screen. The voter is encouraged to verify their selections both on the screen and on the paper ballot. A visually impaired voter will be unable to verify the printout, but the eSlate will again read the ballot selections over the audio channel for verification. If the voter wants to make a change, the voter can reject the ballot and the eSlate causes the VBO to print ”BALLOT REJECTED” on the paper ballot with a barcode indicating that the voter rejected the set of ballot selections immediately preceding. The eSlate then returns the voter to the original ballot to change their selections. The voter may reject two printed ballots; after that, by law, the voter must accept the third printed ballot.

Voting Instructions

1. Select your language using the Wheel to highlight the proper language and push Enter.
2. Use the Wheel to input the access code given to you when you registered. This access code can only be used once.
3. Select candidates by highlighting their names, and using the enter key to make a selection. Undo a selection by pressing enter again. To vote for a write-in candidate, touch the Write-In line and a keyboard will appear. Type in the name of the candidate using the Wheel; touch the Record Write-In button to continue.
4. Review your choices on the Review screen, touch Record Ballot to cast your vote.

Checking The Voter-Verifiable Paper Trail (VVPAT)

Some jurisdictions used Hart Intercivic eSlate DRE-Dial voting machines equipped with a voter-verifiable paper trail (VVPAT) called the Verified Ballot Option (VBO). The VBO printer is a reel-to-reel, cash-register style of printer. The VBO printout is found to the left of the display screen under glass. Voters using eSlates equipped with VBO printers should be sure to verify that their vote has been recorded correctly before casting the ballot.

After the voter reviews a ballot on the printout, accepting the ballot advances the paper to ensure that the last voter’s choices are not visible to the next voter. Canceling the ballot or changing the contents prints a voided status notice below the ballot. After the voter has changed their ballot and selected “cast ballot,” another ballot is printed for review and a barcode is written with the message “ballot accepted.” If the voter cancels their ballot more than the maximum number of permitted cancellations, the system forces the last ballot and VVPAT to be recorded. VVPATs that span multiple pages require the voter to inspect each page before scrolling to reveal subsequent pages. The VBO prints both human-readable text and machine-readable barcode. The barcode is a standard two-dimensional barcode that encodes the contents of the VVPAT and basic information about the election in which the vote was cast and the machine on which the ballot was cast. The Hart VVPAT can be configured with a serial number called a “Ballot Key” to detect duplicate ballots.

When the voter accepts the ballot, the VBO prints ”BALLOT ACCEPTED” and a barcode directly below the human-readable printout of the voter’s selections. This barcode contains a machine-readable encoding of the ballot selections. The VBO then immediately spools the printed ballot out of sight so that the next voter cannot see it. Ballot acceptance also triggers a communication from the eSlate to the JBC to store the ballot contents. The vote is stored electronically on internal eSlate memory, internal JBC memory, and on a memory card known as the Mobile Ballot Box (MBB). The MBB is the primary record of the votes cast on an eSlate, and the data on the MBB is used to generate the results tabulated at the end of an election. At this point, the eSlate shows a blue screen that thanks the voter for voting, and displays a waving American flag. The voter instructions state that the flag indicates to a voter that their vote has been cast. If the voter has been using the auditory feedback, they will hear a similar message through the headphones and will know that the voting process is complete.

A Voting Demo for the eSlate without VVPAT Printer

A Voting Demo for the eSlate with a VVPAT Printer

Hart InterCivic eSlate usage in 2022 (click map for details)

Resouces

Assessing the Usability of the Hart InterCivic eSlate During the 2016 Presidential Election (2017)
California Top to Bottom (T2B) Review (2007)
California Secretary of State Hart Intercivic Source Code Review (2007)
California Secretary of State Hart Intercivic Penetration Test Report
UC Berkeley Hart Intercivic Documentation Review (2007)
Ohio Secretary of State Evaluation and Validation of Election-Related Equipment, Standards and Testing (EVEREST) Review (2007)
EVEREST Hart Intercivic Executive Summary (2007)
EVEREST Hart Intercivic Technical Manager Report (2007)
EVEREST Hart Intercivic Technical Details Report (2007)
SysTest Labs Technical Report (2007)
An Analysis of the Hart Intercivic DAU eSlate (2007)

Security Seals

Ideally, the eSlate’s and JBC’s exposed ports, memory card access areas, and case seams are covered with tamper-evident security seals. The integrity of these seals should be maintained at all times and only breached under controlled, explained circumstances. Seals should be logged to maintain chain of custody of sensitive materials.

Cables Must Be Secured

The eSlate system is daisy-chained system where the JBC controls multiple eSlate terminals. The places where the first cable connects to the JBC as well as the area on the top of each eSlate where two of these cables connect are particularly sensitive. The last eSlate on the “daisy-chain” — likely the eSlate farthest from the JBC — is especially sensitive as it will have one cable coming from another eSlate, but will also have an exposed serial cable port. A malicious party could connect their own cable or device to this exposed port and essentially take control of the election, the software in the eSlate and JBC, as well as vote data stored locally on each eSlate and remotely on the JBC. Ideally, this last exposed serial port will be covered or otherwise disabled. Jurisdictions should use security seals or protected serial cables that cannot be easily disconnected by voters, which might make them difficult for poll workers to connect and disconnect.

Verified Ballot Option (VBO) Is Sensitive And Sealed

The Verified Ballot Option (VBO), Hart’s VVPAT subsystem, is a sealed unit that stores official vote data. The unit should not be opened or serviced except infrequently under monitored and controlled circumstances so that all security seals are logged and reapplied. The entire VBO unit should be replaced when an error or jam occurs. The VBO, if jostled out of its place, can be made to interrupt or duplicate printing.

Judge’s Booth Controller (JBC) And JBC Ports Are Sensitive

The Judge’s Booth Controller (JBC) controller and the ports on the back of the JBC are sensitive. With access to the JBC, access codes can be printed to allow duplicate voting. The ports on the back of the JBC should be covered or otherwise disabled. With access to these ports, a malicious party could take control of the election, activate arbitrary numbers of voter Access Codes, cast votes, erase votes, and other things. Access to the JBC and to the area in the back of the JBC control panel where these ports reside should be monitored and controlled at all times.

Mobile Ballot Box (MBB) Memory Card Is Sensitive

Corrupt MBB cards can introduce viruses, cause the main election server to crash, and falsify votes. Access to the MBB memory card should be controlled, monitored, and logged at all times.