Election Systems and Software (ES&S) iVotronic

ES&S iVotronicThe ES&S iVotronic is a direct recording electronic voting system with a touch screen interface that records votes on internal flash memory. A poll worker uses a device called a Personal Electronic Ballot (PEB; pictured above at left) to turn the machine on and enable voting. Voters choose their ballot language and then make their selections using a touch screen, much in the same way that modern ATMs work. When the polls close, poll workers move summary data from each machine onto the PEB. The PEBs are then transported to election headquarters or their contents transmitted via a computer network.

The iVotronic uses two distinct types of iVotronic terminals, distinguished by colored inserts along the sides: red supervisor terminals and blue voter terminals. Both types of iVotronic terminals are activated using PEBs, which are also used to store ballot definitions and election results. PEBs are typically programmed via a supervisor terminal at the start of an election, and read using either a supervisor terminal or a dedicated PEB Reader connected to the machine running the Election Reporting Manager at the end of an election. A PEB can be used in multiple iVotronics as long as they are qualified for the same election and polling place. The voter iVotronics also use Compact Flash cards to store large ballots, audio ballots, and election result audit files. A separate Communication Pack is connected to iVotronic terminals at the start and end of elections to print zero count tallies and precinct results on a separate printer with removable paper.

RTAL_2Checking the Voter-Verifiable Paper Trail: The iVotronic has an optional voter-verifiable paper trail printer, known as the Real-Time Audit Log (RTAL). States such as Ohio, West Virginia, and North Carolina require the RTAL by law, while iVotronics in South Carolina, Texas, and Pennsylvania do not have this option. The RTAL printer is a reel-to-reel cash-register type of printer under transparent plastic, and is located just to the left of the touch screen (pictuted above right). The RTAL records all of the voter’s actions, so if a voter changes her mind about a race on the ballot, the RTAL records both the initial choice and the final choice.

While all other voter-veriable paper trail schemes wait to print the paper record until the voter has completed the entire ballot, the ES&S RTAL prints each selection at the time it is made. Thus, whenever a voter touches the screen to select a candidate, the printer immediately prints that selection. The advantage is immediate feedback to the voter, if the voter happens to watch the printout. The disadvantage is that in the event the voter makes any changes, all the voter’s previous selections have been retained. In a recount or audit of the paper records, only the last vote recorded for each race should be counted. The inclusion of prior selections can make ballot verification of RTALs challenging for voters, and manual counting of RTALs even more difficult for election officials.

The RTAL also does not provide the voter with the opportunity to review all their selections on the paper record at the end of the voting process, as by that point the paper has spooled out of view. With this system it is important that the voter check the paper record throughout the voting process.

Voting Process: When the voter enters the polling place, a poll worker first confirms the voter is registered. Then the poll worker walks with the voter to an iVotronic and inserts the PEB in the PEB slot (visible as the rectangular slot in the upper left corner of the middle image above). The PEB communicates with the iVotronic using infrared signals, much like a TV remote control works, except that the PEB and iVotronic will not communicate unless the PEB is completely inserted. If the election requires a party-specific ballot, the poll worker chooses this for the voter. Activation by the PEB enables the iVotronic to vote once.

The voter then selects a ballot language and makes decisions using the touchscreen. When the voter is done, he or she presses a small “vote” button at the very top of the iVotronic to cast the vote. The vote is then recorded to three internal flash memories that reside inside the machine. A fourth memory is a removable card, called a “compact flash” (CF) card; note that CF is the same technology used in many digital cameras to store photos. During the election, the CF card holds audio files (for those with visual disabilities) and ballot definitions; vote data is written to the CF card when the machine is closed.

A poll worker closes the polls by using the PEB with a password to enter a supervisor menu on each iVotronic. After closing the election for a given machine, summary vote data is transmitted to the PEB via infrared signals. After the PEB is used to close all the iVotronic machines, it contains all the summary data for the precinct. Depending on local regulations and procedures, poll workers can use a “printer kit” at this point to print the result summary from the PEB on to paper. The PEB for that precinct, any printouts and the CF cards are then either physically transported to a central tabulation facility or its contents sent over a computer network using a laptop running ES&S’ Unity software.

A Voting Demo of the ES&S iVotronic

A Voting Demo produced by Escambia County FL:

Security Concerns

iVotronic_PEBThe PEB slot on the face of the iVotronic is particularly sensitive. The EVEREST study showed that a voter with a magnet and a properly programmed PDA (with an infrared port) could gain privileged access to the sensitive functions of the machine. If you see anyone spending a long time in an iVotronic voting booth and engaging in activity that appears to be centered around the upper-left part of the iVotronic, they might be messing with the PEB slot.  Of course, they might also just be voting, so don’t cry wolf.

The VVPAT printer (RTAL printer) is connected to the iVotronic via a cable that is connected to the top of the machine. This cable, unless the jurisdiction has purchased special cables or connectors, can be disconnected by a voter and various types of mischief could be performed (from printing extra VVPAT records to messing with the internals of the iVotronic). If you observe anyone disconnecting this cable, alert the pollworkers immediately. If a pollworker is disconnecting this cable, it should only be to swap out a printer and you should be able to observe the whole process.

An attacker who gains access to a PEB for a short or extended period of time can change votes on the PEB or attack the central Election Management System when the PEB is returned to election headquarters. PEB devices should only be handled by pollworkers and pollworkers should keep a vigilant watch over their use of the PEBs throughout the day (that is, they should not be leaving them around casually and the area in which the PEBs are kept should be secure and monitored at all times).

Background1

Votronic

The Votronic

Shelby Thomas, president of a small Virginia election services company Election Products Inc., had the idea for the machine in the early 1990’s. He took his idea to a local engineering consulting rm, ILJ Corporation, of Richmond. By 1993, John Davis, president of ILJ, had delivered a prototype, and Davis and Thomas applied for a patent the next year. The Votronic included an innovative new cartridge, the Personal Electronic Ballot (PEB), used to communicate setup information to the machine before the election and to accumulate results at the close of the polls. The PEB was not a passive memory device; rather, it was a small computer system, not much larger than a pack of cigarettes, containing a battery, a microcontrollery, and non-volatile memory. When inserted in its dock on the front of the Votronic, the PEB used infrared light to establish a very short-range network connection with the machine. The developers thought of the PEB as the electronic analog of a ballot; they viewed the machine in the voting booth as the electronic analog of a pencil for marking the ballot. The inventors intended the poll workers to hand PEBs to voters as they signed into the polling place. In practice, pollworkers usually escorted each voter to the machine and used the PEB to activate the machine, before turning it over to the voter.

Shortly after Election Systems and Software (ES&S) was formed by the merger of American Information Systems and Business Records Corporation, ES&S acquired the rights to the Votronic. With its national sales and marketing force, ES&S gained immediate traction selling the system, and it began to invest in updating the design, redesigning the packaging, and adding features supporting broader access for voters with disabilities. The new system was sold as the iVotronic, but in dealings with states that had already certi ed the Votronic, ES&S emphasized that the changes were cosmetic. New Jersey did not even require recerti cation of the new package.

  1. Douglas W. Jones and Barbara Simons, Broken Ballots, 2012