Hart Intercivic eSlate

The Hart InterCivic eSlate is a direct recording electronic voting system where the voter turns a Select Wheel and pushes a button to indicate her preferences. The eSlate is connected via cable to the Judge’s Booth Controller (JBC; image above) which provides vote activation and vote storage for up to twelve eSlates. A poll worker issues a four digit, randomly generated Access Code to the voter using the JBC. The voter enters the Access Code on the eSlate and votes using the select Wheel and Buttons. Once the ballot is cast, the votes are stored in redundant and physically separate areas of the eSlate System, including the eSlate, JBC and flash memory. The votes are transmitted via a cable to the JBC, and are stored on the JBC and on a flash memory card (Mobile Ballot Box or MBB) inside the JBC. Then the MBB is physically transported to election headquarters for tabulation.

The eSlate consists of a screen and below it a wheel and 5 buttons. The voter highlights choices by turning the wheel until the proper area of the screen is marked. The wheel may be rotated to highlight individual contests or options. The SELECT button is used to select or de-select the voter’s choices. The PREV and NEXT arrow buttons move the voter backward and forward through available pages, respectively. The HELP button provides on-screen assistance or summons a poll worker to help the voter. The CAST BALLOT button advances the voter to/through the vote review and acceptance steps and finalizes the voter’s selection data to cast the voter’s ballot.

The eSlate can also be adapted to run in an accessible mode, called a DAU. The eSlate DAU has the eSlate functionality, but with different hardware inputs and a PCMCIA card storing locally recorded ballot information for audio output. The eSlate can take input from jelly switches or a sip-and-puff device. An audio recording of a human reading of the ballot is stored on the DAU audio card as part of the ballot creation process; the system does not use a speech synthesizer.

To the right of the eSlate are directions for using the equipment. Above the printer and eSlate is a compartment that runs the width of the voting booth. Note that the eSlate is not a touch screen voting system; the voter uses the wheel and buttons only. Up to 12 eSlates can be daisy-chained together. In the top compartment is a cable that runs from the eSlate to the next eSlate in the daisy chain. Otherwise (or if this eSlate is the last one in the chain) the cable can be stored in the compartment. Above the compartment, on the lid of the voting booth, is a Nylon fabric privacy screen. When set up for use, the privacy screen is unfolded to obstruct the view of the voter voting, giving the voter privacy.1 

Hart eSlate ScreenVoting Process: When a voter enters the polling place, she registers as usual with a poll worker and signs her name into the poll book. If she wants to use the eSlate, a poll worker selects ”Add Voter” from the JBC’s main menu. The JBC produces a 4-digit access code, and the poll worker prints this access code for the voter on a small printout (looking like a traditional register receipt) with the date, time, location, precinct, and access code. The voter then goes to the eSlate, and ducks under a privacy screen that shields her actions from others’ views. The eSlate greets her with a welcome screen providing some basic instructions on how to operate the device. At this point, she has the option to navigate the eSlate using the wheel and buttons on the face of the device or to use an alternate input device. The eSlate is pre-equipped with two large buttons, called jelly switches, as an accessibility aid to those whose tactile skills do not lend easily to operating the eSlate with the embedded buttons. The jack into which these tactile inputs are plugged is a standard 3.5mm jack, allowing those who prefer to provide their own input device (such as a sip/puff device) to do so. Also available to the voter are a pair of standard headphones, or the option to plug in her own headphones, through which all operations on the eSlate will be narrated. This allows a voter with vision impairments to navigate the eSlate without assistance from a third party. The narration is given even if headphones are not used, but in that case the voter cannot hear the narration.

Once the voter has selected the input and feedback options best suited for her use of the eSlate, she is prompted to enter the access code she received from the poll worker. The eSlate verifies that the code is authorizedby communicating with the attached JBC. After her access code has been verified, eSlate displays the first page of the ballot. The voter can navigate through the ballot at her own speed by manipulating the wheel and buttons, or an assistive device. Once the voter has filled out the ballot to her satisfaction, she advances to the first ballot verification screen. If she makes a selection for every option on the ballot, she will be automatically advanced to this screen; she can, however, hit the ”Cast Ballot” button to manually advance herself to cast a ballot with fewer selections.

The eSlate then displays the first ballot verification screen, called the Ballot Summary Page. A two-column table presents every ballot option and the voter’s selection for that option, including a listing of ”No Selection” where applicable, in the order in which the options appeared on the ballot. If the voter is using the headphones, the eSlate will read the ballot to the voter. She can choose to make changes to selected options, in which case the eSlate returns her to the ballot to change her selections. Or, she can choose to accept the ballot as is. In this case, she advances to a second verification screen. At this point, the contents of the ballot selections are printed on the VBO printer, which is situated directly next to the eSlate screen. The voter is encouraged to verify her selections both on the screen and on the paper ballot. A visually impaired voter will be unable to verify the printout, but the eSlate will again read the ballot selections over the audio channel for her verification. If she wants to change something, she can reject the ballot at this point. In this case, the eSlate has the VBO print ”BALLOT REJECTED” on the paper ballot, and a barcode indicating that the voter rejected the set of ballot selections immediately preceding. The eSlate then returns the voter to the original ballot to change her selections. The voter may reject two printed ballots. After that, by law, the voter must accept the third printed ballot.

Hart_VBOChecking the Voter-Verifiable Paper Trail: Some jurisdictions used Hart Intercivic eSlate DRE-Dial voting machines equipped a voter-verifiable paper trail called the Verified Ballot Option (VBO). The VBO printer is a reel-to-reel, cash-register style of printer. The VBO printout is found to the left of the display screen under glass. If the eSlate you are voting on is equipped with a VBO printer be sure to verify that your vote has been recorded correctly before casting your ballot.

After the voter reviews a ballot on the printout, accepting the ballot advances the paper to  ensure that the last voter’s choices are not visible to the next voter. Canceling the ballot or changing the contents prints a voided status notice below the ballot. After the voter has changed her ballot and selected “cast ballot”, another ballot is printed for review and  a barcode is written with the message “ballot accepted”. If the voter cancels their ballot more than the maximum number of permitted cancellations, the system forces the last ballot and VVPAT to be recorded. VVPATs that span multiple pages require the voter to inspect each page before scrolling to reveal subsequent pages. The VBO prints both human-readable text and machine-readable barcode. The barcode is a standard two-dimensional barcode that encodes the contents of the VVPAT and basic information about the election in which the vote was cast and the machine on which the ballot was cast. The Hart VVPAT can be configured with a serial number (called a “Ballot Key”) in order to detect duplicate ballots.2

When the voter accepts the ballot, the VBO prints ”BALLOT ACCEPTED” and a barcode directly below the human-readable printout of the voter’s selections. This barcode contains a machine-readable encoding of the ballot selections. The VBO then immediately spools the printed ballot out of sight so that the next voter cannot see it. Ballot acceptance also triggers a communication from the eSlate to the JBC to store the ballot contents. The vote is stored electronically on internal eSlate memory, internal JBC memory, and on a memory card known as the MBB (Mobile Ballot Box). The MBB is the primary record of the votes cast on an eSlate, and the data on the MBB is used to generate the results tabulated at the end of an election. At this point, the eSlate shows a blue screen that thanks the voter for voting, and displays a waving American flag. The voter instructions state that a voter knows her vote has been cast when she sees this flag. If she has been using the auditory feedback, she will hear a similar message through the headphones and will know that her voting process is complete.

A Voting Demon for the eSlate without VVPAT Printer:

 A Voting Demo for the eSlate with a VVPAT Printer:

Security Concerns

Security Seals Ideally, the eSlate’s and JBC’s exposed ports, memory card access areas and case seams would be covered with tamper-evident security seals. The integrity of these seals should be maintained at all times, and only breached under controlled, explained circumstances. Seals should be logged to maintain chain of custody of sensitive materials.

Cables Must Be Secured The eSlate system is daisy-chained system where the JBC controls multiple eSlate terminals. The places where the first cable connects to the JBC as well as the area on the top of each eSlate where two of these cables connect are particularly sensitive. The last eSlate on the “daisy-chain” – likely the eSlate farthest from the JBC – is especially sensitive as it will have one cable coming from another eSlate, but will also have an exposed serial cable port. A malicious party could connect their own cable or device to this exposed port and essentially take control of the election, the software in the eSlate and JBC as well as vote data stored locally on each eSlate and remotely on the JBC. Ideally, this last exposed serial port will be covered or otherwise disabled. Jurisdiction should use security seals or protected serial cables that cannot be easily disconnected by voters (granted, this might make them difficult for poll workers to connect and disconnect).

VBO is Sensitive and Sealed The VBO, Hart’s VVPAT subsystem, is a sealed unit that stores official vote data. The unit should not be opened or serviced except infrequently under monitored and controlled circumstances so that all security seals are logged and reapplied. The entire VBO unit should be replaced when an error or jam occurs. The VBO, if jostled out of its place, can be made to interrupt or duplicate printing.

JBC and JBC Ports are Sensitive The JBC controller and the ports on the back of the JBC are sensitive. With access to the JBC, access codes can be printed out to allow duplicate voting. The ports on the back of the JBC should be covered or otherwise disabled. With access to these ports, a malicious party could take control of the election, activate arbitrary numbers of voter Access Codes, cast votes, erase votes and other things. Access to the JBC and to the area in the back of the JBC control panel where these ports reside should be monitored and controlled at all times.

MBB Memory Card is Sensitive Corrupt MBB cards can introduce viruses, cause the main election server to crash and falsify votes. Access to the MBB memory card should be controlled, monitored and logged at all times.

Background3

In 1997, Neil McClure and Kermit Lohry led a patent application for a new networked voting machine. In conception, the network-based aspects of the machine were not very different from the Fidlar ES 2000, but it was a full-face push-button machine. Initially, the developers founded their own company, Worldwide Election Systems, to market the machine they named The Elector. When it came time to market their system, they needed a partner. Hart Information Services, an established Texas ballot printer, bought several small election companies in the late 1990s, including Worldwide, before reorganizing as Hart Intercivic.

With support from Hart, McClure and his associates redesigned their system using a at-panel display, producing the machine they dubbed the eSlate. The eSlate saw successful use in the 2000 presidential election in Tarrant County, Texas and several other counties. It attracted significant attention with its features supporting the needs of voters with disabilities. [918] A few months later, the inventors applied for a patent for the eSlate.

  1. An Analysis of the Hart Intercivic DAU eSlate“, USENIX 2007
  2. Documentation Review of the Hart Intercivic System 6.2.1“, Top to Bottom Review, California Secretary of State (2007)
  3. Douglas W. Jones and Barbara Simons, Broken Ballots, 2012