Cable Forum - View Single Post

**Hugh** · Today, 13:42

There’s a lot of independent testing of the Boting Machines at Federal and Statelevel…

https://www.eac.gov/sites/default/fi...States_508.pdf

Quote:

Overview of Voting Systems Testing and Certification in the United States

Voting System Certification
A voting system is considered EAC-certified when it: has been tested by a federally accredited test laboratory; has successfully met the requirements of the VVSG and any other claims made by the voting system manufacturer; and has undergone vulnerability review and penetration testing for machines tested pursuant to volume three or later of the EAC testing program manual, and the
EAC has issued a certificate that all the steps required of the lab and the manufacturer have been completed.

The EAC accredits independent test laboratories (voting system test laboratories or VSTLs) that evaluate voting systems, including their software, against the VVSG to determine if they provide all of the basic functionality, accessibility, and security capabilities required of these systems. The test laboratory provides a recommendation to the EAC through a test report which is reviewed by the Testing and Certification team. Once documentation demonstrating the successful completion of the requirements have been met by the system and all steps have been completed by the lab and manufacturer, the Testing and Certification Program Director issues a recommendation to the Decision Authority who determines whether to issue a certification. Once a decision has been made, the EAC will post the information on the Voting System Certification section of the EAC website.

Before final certification is granted, the VSTL must deliver specified elements to the EAC repository, including the source code used for the trusted build and its file signatures, a detailed description of the build environment including setup and configuration, executable code, and all documentation to provide evidence to verify that a particular system has met all requirements.

In addition to system certifications, the EAC also processes minor change orders.

These are minor changes to a previously EAC-certified system, such as updating end-of-life commercial hardware components or applying security patches.

State Testing and Certification Programs
Although the VVSG and the EAC’s Testing and Certification Program are not mandatory, many states require their use through statute or rule. Since states have different requirements for voting systems, the EAC’s programs are not a substitute for state-based requirements and testing. Many states use the VVSG or the EAC’s Testing and Certification Program as a baseline while adding their own requirements and testing protocols. Most states require the use of EAC-accredited test laboratories for any certification testing performed at the state level.

There are several ways states use the VVSG and the EAC’s Testing and Certification Program, including:
• Requiring voting systems to be EAC-certified. Tennessee, for example, specifies “All new precinct-based optical scanners purchased
or leased pursuant to this chapter shall be certified pursuant to §2-9-110 and shall have been certified by the Election Assistance Commission as having met the applicable voluntary voting systems guidelines” (Tenn. Code Ann. § 2-20-104). In Ohio, “any voting machine, marking device, or automatic tabulating equipment used in this state shall meet, as a condition of continued certification and use, the voting system standards adopted by the federal election commission in 2002 or the voluntary voting system guidelines most recently adopted by the federal Election Assistance Commission. A voting machine, marking device, or automatic tabulating equipment initially certified or acquired on or after Dec. 1, 2008, also shall have the most recent federal certification number issued by the Election Assistance Commission” (Ohio Rev. Code Ann. § 3506.05).

• Requiring voting systems to be tested to the VVSG or federal standards. Kentucky requires vendors seeking to sell a voting system in the state to request examination from the State Board of Elections before entering the market and include a report that shall “demonstrate that the voting system meets all Election Assistance Commission standards” (Ky. Rev. Stat. Ann. § 117.379). Maryland requires a voting system to be “examined by an independent testing laboratory that is approved by the U.S. Election Assistance Commission; and shown by the testing laboratory to meet the performance and test standards for electronic voting systems established by the Federal Election Commission or the U.S. Election Assistance Commission” (Md. Code Ann. Elec. Law § 9-102).
• Requiring voting systems to be tested by federally accredited test labs. Arizona, for example, specifies that “machines or devices used at any election for federal, state or county offices may only be certified for use in this state and may only be used in this state if they comply with the Help America Vote Act of 2002 and if those machines or devices have been tested and approved by a laboratory that is accredited pursuant to the Help America Vote Act of 2002” (Ariz. Rev. Stat. Ann. § 16-442). Idaho law states, “Except for functions or capabilities unique to this state, voting machines and vote tally systems shall be tested by a voting system testing laboratory prior to the examination of voting machines and vote tally systems by the secretary of state” (Idaho Code Ann. § 34-2409).
Forty-one states require some aspect of the federal testing and certification program. Some of these states require full EAC certification, while others require testing to federal standards or testing by a federally accredited laboratory. For more information on state requirements, view the chart starting on page 9.

Some states do not use the federal program but have robust state-based standards, as well as testing and certification programs. California law, for example, requires that the Secretary of State adopt and publish voting system standards that meet or exceed federal voluntary voting system guidelines. State-level certification includes testing and examination by a state-approved testing agency or expert technicians. In Florida, the Bureau of Voting Systems Certification within the Department of State is responsible for voting system standards and certification. And some states partner with universities to conduct certification and testing of voting equipment. For example, in Indiana, Ball State University’s Voting System Technical Oversight Program advises the secretary of state on the certification of voting systems (Ind. Code § 3-11-16-4).