Elections
Action Plans Needed to Fully Address Challenges in Electronic Absentee Voting Initiatives for Military and Overseas Citizens Gao ID: GAO-07-774 June 14, 2007The Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) protects the rights of military personnel, their dependents, and overseas citizens to vote by absentee ballot. The Department of Defense (DOD) and others have reported that absentee voting, which relies primarily on mail, can be slow and may, in certain circumstances, serve to disenfranchise these voters. In 2004, Congress required DOD to develop an Internet-based absentee voting demonstration project and required the Election Assistance Commission--which reviews election procedures--to develop guidelines for DOD's project. In 2006, Congress required DOD to report, by May 15, 2007, on plans for expanding its use of electronic voting technologies and required GAO to assess efforts by (1) DOD to facilitate electronic absentee voting and (2) the Commission to develop Internet voting guidelines and DOD to develop an Internet-based demonstration project. GAO also assessed DOD's efforts to develop plans to expand its use of electronic voting technologies. GAO interviewed officials and reviewed and analyzed documents related to these efforts.
Since 2000, DOD has developed several initiatives to facilitate absentee voting by electronic means such as fax or e-mail; however, some of these initiatives exhibited weaknesses or had low participation rates that might hinder their effectiveness. For example, the 2003 Electronic Transmission Service's fax to e-mail conversion feature allows UOCAVA voters who do not have access to a fax machine to request ballots by e-mail and then converts the e-mails to faxes to send to local election officials. DOD officials told us, however, they have not performed, among other things, certification tests and thus are not in compliance with information security requirements. The 2004 Interim Voting Assistance System (IVAS)--which, DOD reported, enabled UOCAVA voters to request and receive ballots securely--cost $576,000, and 17 citizens received ballots through it. The 2006 Integrated Voting Alternative Site (also called IVAS)--which enabled voters to request ballots using one tool, by mail, fax, or unsecured e-mail--raised concerns, from Congress and others, that using unsecured e-mail could expose voters to identity theft if they transmit personal data. While this IVAS displayed a warning that voters had to read to proceed, it did not advise them to delete personal voting information from the computers they used. DOD spent $1.1 million, and at least eight voted ballots were linked to this 2006 IVAS. Both the 2004 and 2006 IVAS were each implemented just 2 months before an election. DOD also has a Web site with links to guidance on electronic transmission options, but some of this guidance was inconsistent and could be misleading. DOD officials acknowledged the discrepancies and addressed them during GAO's review. The Election Assistance Commission has not developed the Internet absentee voting guidelines for DOD's use, and thus DOD has not proceeded with its Internet-based absentee voting demonstration project. Commission officials told GAO that they had not developed the guidelines because they had been devoting constrained resources to other priorities, including challenges associated with electronic voting machines. Furthermore, they have not established--in conjunction with major stakeholders like DOD--tasks, milestones, and time frames for completing the guidelines. The absence of such guidelines has hindered DOD's development of its Internet-based demonstration project. To assist the Commission, however, DOD has shared information on the challenges it faced in implementing prior Internet projects--including security threats. GAO observed that DOD was developing, but had not yet completed, plans for expanding the future use of electronic voting technologies. Because electronic voting in federal elections involves numerous federal, state, and local-level stakeholders; emerging technology; and time to establish the initiatives, developing results-oriented plans that identify goals, time frames, and tasks--including addressing security issues--is key. Without such plans, DOD is not in a position to address congressional expectations to establish secure and private electronic and Internet-based voting initiatives.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-07-774, Elections: Action Plans Needed to Fully Address Challenges in Electronic Absentee Voting Initiatives for Military and Overseas Citizens
This is the accessible text file for GAO report number GAO-07-774
entitled 'Elections: Action Plans Needed to Fully Address Challenges i
Electronic Absentee Voting Initiatives for Military and Overseas
Citizens' which was released on June 14, 2007.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Committees:
United States Government Accountability Office:
GAO:
June 2007:
Elections:
Action Plans Needed to Fully Address Challenges in Electronic Absentee
Voting Initiatives for Military and Overseas Citizens:
GAO-07-774:
GAO Highlights:
Highlights of GAO-07-774, a report to congressional committees
Why GAO Did This Study:
The Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA)
protects the rights of military personnel, their dependents, and
overseas citizens to vote by absentee ballot. The Department of Defense
(DOD) and others have reported that absentee voting, which relies
primarily on mail, can be slow and may, in certain circumstances, serve
to disenfranchise these voters. In 2004, Congress required DOD to
develop an Internet-based absentee voting demonstration project and
required the Election Assistance Commission”which reviews election
procedures”to develop guidelines for DOD‘s project. In 2006, Congress
required DOD to report, by May 15, 2007, on plans for expanding its use
of electronic voting technologies and required GAO to assess efforts by
(1) DOD to facilitate electronic absentee voting and (2) the Commission
to develop Internet voting guidelines and DOD to develop an Internet-
based demonstration project. GAO also assessed DOD‘s efforts to develop
plans to expand its use of electronic voting technologies. GAO
interviewed officials and reviewed and analyzed documents related to
these efforts.
What GAO Found:
Since 2000, DOD has developed several initiatives to facilitate
absentee voting by electronic means such as fax or e-mail; however,
some of these initiatives exhibited weaknesses or had low participation
rates that might hinder their effectiveness. For example, the 2003
Electronic Transmission Service‘s fax to e-mail conversion feature
allows UOCAVA voters who do not have access to a fax machine to request
ballots by e-mail and then converts the e-mails to faxes to send to
local election officials. DOD officials told us, however, they have not
performed, among other things, certification tests and thus are not in
compliance with information security requirements. The 2004 Interim
Voting Assistance System (IVAS)”which, DOD reported, enabled UOCAVA
voters to request and receive ballots securely”cost $576,000, and 17
citizens received ballots through it. The 2006 Integrated Voting
Alternative Site (also called IVAS)”which enabled voters to request
ballots using one tool, by mail, fax, or unsecured e-mail”raised
concerns, from Congress and others, that using unsecured e-mail could
expose voters to identity theft if they transmit personal data. While
this IVAS displayed a warning that voters had to read to proceed, it
did not advise them to delete personal voting information from the
computers they used. DOD spent $1.1 million, and at least eight voted
ballots were linked to this 2006 IVAS. Both the 2004 and 2006 IVAS were
each implemented just 2 months before an election. DOD also has a Web
site with links to guidance on electronic transmission options, but
some of this guidance was inconsistent and could be misleading. DOD
officials acknowledged the discrepancies and addressed them during
GAO‘s review.
The Election Assistance Commission has not developed the Internet
absentee voting guidelines for DOD‘s use, and thus DOD has not
proceeded with its Internet-based absentee voting demonstration
project. Commission officials told GAO that they had not developed the
guidelines because they had been devoting constrained resources to
other priorities, including challenges associated with electronic
voting machines. Furthermore, they have not established”in conjunction
with major stakeholders like DOD”tasks, milestones, and time frames for
completing the guidelines. The absence of such guidelines has hindered
DOD‘s development of its Internet-based demonstration project. To
assist the Commission, however, DOD has shared information on the
challenges it faced in implementing prior Internet projects”including
security threats.
GAO observed that DOD was developing, but had not yet completed, plans
for expanding the future use of electronic voting technologies. Because
electronic voting in federal elections involves numerous federal,
state, and local-level stakeholders; emerging technology; and time to
establish the initiatives, developing results-oriented plans that
identify goals, time frames, and tasks”including addressing security
issues”is key. Without such plans, DOD is not in a position to address
congressional expectations to establish secure and private electronic
and Internet-based voting initiatives.
What GAO Recommends:
GAO made recommendations to DOD regarding security, guidance, and plans
for electronic voting initiatives and to the Commission on plans to
develop the guidelines. DOD and the Commission agreed with these
recommendations.
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-774].
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Derek Stewart at (202)
512-5559 or stewartd@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
DOD Initiatives Assist UOCAVA Voters, but Certain Weaknesses May Limit
Their Effectiveness:
Absence of Internet Absentee Voting Guidelines Has Hindered Development
of the Mandated Internet-Based Absentee Voting Demonstration Project:
DOD Was Developing Plans to Expand the Use of Electronic Voting
Technology in the Future, but Sound Management Practices Are Key:
Conclusions:
Recommendations for DOD:
Recommendations for the Election Assistance Commission:
Agency Comments and Our Evaluation:
Appendix I: cope and Methodology:
Appendix II: Examples of the Inconsistent Voting Assistance Guidance on
DOD's Web Site:
Appendix III: Comments from the Department of Defense:
Appendix IV: Comments from the Election Assistance Commission:
Appendix V: GAO Contact and Staff Acknowledgments:
Related GAO Products:
Tables:
Table 1: Electronic Transmission Service E-mail to Fax Conversions for
2004 and 2006:
Table 2: Comparison of Integrated Voting Alternative Site Tools 1 and 2
for Election Year 2006:
Table 3: State Offices Contacted and Programs Where the States Were
Participants:
Table 4: Inconsistencies Identified in Guidance on Electronic
Alternatives to Mail:
Figures:
Figure 1: Laws and Some DOD Programs Promoting Electronic Alternatives
to Mail for UOCAVA Voters, 2000 through 2007:
Figure 2: DOD's 2006-2007 Voting Assistance Guide:
Abbreviations:
DOD: Department of Defense:
FVAP: Federal Voting Assistance Program:
HTML: Hypertext Markup Language:
IVAS: Interim Voting Assistance System:
IVAS: Integrated Voting Alternative Site:
NDAA: National Defense Authorization Act:
OMB: Office of Management and Budget:
PDF: Portable Document Format:
SERVE: Secure Electronic Registration and Voting Experiment:
UOCAVA: Uniformed and Overseas Citizens Absentee Voting Act:
VAG: Voting Assistance Guide:
United States Government Accountability Office:
Washington, DC 20548:
June 14, 2007:
The Honorable Carl Levin:
Chairman:
The Honorable John McCain:
Ranking Member:
Committee on Armed Services:
United States Senate:
The Honorable Ike Skelton:
Chairman:
The Honorable Duncan Hunter:
Ranking Member:
Committee on Armed Services:
House of Representatives:
A citizen's right to vote is one of the hallmarks of a democratic
society; yet exercising this right can be a challenge for millions of
military personnel and their dependents of voting age who live away
from their legal residences (in or outside the United States) and for
overseas citizens. These individuals are eligible to vote by absentee
ballots in federal elections. This eligibility is established by the
Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA),[Footnote
1] which is administered by the Department of Defense's (DOD) Federal
Voting Assistance Program (FVAP). Through this program, DOD provides
assistance to UOCAVA voters to facilitate opportunities for them to
exercise their right to vote. The absentee voting process requires the
potential voter to register to vote, request an absentee ballot,
receive the ballot, correctly complete the ballot, and return it to the
appropriate local election official. However, DOD and groups that
represent voters covered under the act have reported that, because the
multistep process of absentee voting relies primarily on mail, in some
instances it can take so long to complete that these voters may, in
effect, be disenfranchised.
To address concerns about mail-based absentee voting, Congress has
enacted several laws to promote electronic means for voters to
register, request and receive ballots, and transmit voted ballots to
local election officials. These laws include (1) the Help America Vote
Act of 2002, which established the Election Assistance Commission to
serve as a national clearinghouse for election information and to
review election procedures; develop voluntary voting system
guidelines;[Footnote 2] and study, among other things, electronic
voting--particularly Internet voting technology; (2) section 1604 of
the National Defense Authorization Act (NDAA) for Fiscal Year 2002,
which required DOD to carry out a secure[Footnote 3] Internet-based
electronic demonstration project[Footnote 4] in the general election
for federal office in 2002 or 2004; and (3) section 567 of the Ronald
W. Reagan NDAA for Fiscal Year 2005, which amended Congress's mandate
for DOD to develop a secure, Internet-based, absentee voting
demonstration project--by requiring DOD to implement the project during
the first general election for federal office that occurs after the
Election Assistance Commission establishes Internet voting guidelines
for the absentee voting process.[Footnote 5] Section 596 of the John
Warner NDAA for Fiscal Year 2007 required DOD to submit, not later than
May 15, 2007, a detailed plan to expand the use of electronic voting
technology.
Section 596 of the John Warner NDAA for Fiscal Year 2007 also required
GAO to review DOD's electronic and Internet-based voting initiatives.
This report assesses (1) DOD's efforts to facilitate registration,
ballot transmittal, and voting by electronic means, such as e-mail and
fax, for UOCAVA voters and (2) the Election Assistance Commission's
efforts to develop Internet absentee voting guidelines and DOD's
efforts to develop a secure, Internet-based, absentee voting
demonstration project. The report also discusses DOD's efforts to
develop plans to expand the use of electronic voting technology in the
future.
To address our objectives, we reviewed and analyzed laws, directives,
reports, and plans related to DOD's efforts to provide electronic
voting capabilities for UOCAVA voters. We also examined the Election
Assistance Commission's efforts to develop Internet absentee voting
guidelines. We reviewed and analyzed information regarding any benefits
and challenges that we, DOD, and others had identified related to DOD's
Internet-based electronic demonstration project and new electronic
voting initiatives, along with the steps DOD had taken to mitigate
those challenges. Additionally, we interviewed and obtained
documentation from officials in several offices within DOD, the
Election Assistance Commission, selected state and local election
jurisdictions, and some independent groups concerned with the interests
of UOCAVA voters. We performed our work in accordance with generally
accepted government auditing standards, from August 2006 through April
2007. Appendix I provides detailed information about our scope and
methodology.
Results in Brief:
Since the 2000 federal election, DOD has developed several initiatives
to facilitate voting by electronic means such as fax or e-mail;
however, some of these initiatives exhibited weaknesses or garnered low
participation rates that could limit their effectiveness. DOD
introduced the first of three initiatives, an e-mail to fax conversion
enhancement to its Electronic Transmission Service, in 2003. This
feature allows UOCAVA voters who do not have access to a facsimile
machine to send ballot requests, via e-mail, to DOD's Electronic
Transmission Service, which converts e-mail messages to faxes and sends
them to local election officials.[Footnote 6] In return, local election
officials can send ballots to the Electronic Transmission Service
conversion feature by fax; the conversion feature then converts the fax
to an e-mail and sends it to the voter. DOD officials told us, however,
that this feature is not in compliance with certain DOD information
security requirements,[Footnote 7] which include performing and
documenting risk assessments and security certification testing.
Without such compliance, DOD cannot certify that it has employed the
basic practices necessary to apply security measures. DOD officials
said that they plan to award a contract to meet the requirements. Also,
DOD voluntarily launched a second initiative--the Interim Voting
Assistance System (IVAS)--in September 2004, to enable, as DOD
reported, absentee voters to request and receive state or territory
ballots securely for use in the November 2004 election. DOD spent
$576,000 on this project, but only 17 citizens received ballots through
this system--in part, because it was implemented just 2 months before
the election. Further, in September 2006, DOD developed, in response to
a legislative mandate,[Footnote 8] a third initiative--the Integrated
Voting Alternative Site (also called IVAS). This site included (1) a
ballot request only tool--called Tool 1--that enabled voters to request
their state or territory ballots from election officials by fax,
regular mail, or unsecured e-mail and (2) a ballot request and receipt
tool--called Tool 2--that enabled voters to request and receive their
state or territory ballots through a secured server. Officials within
Congress, and others, expressed concerns that using the Tool 1 with
unsecured e-mail could expose voters to the risk of identity theft. DOD
displayed a warning on the site--which voters had to read to continue
processing their request--that explained the risks associated with e-
mailing ballot requests. While the warning addressed the risks of
transmitting personal identification information by e-mail, it did not
inform voters of the risks involved in leaving such personal
information on the computers they used--especially public computers or
those shared by others. DOD officials said they would incorporate
lessons learned, such as adding a cautionary statement to future
systems to warn UOCAVA voters to remove personal information from the
computers they use. DOD spent about $1.1 million on the 2006 IVAS, but
local election officials could link only eight ballots to IVAS Tool
2.[Footnote 9] In addition to these initiatives, DOD has established a
Web site with links to guidance that provides UOCAVA voters with, among
other things, information on electronic alternatives to mail for each
of the 55 states and territories. These links lead to DOD's 2006 IVAS,
the Voting Assistance Guide, news releases, and guidance updates. Our
analysis of information on DOD's Web site, however, showed that for 14
of the 55 states and territories, some of the information about the
alternatives was inconsistent and could be misleading. For example, for
one state, information on three links correctly stated that only
overseas military and overseas civilian voters were eligible to receive
or return a ballot by fax; however, a fourth link did not include this
restriction. As a result, military personnel stationed in the United
States, but away from their state of residence, may have incorrectly
concluded that they were eligible to vote by fax. While these
inconsistencies were not widespread, their mere existence could lead
UOCAVA voters to rely on incorrect information and therefore adversely
affect the citizens' ability to vote. Agency officials acknowledged
these discrepancies and addressed them during the course of our review.
We are recommending that DOD improve the security and accuracy of its
systems by (1) complying with information security requirements, (2)
incorporating lessons learned, such as adding a cautionary statement to
future systems to warn UOCAVA voters to remove personal information
from the computers they use, and (3) institutionalizing a review
process for its online guidance to ensure that information for absentee
voters is accurate and consistent. DOD concurred with these
recommendations.
The Election Assistance Commission has not yet developed guidelines for
Internet absentee voting for DOD's use, and, thus, DOD has not
proceeded with developing its secure, Internet-based, absentee voting
demonstration project. Specifically, Commission officials stated that
they had not yet developed the guidelines because they had been
devoting constrained resources to meeting the challenges associated
with current electronic voting machines. Furthermore, the Commission
has not yet established--in conjunction with major stakeholders, like
DOD--tasks, including addressing security and privacy risks; time
frames; or milestones for completing the guidelines. Similarly, DOD has
not developed the secure, Internet-based, absentee voting demonstration
project because, DOD officials said, by law, the Commission must
develop Internet absentee voting guidelines for DOD to follow before it
can proceed. To support the Commission in developing these guidelines,
DOD officials said they gave the Commission a report and an internal
DOD document that provides the framework for a system, along with
challenges DOD found in its earlier Internet voting projects. These
challenges included security threats such as computer viruses,
malicious insider attacks, and inadvertent errors that could disrupt
system performance. DOD officials stated that, even if the Internet
absentee voting guidelines had been available at the time of our
review, the time remaining before the 2008 federal election would be
inadequate for developing the secure, Internet-based, demonstration
project. We are recommending that the Election Assistance Commission,
in conjunction with major stakeholders such as DOD, create an action
plan with tasks including actions to address the security and privacy
risks associated with Internet voting processes and time frames for
developing the Internet absentee voting guidelines. The Election
Assistance Commission concurred with our recommendation.
We observed that DOD was developing, but had not yet completed, plans
for expanding the use of electronic voting technology for military
personnel and overseas citizens, as required by the John Warner NDAA
for Fiscal Year 2007. The act requires DOD to submit these plans to
Congress, not later than May 15, 2007. Our analysis of existing DOD and
Commission documents and our interviews with agency officials show that
DOD has not sufficiently involved stakeholders in recent electronic
voting efforts--such as its 2006 IVAS. In addition, it has not
established interim tasks that address issues such as security and
privacy, milestones, time frames, or contingency plans, following the
sound management practices used by leading organizations.
Implementation of new electronic voting initiatives requires careful
planning, particularly in light of the large number of stakeholders,
the application of new technology, the remote location of troops, and
the lead time required for implementation. Without an integrated,
results-oriented plan that involves all stakeholders and identifies,
among other things, goals, tasks, time frames, and contingency plans,
DOD is not in a position to address congressional expectations to
establish secure and private electronic and Internet-based voting
initiatives. We are recommending that DOD, in conjunction with major
stakeholders such as the Election Assistance Commission and local
election officials, develop a comprehensive, results-oriented plan for
future efforts that specifies, among other things, tasks including
identifying safeguards for security and privacy of all DOD's voting
systems--both electronic and Internet-based. DOD concurred with this
recommendation.
DOD's and the Commission's written comments are contained in appendixes
III and IV, respectively. DOD also provided technical comments, which
we incorporated in the final report, as appropriate.
Background:
The U.S. election system is highly decentralized and relies on a
complex interaction of people, processes, and technology. Voters, local
election jurisdictions (which number over 10,000), states and
territories, and the federal government all play important roles in the
election process. The process, however, is primarily the responsibility
of the individual states and territories and their election
jurisdictions. As we reported in our 2006 testimony,[Footnote 10]
states and territories have considerable discretion in how they
organize the elections process; this is reflected in the diversity of
procedures and deadlines that states and jurisdictions establish for
voter registration and absentee voting. Furthermore, these states and
jurisdictions use a variety of voting techniques, from paper ballots to
faxes and e-mails. We also reported that the voter is ultimately
responsible for being aware of and understanding the absentee voting
process and taking the actions necessary to participate in it.
The UOCAVA established that members of the military and their
dependents of voting age living away from their legal residences (in or
outside the United States) and American citizens who no longer maintain
a permanent residence in the United States are eligible to participate
by absentee ballot in all federal elections. According to DOD, the act
covers more than 6 million people. Executive Order and DOD guidance
related to the act include the following:
* Executive Order 12642, dated June 8, 1988, made the Secretary of
Defense, or his designee, responsible for carrying out the federal
functions under UOCAVA, including (1) compiling and distributing
information on state absentee voting procedures, (2) designing absentee
registration and voting materials, (3) working with state and local
election officials, and (4) reporting to Congress and the President
after each presidential election on the effectiveness of the program's
activities (including a statistical analysis of UOCAVA voters'
participation).
* DOD Directive 1000.4, updated April 14, 2004, assigned the Office of
the Under Secretary of Defense for Personnel and Readiness
responsibility for administering and overseeing the program, and it
established the FVAP to manage the program. In 2006, FVAP officials
told us that they were authorized a full-time staff of 13 and had a
fiscal year budget of approximately $3.8 million.
FVAP facilitates the absentee voting process for UOCAVA voters; its
mission is to (1) inform and educate U.S. citizens worldwide about
their right to vote, (2) foster voter participation, and (3) enhance
and protect the integrity of the electoral process at the federal,
state, and local levels. FVAP also, among other things, provides
training opportunities for Voting Assistance Officers (service, State
Department, and overseas citizen organization officials who carry out
the implementation of their respective voting assistance programs);
prescribes, coordinates, and distributes voting materials, such as the
Federal Post Card Application (the registration and absentee ballot
request form for UOCAVA voters); and provides for alternatives to
regular mail, including Express Mail and the use of electronic
solutions.
The Election Assistance Commission, which was established by the Help
America Vote Act of 2002, also contributes to the absentee voting
process. The act specifically established the Commission as a national
clearinghouse for election information and procedures and assigned it
responsibility for developing voting system guidelines for the entire
election process. The act also specifies that the development of
voluntary voting system guidelines should be informed by research and
development in remote access voting, including voting through the
Internet, and the security of computers, networks and data storage. In
2005, the Commission issued guidelines that, among other things,
addressed gaps in the security measures of prior standards. However,
these guidelines do not comprehensively address telecommunications and
networking services or their related security weaknesses, such as those
related to the Internet. The act also amended UOCAVA to require states
to report to the Commission, after each regularly scheduled general
election for federal office, on the aggregate number of (1) absentee
ballots transmitted to absentee uniformed services voters and overseas
voters for the election and (2) ballots returned by those voters and
cast in the election. The Commission collects this information through
its biennial state surveys of election data.
DOD, the Commission, and organizations representing UOCAVA voters have
noted that these voters may effectively become disenfranchised because
the multistep process for voting by absentee ballot--which relies
primarily on mail--can take too long, especially for mobile
servicemembers and overseas citizens or those deployed to or living in
remote areas. Congress and DOD have taken action to facilitate the use
of alternatives to mail, including electronic means such as fax, e-
mail, and the Internet. Figure 1 shows (1) the laws designed to
facilitate the use of electronic capabilities for UOCAVA voters and (2)
some of DOD's efforts, either voluntary or in response to a statute, to
provide electronic capabilities to these voters during fiscal years
2000 through 2007.
Figure 1: Laws and Some DOD Programs Promoting Electronic Alternatives
to Mail for UOCAVA Voters, 2000 through 2007:
[See PDF for image]
Source: GAO analysis of Law and DOD information.
[End of figure]
FVAP stated that it implemented the Voting Over the Internet project in
2000 as a small-scale pilot project to provide military personnel and
their dependents and overseas citizens covered under UOCAVA the ability
to securely register to vote, request and receive ballots from local
election officials, and vote via the Internet. DOD voluntarily
developed the project as a small-scale proof-of-concept Internet voting
project. This project enabled 84 voters to vote over the Internet--the
first time that binding votes were cast in this manner.[Footnote 11]
While the project demonstrated that it was possible for a limited
number of voters to cast ballots online, DOD's report concluded that
security concerns needed to be addressed before it could expand remote
(i.e., Internet) voting to a larger population.
In 2001, Congress noted that the Voting Over the Internet project had
demonstrated that the Internet could be used to enhance absentee
voting.[Footnote 12] To continue the examination of a secure, easy-to-
use Internet voting system as an alternative to the regular mail
process, Congress mandated, in the NDAA for Fiscal Year 2002, that DOD
conduct a large-scale Internet-based absentee voting demonstration
project to be used for the 2002 or 2004 federal election. DOD responded
to this mandate by creating the Secure Electronic Registration and
Voting Experiment (SERVE) for Internet-based absentee registration and
voting; SERVE used a system architecture similar to the one used for
the Voting Over the Internet project. However, as we previously
reported,[Footnote 13] a minority report published by four members of
the Security Peer Review Group--a group of 10 computer election
security experts that FVAP assembled to evaluate SERVE--publicly raised
concerns about the security of the system because of its use of the
Internet.[Footnote 14] The four members suggested that SERVE be
terminated because potential security problems left the information in
the system vulnerable to cyber attacks that could disclose votes or
personal voter information. Furthermore, they cautioned against the
development of future electronic voting systems until the security of
both the Internet and the world's home computer infrastructure had been
improved. Because DOD did not want to call into question the integrity
of votes that would have been cast via SERVE, the Deputy Secretary of
Defense terminated the project in early 2004, and DOD did not use it in
the November 2004 election.
The points raised in these security reviews are consistent with
concerns we raised in our 2001 reports.[Footnote 15] We found that
broad application of Internet voting presented formidable social and
technological challenges. In particular, we noted that challenges to
remote Internet voting[Footnote 16] involve securing voter
identification information and ensuring that voters secure the computer
on which they vote. We also reported that because voting requires more
stringent controls than other electronic transactions, such as online
banking, Internet voting systems face greater security challenges than
other Internet systems. Furthermore, we found that remote Internet
voting was recognized as the least protective of ballot
secrecy[Footnote 17] and voter privacy[Footnote 18] and was most at
risk from denial of service and malicious software, such as computer
viruses. While opinions of groups considering the pros and cons of
Internet voting were not unanimous, we found that they agreed in
principle on major issues, including considering security to be the
primary technical challenge for Internet voting.[Footnote 19] Because
of serious concerns about protecting the security and privacy of the
voted ballot, we concluded that Internet-based registration and voting
would not likely be implemented on a large scale in the near future.
In the Ronald W. Reagan NDAA for Fiscal Year 2005, Congress amended the
requirement for the Internet-based absentee voting demonstration
project by permitting DOD to delay its implementation until the first
federal election after the Election Assistance Commission developed
guidelines for the project. The conference report for the act[Footnote
20] stated that, although Congress recognized the technical challenges
of Internet voting, SERVE was an important prototype that should not be
abandoned.
DOD Initiatives Assist UOCAVA Voters, but Certain Weaknesses May Limit
Their Effectiveness:
Since the 2000 federal election, DOD has established several
initiatives as alternatives to the by-mail process to facilitate voter
registration and ballot request, receipt of a ballot, and submission of
a voted ballot by electronic means--such as fax and e-mail--for UOCAVA
voters. These include the Electronic Transmission Service's fax to e-
mail and e-mail to fax conversion enhancement (hereafter referred to as
the e-mail to fax conversion feature); the 2004 Interim Voting
Assistance System (IVAS); the 2006 Integrated Voting Alternative Site
(also called IVAS); DOD's online voting assistance guidance; and online
forms to register, request, receive, or submit ballots. While these
efforts provide valuable guidance, services, and information to UOCAVA
voters, some of them had limited participation rates or exhibited
weaknesses in security, consistency, and accuracy that might hinder
their use and effectiveness. DOD officials have acknowledged these
weaknesses and they began taking action to address them during the
course of our review.
Electronic Transmission Service's E-mail to Fax Conversion Capability
Facilitates Transmission of Voting Materials but Does Not Fully Comply
with Information Security Requirements:
The electronic transmission service is a fax forwarding system,
established by FVAP in 1990, that allows UOCAVA voters and state and
local election officials, where permitted by law, to fax election
materials to each other. These voters and election officials can use
this service and do not have to pay long distance fees for faxing out
of state, because DOD provides the service through a toll-free line. In
2003, after discussions with Mississippi state officials and a
Mississippi National Guard unit, FVAP added the e-mail to fax
conversion capability to its electronic transmission service. These
officials asked FVAP for help in transmitting voting materials because,
by state law, Mississippi allowed only faxing as an electronic means of
transmission--a capability that the Guard unit would not have while it
was deployed to Iraq.[Footnote 21] The e-mail to fax conversion feature
allows UOCAVA voters who do not have access to a facsimile machine to
send ballot requests, via e-mail, to DOD's Electronic Transmission
Service, which converts e-mail attachments to faxes and sends them to
local election officials. In return, local election officials can send
ballots to the Electronic Transmission Service conversion feature by
fax; the conversion feature then converts the fax to an e-mail
attachment and sends it to the voter.
FVAP stated that it notifies states and territories whenever it
converts an e-mail containing voting materials to a fax, or vice versa,
so that the state or territory can decide whether or not to accept it.
Table 1 shows Electronic Transmission Service activity for the
conversion feature for 2004 and 2006.
Table 1: Electronic Transmission Service E-mail to Fax Conversions for
2004 and 2006:
E-mails converted to fax--sent from citizens to local election
officials.
Voted ballots;
Years: 2004: 67;
Years: 2006: 53.
Federal post card applications and remaining ballot materials;
Years: 2004: 389;
Years: 2006: 190.
Subtotal;
Years: 2004: 456;
Years: 2006: 243.
E-mails converted to fax--sent from local election officials to
citizens[A].
Federal post card applications and remaining ballot materials;
Years: 2004: 153[B];
Years: 2006: 182.
Subtotal;
Years: 2004: 153[B];
Years: 2006: 182.
Total;
Years: 2004: 609;
Years: 2006: 425.
Source: DOD.
[A] FVAP officials stated that the local election officials who send e-
mails to the Electronic Transmission Service conversion feature use it
to store ballots that will be sent to UOCAVA voters, through DOD, at
some future date.
[B] FVAP noted that for the 2004 elections the Electronic Transmission
Service conversion feature received 61 e-mails from local election
officials which they converted to 153 faxes to citizens covered under
UOCAVA. FVAP explained that this allowed one local election official to
send one e-mail with a PDF attachment to the Electronic Transmission
Service, which would then get converted to a fax and sent to multiple
UOCAVA voters per the local election official's instructions. PDF means
Portable Document Format; it is a file format that is used to view
electronic copies of paper documents, which allows an exact copy of the
paper document.
[End of table]
Although FVAP has made progress in assisting servicemembers to transmit
voting materials with the e-mail to fax conversion enhancement, FVAP
officials told us they have not fully complied with certain information
security requirements in the Interim DOD Information Assurance
Certification and Accreditation Process.[Footnote 22] This guidance
requires DOD components, among other things, to implement controls and
to certify and accredit such e-mail systems.
FVAP officials initially stated that the information security guidance
did not apply to the conversion feature; they saw it as an enhancement
to the original Electronic Transmission Service's fax system. During
the course of our review, however, FVAP officials said they consulted
with officials responsible for DOD's information assurance
certification and accreditation and concluded that the requirements
did, in fact, apply. These officials stated that, by the end of fiscal
year 2007, they plan to award a contract to obtain services to meet the
information security requirements. The FVAP officials further stated
that, while they do not have the required documentation--such as risk
assessments or certification tests and accreditations--they have taken
some measures to ensure security. We note that the statement of work
for FVAP's April 29, 2005, contract for the Electronic Transmission
Service recognizes the sensitivity of the data associated with election
materials and includes provisions for certain security functions, such
as ensuring that adequate steps are taken to prevent unauthorized
access or manipulation of the data. Until FVAP performs and documents
the security assessments and certifications, however, it has not taken
all the necessary measures to secure its system and comply with DOD's
information security requirements.
Federal law includes a number of separate statutes that provide privacy
protections for certain information. The major requirements for the
protection of personal privacy by federal agencies come from two laws:
the Privacy Act of 1974[Footnote 23] and the privacy provisions of the
E-Government Act of 2002. Section 208 of the E-Government Act of
2002[Footnote 24] requires agencies, among other things, to conduct
privacy impact assessments before developing, upgrading, or procuring
information technology that collects, maintains, or disseminates
personally identifiable information. DOD developed departmentwide
guidance--the DOD Privacy Impact Assessment Guidance--for implementing
the privacy impact assessment requirements mandated in the E-Government
Act of 2002. In this guidance, DOD directs the components to adhere to
the requirements prescribed by the Office of Management and Budget
(OMB)--Guidance for Implementing the Privacy Provisions of the E-
Government Act of 2002.[Footnote 25] FVAP officials stated that they
had not conducted a privacy impact assessment for the Electronic
Transmission Service's e-mail to fax conversion enhancement, but they
told us that a privacy impact assessment will be done as part of the
previously mentioned contract to meet information security
requirements. A privacy impact assessment would identify specific
privacy risks to help determine what controls are needed to mitigate
those risks associated with the Electronic Transmission Service.
Furthermore, building in controls to mitigate risks could ensure that
personal information that is transmitted is only used for a specified
purpose. FVAP noted that when information is sent by e-mail, the
conversion feature retains the following information: full name, fax
number, city, state, zip code, and e-mail addresses. FVAP's Electronic
Transmission Service retains this personally identifiable information
both to provide transmission verification or confirmation to users and
to comply with election document retention requirements under the Civil
Rights Act of 1960.[Footnote 26]
DOD's Electronic Ballot Request and Receipt Initiatives Had Limitations
in Participation and Security:
In September 2004, just 2 months prior to the election, DOD voluntarily
implemented what it reported as a secure electronic system for voters
to request and receive ballots--the Interim Voting Assistance System
(IVAS)--as an alternative to the traditional mail process. IVAS was
open to active duty servicemembers, their voting age dependents, and
DOD overseas personnel who were registered in a state or territory
participating in the project[Footnote 27] and enrolled in the Defense
Enrollment Eligibility Reporting System--a DOD-managed database that
includes over 23 million records pertaining to active duty and reserve
military and their family members, retired military, DOD civil service
personnel, and DOD contractors. DOD had limited IVAS participation to
UOCAVA voters who were affiliated with DOD because their identities
could be verified in the Defense Enrollment Eligibility Reporting
System. Voters obtained their state or territory ballots through IVAS
by logging on to a special Web site and then requesting ballots from
their participating local election jurisdictions. After the local
election officials approved the requests and the ballots were
finalized, IVAS notified voters via e-mail that the ballots were
available to download and print. DOD reported that 108 counties in
eight states and one territory agreed to participate in this 2004 IVAS;
however, only 17 citizens downloaded their ballots from the site during
the 2004 election. FVAP officials noted that participation was low, in
part because this IVAS was implemented just 2 months before the
election. FVAP further reported that many states did not participate--
for a variety of reasons, including state legislative restrictions,
workload surrounding regular election responsibilities, and lack of
Internet access. FVAP officials noted that this system, which was
maintained through the conclusion of the election, cost $576,000.
In September 2006--again, just 2 months before the next general
election--FVAP launched a follow-on Integrated Voting Alternative Site,
also called IVAS, in response to a June 2006 legislative mandate to
reestablish the 2004 IVAS. This 2006 IVAS expanded on the 2004 effort,
by providing information on electronic ballot request and receipt
options for all UOCAVA citizens in all 55 states and territories. It
also provided two tools that registered voters could access through the
FVAP Web site, using DOD or military identification, to request or
receive ballots from local election officials. As with the 2004 IVAS,
local election officials used information in these tools to verify the
identity of UOCAVA voters who used them.[Footnote 28] The first tool--
called Tool 1--contained a ballot request form only, accessed through
DOD's Web site, which voters could fill out and download to their
computers. Voters could then send the downloaded form to the local
election officials either by regular mail, fax, or unsecured e-mail,
per state or territory requirements. FVAP officials reported to
Congress that no information on the number of users was available on
the use of Tool 1 because the department was no longer involved in the
process once the voter downloaded the ballot request and they,
essentially, had no visibility into what transpired directly between
the voter and the election officials.
The second tool--called Tool 2--provided a ballot request and receipt
capability for voters, similar to the 2004 IVAS, which also allowed
voters to fill out ballot request forms online, send them to local
election officials through a secure line, and receive their state or
territory ballots from the local election officials through a secured
server. Again, no voted ballots were transmitted through this IVAS
system given that it was not designed for that purpose. Absentee
voters, instead, would return voted ballots, outside of IVAS, in
accordance with state law. Tool 2 had a tracking feature which showed
that 63 voters had requested ballots through the system. Of these,
local election officials approved and made their state or territory
ballots available to 35 UOCAVA voters. However, of the 35 sent out,
local election officials reported that only 8 voted ballots[Footnote
29] were traced back to the IVAS Tool 2, in part because this IVAS was
implemented just 2 months before the election. DOD reported that the
total cost for the 2006 IVAS was about $1.1 million, and given that the
tools were used only to request or receive ballots for the November
2006 elections,[Footnote 30] DOD removed the tools from FVAP's Web site
in January 2007. Table 2 compares and provides additional details on
the two tools.
Table 2: Comparison of Integrated Voting Alternative Site Tools 1 and 2
for Election Year 2006:
Developer/ contractor;
Tool 1: Defense Manpower Data Center;
Tool 2: Merlin International, Incorporated's PostX.
User(s);
Tool 1:
* Uniformed servicemembers;
* Servicemembers' dependents;
* Overseas DOD employees and contractors;
Tool 2:
* Uniformed servicemembers;
* Servicemembers' dependents;
* Overseas DOD employees and contractors;
* Local election officials.
Tracking;
Tool 1:
* System is not able to track ballot request forms sent to local
election officials because users submitted their Federal Post Card
Applications directly to local election officials using their personal
e-mail accounts;
* System can provide only how many times it was accessed;
Tool 2:
* System is able to track ballot request forms sent to local election
officials; local election officials reported that they received 8 voted
ballots.[A];
* PostX reported 63 ballot requests were submitted to the system; 35
were approved--29 out of 35 blank ballots were viewed by voters on the
system.
Step-by-step process;
Tool 1:
* Registered voters use a unique DOD identifier or credential to log in
to the IVAS tool;
* Voters complete the automated Federal Post Card Applications, without
their signature, to request a ballot;
* Voters save the Federal Post Card Applications to their computers as
PDF files;
* Voters e-mail the Federal Post Card Applications over an unsecured
Internet line to local election officials; voters may also fax or mail
the Federal Post Card Applications to local election officials--
depending on state or territory procedures;
Tool 2:
* Registered voters use unique DOD identifier or credential to log in
to the IVAS tool;
* Voters complete the automated Federal Post Card Applications, without
their signature, to request a ballot;
* Voters save the Federal Post Card Applications to the secure server
and the system sends a notification to the local election officials of
completed ballot requests;
* Local election officials receive automated e-mails with notification
of new ballot requests and log onto the secure server to access the
Federal Post Card Applications;
* Local election officials approve applications and upload blank
ballots onto the secure server;
* Voters log onto the secure server and fill out ballots;
* Voters print completed ballots;
* Voters submit voted ballot directly to local election officials, in
accordance with state law;
* Local election officials confirm voted ballot receipts;
* Voters log on to check confirmation of voted ballot receipts.
Source: DOD information.
[A] FVAP reported that, since ballot requests could be printed and
returned through the mail or by fax instead of the secured server, an
accurate reporting could not be obtained through Tool 2. FVAP also
reported that ballot requests submitted using Tool 1 could not be
tracked and reported because voters sent the requests directly to local
election officials using their personal e-mail accounts, mail, or fax.
[End of table]
Officials within Congress, and others, have expressed concerns that
voters could be exposed to a heightened risk of identity theft if they
used Tool 1 to send voting materials that contain personally
identifiable information (including Social Security number, date of
birth, and address), by unsecured e-mail. FVAP officials acknowledged
in their December 2006 report to Congress[Footnote 31] that Tool 1 was
less secure, but said (1) DOD was providing access to a capability that
states already provide,[Footnote 32] (2) most states and territories
only required the last four digits of the Social Security number on the
ballot requests,[Footnote 33] and (3) Tool 1 displayed a cautionary
statement that voters had to read to go on with the request process;
this cautionary statement explained the risk associated with e-mailing
ballot requests and that the government assumed no liability if voters
did so. While we confirmed a cautionary statement related to the
transmission of personal data did exist for Tool 1, it did not advise
voters, after submitting their ballot request, to remove voting
materials that they have stored on their computers. For example, voters
using Internet cafes overseas could have been subject to identity theft
if they did not delete their personal information from the computer and
a subsequent user gained access to the stored file. FVAP officials
acknowledged that users were not advised of the risks of storing
personal voting information on their computers, and these officials
stated that they will incorporate lessons learned, such as adding a
cautionary statement in any future ballot request system.
Online Voting Guidance Is Useful but Some Inconsistencies Exist in the
Links:
In addition to these initiatives, DOD also has established the FVAP Web
site,[Footnote 34] which contains information on FVAP programs and
links to assist UOCAVA voters in the voting process. Specifically,
these links access FVAP's online guidance, including several versions
of FVAP's biennial Voting Assistance Guide, shown in figure 2.
Figure 2: DOD's 2006-2007 Voting Assistance Guide:
[See PDF for image]
Source: DOD.
[End of figure]
This guide tells the UOCAVA voter how to register, request a ballot,
receive a ballot, and vote the ballot electronically--including by e-
mail or fax--where state or territory law allows this. One link on
FVAP's Web site had a full-text version of the guide, so that a Voting
Action Officer[Footnote 35] or other user could download and print the
entire guide and use it to provide assistance to absentee voters from
various states and jurisdictions. Another link goes to a Web page
containing "State-by-State Instructions," where two additional links--
one a PDF guide, the other an HTML version[Footnote 36]--are provided
for each state or territory. This allows voters to read or print off
only their own state's or territory's instructions and to have a choice
of formats.[Footnote 37] Another link goes to the Integrated Voting
Alternative Site--this site provides information for the 55 states and
territories regarding the electronic ballot request and receipt options
available to UOCAVA voters. FVAP's Web site also has another link to
News Releases, which contains updates on changes to the guidance,
including changes to state laws that affect UOCAVA voters. Finally, a
link goes to FVAP's Voting Assistance Guide Errata Sheets--this
contains changes that have been made to the archived Voting Assistance
Guide since its last printing.
Our review of the FVAP Web site, however, revealed inconsistencies in
some of the information about electronic transmission options that the
voters could access through different links on the site. Our analysis
specifically showed that, while not widespread, for 14 of the 55 states
or territories, some of the guidance regarding requirements for
electronic transmission was inconsistent and could be misleading, as
the following examples illustrate:
* For the state of California, we found that three of the FVAP links
correctly stated that only overseas military and overseas civilian
voters were eligible to receive or return a ballot by fax; a fourth
link, however, did not include this restriction. As a result, military
personnel stationed in the United States, but away from their state of
residence, might conclude--incorrectly--that they were eligible to vote
by fax. FVAP officials acknowledged this discrepancy and updated the
information reached from the fourth link on January 25, 2007, to
reflect the fact that uniformed servicemembers must be residing or
deployed overseas to be able to receive and send ballots by fax.
* For the state of Colorado, we identified a news release that was
issued on October 18, 2006, announcing a new initiative to allow
uniformed servicemembers deployed outside the United States to request,
receive, and return absentee ballots via e-mail. One other FVAP link
reflected this change; however, four other links did not capture this
change. FVAP officials acknowledged this discrepancy, updated two of
the links, and issued an errata sheet on January 22, 2007. FVAP
officials did not update the third link--the 2006-2007 Voting
Assistance Guide accessed through the publications link on their Web
site--stating that it was considered an archive document and was not
intended for update. However, DOD did not clearly identify this link as
an archived document; as a result, this link could mislead voters who
relied on it. FVAP officials later acknowledged that the archived
version of the 2006-2007 Voting Assistance Guide could have been
labeled better, and eventually deleted this version from their Web
site.
Appendix II provides details on the inconsistencies we found on FVAP's
Web sites for 14 states and identifies the links, along with DOD's
responses regarding each. Under internal control guidance,
organizations are to apply policies and procedures
consistently.[Footnote 38] As noted previously, while the
inconsistencies were not widespread, the fact that inconsistencies
exist at all could lead UOCAVA voters--especially busy voters residing
or deployed in remote locations--to rely on incorrect information and
therefore adversely affect their ability to vote. Agency officials
acknowledged these discrepancies and addressed them during the course
of our review.
Online Voting Forms:
In addition, FVAP administers two online forms, (1) the Federal Post
Card Application, which allows absentee voters to register to vote or
request ballots; and (2) the Federal Write-in Absentee Ballot, which
allows absentee voters to vote even if they have not yet received the
absentee ballot they requested from their state or territory. The
Federal Post Card Application has been online since 1999, in PDF
format, and is postage-free within the U.S. mail system when
appropriate markings, provided on FVAP's web site, are used. The online
Federal Post Card Application allows voters to download a PDF version
to their computers to complete, e-mail, print, sign, and send to their
local election official via mail. Some state and local election
officials we spoke with indicated that the online version of the
Federal Post Card Application has many benefits because it is easy to
fill out and read, and it provides sufficient space for the voter to
write in.
A UOCAVA voter can also use the Federal Write-in Absentee Ballot as a
backup ballot when the state or territory has not sent a regular
absentee ballot in time for the voter to participate in the election.
On October 21, 2004, just a few weeks before the national election,
FVAP issued a news release announcing the electronic version of the
ballot as an emergency ballot. The Ronald W. Reagan NDAA for Fiscal
Year 2005 amended the eligibility criteria in UOCAVA[Footnote 39] to
allow states and territories to accept the Federal Write-in Absentee
Ballot under a broader range of circumstances. Prior to the change, a
UOCAVA citizen had to be outside of the United States, have applied for
a regular absentee ballot early enough to meet state election
deadlines, and not have received it from the state. Under the new
criteria, the Federal Write-in Absentee Ballot can be used by military
servicemembers and their dependents stationed in the United States, as
well as by military personnel, their dependents, and citizens living
overseas.
Absence of Internet Absentee Voting Guidelines Has Hindered Development
of the Mandated Internet-Based Absentee Voting Demonstration Project:
The Election Assistance Commission has not yet developed the Internet
absentee voting guidelines, and because it is required by law to
develop them for DOD's use in the secure, Internet-based, absentee
voting demonstration project, DOD has not moved ahead with the project.
Commission officials told us that they have not yet developed the
required Internet absentee voting guidelines because the Commission has
been working on other priorities--including standards for electronic
voting machines, challenges associated with these electronic voting
machines, and a process for certification and accreditation--and it
lacks the resources to work on the Internet absentee voting guidelines
or the mandated study of the issues and challenges for Internet
technology at the same time. Although the Internet voting study is now
underway, the Commission has said that it will not be completed until
September 2007 and thus does not have the results it needs to establish
time frames or a plan for developing the guidelines. Regarding the
demonstration project, DOD officials stated that they had not taken
action to develop this project because the Ronald W. Reagan NDAA for
Fiscal Year 2005 requires the Commission to develop the guidelines
first. DOD officials stated that, in an effort to assist the Commission
in developing the Internet absentee voting guidelines, they have
provided information on prior Internet voting efforts, along with
challenges associated with these Internet voting efforts and views on
how to mitigate those challenges.
The Commission Has Not Developed Internet Absentee Voting Guidelines
because of Other Priorities, Constraints on Resources, and Lack of DOD
Information:
Commission officials stated that they have not developed Internet
absentee voting guidelines because the Commission and the organizations
that would normally provide assistance to it are directing their
constrained resources to other priorities. This includes addressing
challenges associated with electronic voting machines and establishing
a process for certification and accreditation. Additionally, the Help
America Vote Act of 2002 requires the Commission's Technical Guidelines
Development Committee to assist the Executive Director of the
Commission in developing voluntary voting system guidelines.[Footnote
40] The act also requires the Director of the National Institute of
Standards and Technology to provide the Development Committee with
technical support in developing those guidelines, including research
and development related to computer and network security, voter
privacy, remote access voting (including voting through the Internet),
and voting fraud.
Commission officials told us, however, that the Development Committee
has not been able to work on Internet absentee voting guidelines for
UOCAVA voters because it had other priorities and constraints on its
resources.[Footnote 41] In light of the Development Committee's low
priority for working on the Internet absentee voting guidelines,
officials from the Commission asked officials from the National
Institute of Standards and Technology to assist with developing the
guidelines. However, officials from the National Institute of Standards
and Technology said that they could not provide support because they
also lacked sufficient resources at the time. Commission officials told
us that, at the time of our review, the National Institute of Standards
and Technology was also using its resources to work with the
Development Committee on the current voluntary voting guidelines and
would not have sufficient resources to work on Internet absentee voting
guidelines until after July 2007.
Additionally, Commission officials stated that they were waiting for
DOD to provide information that describes the type of system around
which the guidelines should be developed. DOD officials, however,
stated that they gave the Commission reports that provided the
framework for the Internet-based absentee voting system they
envisioned. Specifically, these DOD officials told us that they
provided the Commission, in 2004, with a report on their 2000 proof of
concept for Internet-based voting called "Voting Over the
Internet,"[Footnote 42] and in March 2006, they provided the Commission
with an internal DOD document assessing the terminated SERVE project.
DOD and Commission officials told us that they had not communicated in
depth on the guidelines and the DOD system before our review.
The Election Assistance Commission Has Started a Study as a Precursor
to the Internet Absentee Voting Guidelines:
To gain a better understanding of the Internet voting environment, in
September 2006, the Commission started an Internet voting study as a
precursor to developing the Internet absentee voting guidelines. The
Help America Vote Act of 2002 required the Commission to conduct this
study to determine the issues and challenges presented by incorporating
communications and Internet technology into elections, including the
potential for election fraud, and to issue a report no later than June
29, 2004. However, the Commission did not meet this reporting date.
Commission officials told us that they were unable to complete the
study sooner--or even begin it--because of the resource constraints
they have worked under since the Commission's inception, and because
they were working on other priorities. They noted, for example, that
under the act, the Commission was to be established by February 26,
2003, but the Commissioners were not appointed until almost a year
later, in December, 2003. They also told us that, although 23 employees
were allocated to the Commission, they had to build up staff gradually,
starting in January 2004, by hiring two employees each month.
Accordingly, Commission officials testified in June 2004[Footnote 43]
that, as a result of these constraints, the Commission was able to meet
only some of its mandates, such as developing the 2005 Voluntary Voting
System Guidelines. As a result, the Commission was not able to conduct
the Internet voting study in a timely manner.
Commission officials stated that the Internet voting study, which was
underway during the course of our review, includes several case studies
to monitor current Internet voting usage and electronic transmission of
ballots. The four states participating in this part of the study are
Florida, Montana, South Carolina, and Illinois. The study also includes
(1) a survey of UOCAVA voters to collect information on their level of
interest in electronic voting and (2) a conference to gather states'
experiences on topics such as Internet voting, electronic transmission
of ballots, security risks for voting systems, and verification of
voters' identities. Commission officials told us that they plan to
issue a final report on the Internet voting study in September 2007.
The Commission Does Not Have a Plan for Assessing Security Issues and
Developing Internet Absentee Voting Guidelines:
The Ronald W. Reagan NDAA for Fiscal Year 2005 did not establish a
deadline by which the Commission was to complete the Internet absentee
voting guidelines, and the Commission has not set time frames for
itself, primarily because it has been working on guidelines for current
voting systems. Additionally, as stated previously, the Commission has
not completed the precursor Internet voting study to identify critical
issues and challenges such as those related to security and privacy.
Also, it has not established a plan, in conjunction with major
stakeholders like DOD, to develop appropriate guidelines for Internet
voting with specific tasks that would address security risks such as
those identified in its study and other security evaluations and
reports, as well as time frames and milestones.
In previous reports, we have noted that leading organizations develop
long-term results-oriented plans that involve all stakeholders and
identify specific tasks, milestones, time frames, and contingency
plans;[Footnote 44] this practice is also embodied in the underlying
principles of the Government Performance and Results Act of
1993.[Footnote 45] Similarly, without a plan for the UOCAVA Internet
absentee voting guidelines--including specific tasks, time frames,
milestones, necessary resources, and alternatives--the Commission
cannot inform Congress, FVAP, and local election officials when it will
meet the mandate to develop the required guidelines. As we previously
noted, some technologies may not yet be mature enough to support
Internet voting. Therefore, the plan for developing Internet absentee
voting guidelines may require an incremental approach that reflects
emerging solutions to security and privacy challenges, as well as
changing views on acceptable levels of risk and cost.
DOD Has Not Developed a Secure, Internet-based, Absentee Voting
Demonstration Project:
Similarly, DOD has not developed a secure, Internet-based absentee
voting demonstration project, as Congress mandated in the Ronald W.
Reagan NDAA for Fiscal Year 2005. DOD reported that the principal
objective of the Internet-based electronic demonstration project was to
assess the use of such technologies to improve UOCAVA participation in
elections. The department planned to conduct the project during the
first general election for federal office after the Commission has
established Internet voting guidelines for the project. However, DOD
has not moved forward with the electronic demonstration project
because, by law, the Commission must first develop the Internet
absentee voting guidelines.
DOD officials stated, as mentioned previously, that they provided
information to assist the Commission in developing the guidelines, and
Commission officials acknowledged that DOD had provided them with a
report on "Voting Over the Internet," DOD's assessment of its November
2000 Internet-based voting project, in 2004--the first year of the
Commission's operation. DOD also provided the Commission with an
internal document that contained information on its SERVE project.
However, Commission officials told us that they did not receive the
SERVE document until June 2006. This document discussed challenges DOD
identified with Internet voting, which included security threats such
as computer viruses, malicious insider attacks, and inadvertent errors
that could disrupt system performance.
In 2001, we also identified several challenges to Internet voting, such
as privacy and security.[Footnote 46] As previously mentioned, we
reported that broad application of Internet voting faced formidable
challenges, including the difficulty of providing adequate voter
privacy--that is, protecting the voter's ability to cast a ballot
without being observed. We further reported that, although not
unanimous on all issues, groups considering the pros and cons of
Internet voting were in consensus in identifying security as the
primary technical challenge for Internet voting. We also reported that,
because of the security risks involved, Internet voting would not
likely be implemented on a large scale in the near future. Moreover,
DOD officials told us that even if the Commission had developed
Internet voting guidelines at the time of our review, DOD would not
have been able to develop a secure, Internet-based, electronic
demonstration project in time for the 2008 presidential election. DOD
officials said that--depending on the Internet voting guidelines
provided by the Commission--the final system design, full development,
testing and deployment phases would take an estimated 24 to 60 months.
Furthermore, deployment of any system requires participation of the
military services, which have many additional, competing priorities
that may cause delays in deployment. Given that less than 17 months
remain before the November 2008 election, FVAP officials said there is
insufficient time to advertise and launch the Internet-based electronic
demonstration project.
DOD Was Developing Plans to Expand the Use of Electronic Voting
Technology in the Future, but Sound Management Practices Are Key:
We observed that DOD was developing, but had not yet completed, plans
to expand the use of electronic voting technology for UOCAVA voters use
in federal elections through November 2010, as required by the John
Warner NDAA for Fiscal Year 2007. DOD officials told us that they
anticipated providing the plans to Congress, in accordance with the
act, by May 15, 2007. Because electronic voting initiatives for the
absentee voting process (fax, e-mail, and Internet) involve numerous
stakeholders at the federal level--including DOD and the Commission--as
well as the various state and local levels, developing a plan is key.
Implementation of new electronic voting initiatives requires careful
planning, particularly in light of the remote location of troops, the
application of new technology, and the lead time required for
implementation. As DOD develops these plans, employing a comprehensive
strategic approach that incorporates sound management principles could
provide a framework for DOD's plans. Our analyses of DOD and Commission
documents and our interviews--including those with officials from these
agencies, organizations representing UOCAVA voters, and state and local
election officials--show that DOD did not obtain sufficient stakeholder
involvement in planning its recent electronic voting initiatives--the
2004 and 2006 IVAS initiatives. In fact, Commission officials mentioned
that DOD's recent initiatives took a "top down" approach and did not
seek input from the Commission or from local jurisdictions during the
planning stage. DOD officials noted that both the 2004 and 2006 IVAS
initiatives were planned, designed, advertised, and implemented just
months before those two elections. In the case of the 2006 IVAS,
however, the department reported that it developed the system within 79
days of passage of the mandate--June 2006--and noted that it was in
fact responsive to that mandate. The Commission and state and local
election officials noted that the aggressive schedules for these latest
electronic initiatives did not allow sufficient time to enable full
participation, training, and dissemination of information on the
efforts. Additionally, at the time of our review, DOD officials said
they had not yet established interim tasks that address issues such as
security and privacy, milestones, time frames, and contingency plans.
The principles of sound management used by leading organizations and
embodied in the Government Performance and Results Act of 1993[Footnote
47] provide a methodology to establish a results-oriented framework for
DOD to develop its detailed plans. Such a framework would provide a
firm foundation for DOD's long-term plan for electronic voting
initiatives. Some of the key management principles include (1)
involving stakeholders when defining the mission and outcomes, (2)
identifying specific actions and tasks, such as monitoring and
assessing security of the initiatives, (3) developing schedules and
time frames for tasks, and (4) evaluating the overall effort, with
specific processes to allow for adjustments and changes. Furthermore,
as we reported in one of our executive guides, leading organizations
plan for a continuous cycle of risk management. This includes
determining needs, assessing security risks, implementing policies and
controls, promoting awareness, and monitoring and evaluating
controls.[Footnote 48] Combined with effective leadership, these
principles provide decision makers with a framework to guide program
efforts and the means to determine if these efforts are achieving the
desired results.
In its December 2006 report to Congress on IVAS,[Footnote 49] DOD
stated the following:
* Development of a long-term strategic plan was necessary to ensure
that all related initiatives were effectively integrated, but this was
dependent on having sufficient time to assess, improve, and evaluate
new or evolving electronic alternatives.
* Major recommendations for its future electronic voting projects would
include, for example,
- recognizing the variation in state and local laws, procedures, and
systems;
- identifying and mitigating actual and perceived risks, by educating
people about risk management practices; and:
- building consensus among key stakeholders.
As stated previously, Commission officials told us that, for recent
initiatives, DOD did not seek input from the Commission or local
jurisdictions during the planning stage of these efforts. Without a
proactive, integrated, long-term, results-oriented plan that involves
all major stakeholders; includes goals, interim tasks--such as
identifying security risks and addressing privacy concerns--
milestones, time frames, and contingency plans; and follows the sound
management practices used by leading organizations, DOD is not in a
position to address congressional expectations to establish secure and
private electronic and Internet-based voting initiatives.
Conclusions:
It is imperative that the 6 million Americans who are covered under the
Uniformed and Overseas Citizens Absentee Voting Act have the
opportunity to exercise their right to vote--one of the hallmarks of a
democratic society. The fact that time is an issue with absentee voting
by regular mail has led many to look toward electronic and Internet
voting, which represent the next generation of voting technology, as
alternatives. While these alternatives may expedite the absentee voting
process, they are more vulnerable to privacy and security compromises
than the conventional methods now in use. Electronic and Internet
voting require safeguards to limit such vulnerabilities and prevent
compromises to votes from intentional actions or inadvertent errors.
However, available safeguards may not adequately reduce the risks of
compromise. To date, the Election Assistance Commission has not
assessed the risks or possible safeguards for Internet voting, nor has
it developed corresponding guidelines that define minimum Internet
voting capabilities and safeguards to be considered by the election
community. Furthermore, electronic and Internet-based absentee voting
can be challenging for UOCAVA voters, who reside at multiple locations
across the globe. These voters are also registered to vote in thousands
of local jurisdictions across 55 states and territories that employ
varying levels of technology--from paper ballots to faxes and e-mail.
DOD faces significant challenges in leveraging electronic and Internet
technology to facilitate this complex, global absentee voting process.
Delays in developing guidelines and a demonstration project have
resulted in two presidential elections passing without significant
progress in moving toward expanded use of electronic and Internet
absentee voting. DOD officials told us it is now too late in the cycle
to implement significant changes before the 2008 election. The
challenges of coordinating among numerous stakeholders--including DOD,
the Commission, and state and local election officials, as well as
organizations representing UOCAVA voters--are substantial, and, to
date, efforts to involve stakeholders in the planning stage of DOD's
recent initiatives have fallen short. This delay has left an
expectation gap between what Congress required and what has been
accomplished so far. Several steps would have to be taken to overcome
these challenges, including better coordination between the Commission
and DOD regarding their complementary roles in developing Internet
voting guidelines and the mandated demonstration project. Unless the
Commission and DOD move in a timely manner to assess the technology
risks, develop guidelines that address the risks, coordinate among
election stakeholders, and establish and execute prudent plans, they
are unlikely to meet the expectations of Congress and military and
overseas voters to establish a secure and private electronic and
Internet-based UOCAVA voting environment.
Recommendations for DOD:
To improve the security and accuracy of DOD's electronic and Internet
initiatives, we recommend that the Secretary of Defense direct the
Under Secretary of Defense for Personnel and Readiness to take the
following four actions:
* Comply with the information security requirements in the DOD
Certification and Accreditation Process guidance.
* Incorporate lessons learned into plans for future systems such as
those we identified, including adding cautionary statements to future
ballot request and receipt systems to warn UOCAVA voters to remove
personal data from their computers.
* Institutionalize a process to review online UOCAVA guidance to ensure
that DOD provides accurate and consistent information to UOCAVA voters.
* Create an integrated, comprehensive, long-term, results-oriented plan
for future electronic voting programs that specifies, among other
things, the goals to be achieved along with tasks including identifying
safeguards for the security and privacy of all DOD's voting systems--
both electronic and Internet. The plan should also specify milestones,
time frames, and contingencies; synchronize them with planned
development of the Commission's guidelines for Internet voting; and be
developed in conjunction with major stakeholders--including state and
local election officials, the Election Assistance Commission, overseas
voting groups, and each of the armed services. The plan should also
include initiatives that will be done well in advance of federal
elections, to allow adequate time for training and dissemination of
information on the options available to UOCAVA voters.
Recommendations for the Election Assistance Commission:
To improve the Election Assistance Commission's efforts to comply with
the direction from Congress to develop the Internet absentee voting
guidelines, we recommend that the Commission take the following two
actions:
* Determine, in conjunction with major stakeholders like DOD, whether
the Commission's 2007 Internet voting study and any other Commission
efforts related to Internet or electronic voting are applicable to
DOD's plans for Internet-based voting, and incorporate them where
appropriate.
* Develop and execute, in conjunction with major stakeholders--
including state and local election officials and DOD--a results-
oriented action plan that specifies, among other things, goals, tasks,
milestones, time frames, and contingencies that appropriately address
the risks found in the UOCAVA voting environment--especially risks
related to security and privacy.
Agency Comments and Our Evaluation:
In written comments on a draft of this report, DOD concurred with our
recommendations to (1) comply with the information security
requirements, (2) incorporate lessons learned into plans for future
systems--to include adding cautionary statements to warn UOCAVA voters
to remove personal data from their computers, (3) institutionalize a
process to review online UOCAVA guidance, and (4) create a
comprehensive, results-oriented, long-term plan for future electronic
voting initiatives. The department said that it will contract for
services to comply with the information security requirements and will
incorporate identified lessons learned into future registration, ballot
request, and ballot receipt systems. The department said that it has
already streamlined its online guidance by, among other things,
eliminating the archived "Publications" version of the Voting
Assistance Guide entirely; it will also establish a revised review
process for online information. DOD noted that these changes will
reduce the possibility of human error and simplify the review and
verification process of online information. Finally, DOD stated that it
was in full support of a long-term, comprehensive plan for future
electronic voting projects that would allow for sufficient time to
involve the major stakeholders, train, and disseminate information and
ultimately serve UOCAVA voters. The department said it looked forward
to working on this multiyear project plan in cooperation with the
Election Assistance Commission, the National Institute of Standards and
Technology, and other major stakeholders. It further stated that FVAP,
the Commission, and the National Institute of Standards and Technology
are scheduling a meeting to lay the groundwork for the plan. DOD's
comments are reprinted in appendix III. DOD also provided technical
comments, which we incorporated in the final report, as appropriate.
In its written comments, the Election Assistance Commission concurred
with our recommendations to (1) determine the applicability of the
Commission's 2007 Internet voting study and other Commission studies to
DOD's plans for Internet-based voting, and (2) develop and execute a
results-oriented action plan to provide guidelines that appropriately
address the risks found in the UOCAVA voting environment. The
Commission stated that it has already met with FVAP and the National
Institute of Standards and Technology and agreed to develop a time line
for creating the UOCAVA guidelines. The Commission's comments are
reprinted in appendix IV.
We are sending copies of this report to the Secretary of Defense and
the Under Secretary of Defense (Personnel and Readiness) and the
Commissioners of the Election Assistance Commission. We will also make
copies available to others upon request. In addition, the report will
be available at no charge on the GAO Web site at http://www.gao.gov.
Should you or your staff have any questions about this report, please
contact me at (202) 512-5559. Contact points for our Offices of
Congressional Relations and Public Affairs may be found on the last
page of this report. Key contributors to this report are listed in
appendix V.
Signed by:
Derek Stewart Director, Defense Capabilities and Management:
[End of section]
Appendix I: Scope and Methodology:
To assess DOD's electronic initiatives, we reviewed and analyzed
relevant laws, directives, and guidance. These included DOD Directive
1000.4, Federal Voting Assistance Program (FVAP), updated April 14,
2004; and DOD's Interim Department of Defense (DOD) Certification and
Accreditation (C&A) Process Guidance, dated July 6, 2006. We also
reviewed applicable requirements documents for DOD's electronic
efforts, as well as relevant reports by GAO, DOD, FVAP, the DOD
Inspector General, and others, including A Security Analysis of the
Secure Electronic Registration and Voting Experiment (SERVE), dated
January 21, 2004. In addition, we reviewed FVAP's 2006-2007 Voting
Assistance Guide and its Web site to ascertain what type of information
on electronic voting alternatives is provided to UOCAVA citizens.
We interviewed key program officials at the Office of the Under
Secretary of Defense for Personnel and Readiness's Federal Voting
Assistance Program (FVAP), the Business Transformation Agency, the
Defense Manpower Data Center, and Voting Action Officers from several
service headquarters. We also contacted officials from (1) election
organizations, including the National Association of Secretaries of
State and Joint Election Officials Liaison Committee and (2)
organizations representing UOCAVA voters, including those from the
National Defense Committee and the Overseas Vote Foundation. We made
contact with officials from 14 of the 16 state and local election
offices we called to obtain their perspectives on DOD's initiatives.
Specifically, we included all 11 states that had participated in DOD's
2006 Integrated Voting Alternative Site--some of which participated in
SERVE and other DOD programs and initiatives. We also included three
other states that had 10 or more military bases and had participated in
SERVE though not in IVAS. Table 3 lists the states we contacted and the
programs in which these states participated.
Table 3: State Offices Contacted and Programs Where the States Were
Participants:
1;
States contacted: Arkansas;
SERVE participants[A]: Yes;
IVAS Tool 1 participants[A]: Yes;
IVAS Tool 2 participants[A]: No.
2;
States contacted: Florida;
SERVE participants[A]: Yes;
IVAS Tool 1 participants[A]: No;
IVAS Tool 2 participants[A]: No.
3;
States contacted: Hawaii;
SERVE participants[A]: Yes;
IVAS Tool 1 participants[A]: No;
IVAS Tool 2 participants[A]: No.
4;
States contacted: Illinois;
SERVE participants[A]: No;
IVAS Tool 1 participants[A]: Yes;
IVAS Tool 2 participants[A]: No.
5;
States contacted: Indiana;
SERVE participants[A]: No;
IVAS Tool 1 participants[A]: No;
IVAS Tool 2 participants[A]: Yes.
6;
States contacted: Kentucky;
SERVE participants[A]: No;
IVAS Tool 1 participants[A]: No;
IVAS Tool 2 participants[A]: Yes.
7;
States contacted: Mississippi;
SERVE participants[A]: No;
IVAS Tool 1 participants[A]: Yes;
IVAS Tool 2 participants[A]: No.
8;
States contacted: Montana;
SERVE participants[A]: No;
IVAS Tool 1 participants[A]: No;
IVAS Tool 2 participants[A]: Yes.
9;
States contacted: North Carolina;
SERVE participants[A]: Yes;
IVAS Tool 1 participants[A]: Yes;
IVAS Tool 2 participants[A]: No.
10;
States contacted: Puerto Rico;
SERVE participants[A]: No;
IVAS Tool 1 participants[A]: Yes;
IVAS Tool 2 participants[A]: No.
11;
States contacted: South Carolina;
SERVE participants[A]: Yes;
IVAS Tool 1 participants[A]: No;
IVAS Tool 2 participants[A]: No.
12;
States contacted: Vermont;
SERVE participants[A]: No;
IVAS Tool 1 participants[A]: Yes;
IVAS Tool 2 participants[A]: No.
13;
States contacted: Virgin Islands;
SERVE participants[A]: No;
IVAS Tool 1 participants[A]: Yes;
IVAS Tool 2 participants[A]: No.
14;
States contacted: Washington;
SERVE participants[A]: Yes;
IVAS Tool 1 participants[A]: Yes;
IVAS Tool 2 participants[A]: No.
Totals;
States contacted: 14 states contacted;
SERVE participants[A]: 6 SERVE states contacted;
IVAS Tool 1 participants[A]: 8 IVAS Tool 1 states contacted;
IVAS Tool 2 participants[A]: 3 IVAS Tool 2 states contacted.
Source: GAO analysis of DOD data.
[A] While a number of jurisdictions were included under each of the DOD
programs listed, we spoke to at least one election official from each
state.
[End of table]
To determine the Commission's efforts to develop Internet voting
guidelines and DOD's efforts to develop the secure, Internet-based,
absentee voting demonstration project, we reviewed and analyzed
relevant laws, Commission reports, and to the extent they existed, the
Commission's strategic plan and other documents to ascertain its plans
and efforts to develop Internet voting guidelines for UOCAVA voters. We
also reviewed and analyzed various DOD requirements documents, GAO
reports, internal DOD reports, and other reports related to DOD's prior
Internet-based absentee voting initiatives--Voting Over the Internet
and SERVE--to ascertain, among other things, challenges and benefits
associated with Internet voting efforts. Additionally, we interviewed
key program officials within FVAP, including the Director and Deputy
Director of FVAP and the Project Manager for SERVE, who is currently
retired, along with officials on DOD's private sector Security Peer
Review Group. We also spoke with officials on the Commission's
Technical Guidelines Development Committee and with the National
Institute of Standards and Technology.
To ascertain DOD's efforts to develop plans to expand the use of
electronic voting technologies in the future, we reviewed and analyzed
laws, guidance, and reports to determine DOD's current and future plans
for the Internet-based absentee voting demonstration project.
Additionally, we examined, to the extent they existed, DOD's strategic
plan and other documentation to determine its current and future plans
for the Internet-based absentee voting demonstration project. We also
interviewed responsible officials within DOD about these plans--
including the Principal Deputy Under Secretary of Defense for Personnel
and Readiness and the Director and Deputy Director of FVAP.
We conducted our work from August 2006 through April 2007 in accordance
with generally accepted government auditing standards.
[End of section]
Appendix II: Examples of the Inconsistent Voting Assistance Guidance on
DOD's Web Site:
During the course of our review, we compared and analyzed the voting
assistance guidance provided on DOD's Federal Voting Assistance Program
(FVAP) Web site that covered electronic alternatives to mail. The
online links we reviewed included FVAP's: (1) 2006-2007 Voting
Assistance Guide (VAG)--a PDF version;[Footnote 50] (2) 2006-2007 VAG-
-an HTML version;[Footnote 51] (3) the archived 2006-2007 VAG--a PDF
version dated October 25, 2005;[Footnote 52] (4) changes to the
archived 2006-2007 VAG--called Errata Sheets; (5) News Releases; and
(6) the 2006 Integrated Voting Alternative Site (IVAS). While not
widespread, for 14 of the 55 states and territories, we found
differences in some of the guidance provided on these links.[Footnote
53] Table 4 shows the differences we identified.
Table 4: Inconsistencies Identified in Guidance on Electronic
Alternatives to Mail:
1;
State: California;
Differences identified: Both PDF versions and the HTML Voting
Assistance Guides state that only overseas military and overseas
citizens may receive and send the ballot by fax; IVAS instruction does
not restrict who can receive or send the ballot by fax;
Questions: Could an absentee ballot sent by fax by military personnel
within the United States be rejected if a voter covered under the
Uniformed and Overseas Citizens Absentee Voting Act relied solely on
IVAS for voting guidance?;
FVAP response: IVAS page was incorrect and was updated on1/25/07. The
instruction should have specified that Uniformed Servicemembers must be
overseas to receive and send the ballot by fax. By law, an absentee
ballot faxed from within the United States should be rejected;
GAO observation: Correction to IVAS has been verified.
2;
State: Colorado;
Differences identified: The News Release for Colorado on October 18,
2006, and IVAS "allow Uniformed Servicemembers deployed outside the
U.S. to request, receive, and return absentee ballots via e-mail.";
This is not reflected in the two PDF versions or HTML Voting Assistance
Guides, nor was an errata sheet created;
Questions: Would overseas uniformed voters know of the e-mail options
if they relied on the Voting Assistance Guide for voting guidance?;
FVAP response: The Voting Assistance Guide, PDF, HTML, and errata sheet
have been updated to reflect the change. Web site changes to the Voting
Assistance Guide were made January 22, 2007;
GAO observation: Corrections to PDF, HTML, and errata sheet have been
verified.
FVAP stated that the "Publications" version of the Voting Assistance
Guide in PDF format was the original book version of the Guide in
electronic form. Since it was considered an archived document, FVAP
officials stated that it was not intended for update; but, acknowledged
that this version could have been marked better as an archived
document. These officials have since deleted this version of the Guide
from their Web site.
3;
State: Illinois;
Differences identified: FVAP issued an errata sheet for Illinois on
September 29, 2006, and all changes except one are reflected in the
HTML and PDF "Publications" versions of the Voting Assistance Guide and
IVAS did not mention the change; Specifically, the change that is not
captured is in Item IIE (Uniformed Services): "The Publications" PDF
and HTML Voting Assistance Guides say Illinois does not allow receipt
of blank ballots by fax or e-mail and IVAS does not address this issue;
Questions: Would uniformed voters be aware of the fax and e-mail
provisions if they relied on IVAS, HTML Voting Assistance Guide, or
"publications" PDF version?;
FVAP response: The fax and e-mail provisions on the errata sheet and
the Voting Assistance Guide PDF are correct as accepted by the State of
Illinois. The IVAS page and the Voting Assistance Guide HTML were
missing the information about the City of Chicago and Suburban Cook
County allowing receipt of the blank ballot by fax or e-mail. The
information was added on both the IVAS and the HTML on January 26,
2007; See note below on "Publications" version of the Voting Assistance
Guide.[A];
GAO observation: Corrections to IVAS and HTML have been verified; FVAP
officials acknowledged that the "Publications" version of the Voting
Assistance Guide could have been marked better as an archived document,
and have since deleted this version of the Guide from their Web site.
4;
State: North Carolina;
Differences identified: FVAP issued a News Release and updated IVAS on
October 20, 2006, stating that North Carolina now allows all citizens
covered under the Uniformed and Overseas Citizens Absentee Voting Act
to, among other things, receive blank absentee ballots and return voted
ballots by fax. It also stated that the Federal Post Card Application
could be faxed or e-mailed; This information was not reflected in the
FVAP PDFs or HTML versions of the Voting Assistance Guide, nor was an
errata sheet created;
Questions: Would voters covered under the Uniformed and Overseas
Citizens Absentee Voting Act know of the fax or e-mail options if they
relied on the Voting Assistance Guide publications?;
FVAP response: Voting Assistance Guide pages updated to reflect
information contained in News Release on January 29, 2007; See note
below on "Publications" version of the Voting Assistance Guide.[A];
GAO observation: Corrections to PDF and HTML Voting Assistance Guide
and errata sheet have been verified; FVAP officials acknowledged that
"Publications" version of the Voting Assistance Guide could have been
marked better as an archived document, and have since deleted this
version of the Guide from their Web site.
5;
State: Rhode Island;
Differences identified: Rhode Island's Overseas Civilians instructions
for FVAP's PDFs and HTML Voting Assistance Guide include language in
Section IIIB stating that ballots "may be requested by using the
Federal Post Card Application, letter, telephone, fax, or e-mail.";
This language contradicts guidance in Section IIIE of the HTML and PDF
Voting Assistance Guides which only mentions fax transmissions;
Furthermore, the IVAS Web site says no e-mail is permitted;
Questions: Would overseas civilians know of the option to request the
blank ballot by e-mail if they relied on Section IIIE of the Voting
Assistance Guide or IVAS?;
FVAP response: The language in question does not refer to the ability
of the voter to request an absentee ballot via e-mail, but to request
that a copy of a state form (now discarded) be sent to them, which
could be requested by using a Federal Post Card Application, via fax, e-
mail, phone, etc. Given that the state form has been discarded, the
Voting Assistance Guide has been updated to reflect the change. Web
site changes to the Voting Assistance Guide were made January 29, 2007;
GAO observation: Corrections to the PDF, HTML, IVAS, and errata sheet
have been verified.
6;
State: South Dakota;
Differences identified: South Dakota's errata sheet from June 19, 2006
and the PDF Voting Assistance Guide require the Federal Post Card
Application be notarized for stateside military voters; This is not
mentioned as a requirement in IVAS, or the HTML or "Publications"
Voting Assistance Guide. (Specifically, these say that "no registration
or voting materials are notarized or witnessed.");
Questions: Would stateside military voters know that they are required
to have the Federal Post Card Application notarized if they rely on
IVAS, HTML or "Publications" Voting Assistance Guides instead of the
errata sheet?;
FVAP response: The change was made by South Dakota and approval signed.
The PDF and errata sheet were changed, the HTML was overlooked, and
correction was made January 26, 2007. The IVAS page did not contain
full instructions but referred the reader to the Voting Assistance
Guide instructions; See note below on "Publications" version of the
Voting Assistance Guide.[A];
GAO observation: Correction to the HTML has been verified; IVAS
referred the voter to the Voting Assistance Guide instructions; FVAP
officials acknowledged that "Publications" version of the Voting
Assistance Guide could have been marked better as an archived document,
and have since deleted this version of the Guide from their Web site.
7;
State: South Dakota;
Differences identified: South Dakota's errata sheet from October 4,
2006, and HTML and PDF Voting Assistance Guides allow voters covered
under the Uniformed and Overseas Citizens Absentee Voting Act to send
the Federal Post Card Application by fax and allow a voter to submit a
scanned application as an e-mail attachment; This is not reflected in
the "Publications" Voting Assistance Guide;
Questions: Would voters covered under the Uniformed and Overseas
Citizens Absentee Voting Act know of the option to send the Federal
Post Card Application by fax or via e-mail attachment if they relied on
the "Publications" Voting Assistance Guide?;
FVAP response: See note below on "Publications" version of the Voting
Assistance Guide.[A];
GAO observation: FVAP officials acknowledged that "Publications"
version of the Voting Assistance Guide could have been marked better as
an archived document, and have since deleted this version of the Guide
from their Web site.
8;
State: Utah;
Differences identified: Utah's errata sheet from May 11, 2006, and PDF
Voting Assistance Guide (uniformed services) states that registration
and voting materials are not notarized or witnessed; This is not
reflected in the HTML or PDF "Publications" version of the Voting
Assistance Guide; For example, the HTML Voting Assistance Guide says
that no notary or witness is required, but mentions certification;
Questions: Would uniformed voters know that they were not required to
have their voting materials notarized if they relied on the HTML or
"Publications" Voting Assistance Guide?;
FVAP response: Change was made to reflect Utah's election law and
approval signed. The PDF and errata sheet were corrected, however, the
HTML was overlooked. Correction was made January 26, 2007. See note
below on "Publications" version of the Voting Assistance Guide.[A];
GAO observation: Correction to the HTML has been verified; FVAP
officials acknowledged that "Publications" version of the Voting
Assistance Guide could have been marked better as an archived document,
and have since deleted this version of the Guide from their Web site.
9;
State: Vermont;
Differences identified: While the notary section of Civilian Outside
U.S. in the PDF Voting Assistance Guide has the statement about witness
requirements for the return ballot, it does not have the statement:
"However, your signature must be on the inside envelope certificate.";
This line is reflected in the HTML Voting Assistance Guide and in all
notary sections of the Uniformed Services Voting Assistance Guides;
Questions: Would overseas civilians know that their signature is
required on the inside envelope certificate if they relied on the PDF
Voting Assistance Guide?;
FVAP response: The PDF Voting Assistance Guide had the signed approval
of Vermont. The missing line was simply overlooked by the state and
FVAP and was updated on January 25, 2007;
GAO observation: Correction to the PDF has been verified.
10;
State: Alaska;
Differences identified: The HTML, "State-by-State" PDF Voting
Assistance Guide, and IVAS instruction allow e-mailing of the blank
ballot and voted ballot; This is not reflected in the "Publications"
version of the PDF Voting Assistance Guide for Alaska;
Questions: Would voters covered under the Uniformed and Overseas
Citizens Absentee Voting Act know of the option to e-mail the blank and
voted ballot if they relied on the "Publications" Voting Assistance
Guide?;
FVAP response: See note below on "Publications" version of the Voting
Assistance Guide.[A];
GAO observation: FVAP officials acknowledged that "Publications"
version of the Voting Assistance Guide could have been marked better as
an archived document, and have since deleted this version of the Guide
from their Web site.
11;
State: Oregon;
Differences identified: An errata sheet on August 22, 2006 for Oregon
and the HTML and PDF Voting Assistance Guides added, in addition to
faxing, the words "or e-mail" to the electronic transmission sections
in the Voting Assistance Guide; This information is not reflected in
the "Publications" version of the Voting Assistance Guide;
Questions: Would voters covered under the Uniformed and Overseas
Citizens Absentee Voting Act know of the option to use e-mail for their
voting materials if they relied on the "Publications" Voting Assistance
Guide?;
FVAP response: See note below on "Publications" version of the Voting
Assistance Guide.[A];
GAO observation: FVAP officials acknowledged that "Publications"
version of the Voting Assistance Guide could have been marked better as
an archived document, and have since deleted this version of the Guide
from their Web site.
12;
State: South Carolina;
Differences identified: An errata sheet and a news release on May 5,
2006 and the HTML and PDF Voting Assistance Guides announced that
voters are allowed to receive and return the ballot by fax or e-mail
under any conditions or circumstances; This information is not
reflected in the "Publications" version of the Voting Assistance Guide,
which only allows fax and e-mail for emergencies;
Questions: Would voters covered under the Uniformed and Overseas
Citizens Absentee Voting Act know of the fax and e-mail options if they
relied on the "Publications" Voting Assistance Guide?;
FVAP response: See note below on "Publications" version of the Voting
Assistance Guide.[A];
GAO observation: FVAP officials acknowledged that "Publications"
version of the Voting Assistance Guide could have been marked better as
an archived document, and have since deleted this version of the Guide
from their Web site.
13;
State: Texas;
Differences identified: FVAP issued an errata sheet for Texas on July
24, 2006, that changed the first bullet in both electronic transmission
sections, which says Texas allows voters to send the Federal Post Card
Application by fax; but adds "to request an absentee ballot and for
temporary registration only."; This information was in the HTML and PDF
Voting Assistance Guides but is not reflected in the "Publications"
version of the Voting Assistance Guide;
Questions: Would voters covered under the Uniformed and Overseas
Citizens Absentee Voting Act know the fax option was for only to
request the ballot and temporary registration, if they relied on the
"Publications" Voting Assistance Guide?;
FVAP response: See note below on "Publications" version of the Voting
Assistance Guide.[A]; The state of Texas only allows faxing to be used
to request a ballot and for temporary registration. It is not allowed
for the use of permanent registration. The impact on voters may be
negligible as these voters still receive ballots for two successive
election cycles;
GAO observation: FVAP officials acknowledged that "Publications"
version of the Voting Assistance Guide could have been marked better as
an archived document, and have since deleted this version of the Guide
from their Web site.
14;
State: Virginia;
Differences identified: An errata sheet for Virginia on July 20, 2006,
and the HTML and PDF Voting Assistance Guides allow only overseas
military members to receive the blank ballot by e-mail or fax upon
request; This information is not reflected in the "Publications"
version of the Voting Assistance Guide;
Questions: Would stateside military members know of the stipulation
that only overseas military members may receive the blank ballot by e-
mail or fax if they relied on the "Publications" Voting Assistance
Guide?;
FVAP response: See note below on "Publications" version of the Voting
Assistance Guide.[A];
GAO observation: FVAP officials acknowledged that "Publications"
version of the Voting Assistance Guide could have been marked better as
an archived document, and have since deleted this version of the Guide
from their Web site.
15;
State: Virginia;
Differences identified: An errata sheet for Virginia on July 20, 2006,
and the HTML and PDF Voting Assistance Guides changed the Civilian
language to "Some Virginia counties and cities allow you to receive the
blank ballot by e-mail or fax upon request."; This limiting information
"some" is not reflected in the "Publications" version of the Voting
Assistance Guide. It simply says that Virginia "allows you to receive
the blank ballot you e-mail or fax upon request.";
Questions: Would overseas civilians know of the stipulation that only
some Virginia counties and cities allow receipt of the blank ballot by
fax or e-mail if they relied on the "Publications" Voting Assistance
Guide?;
FVAP response: See note below on "Publications" version of the Voting
Assistance Guide.[A];
GAO observation: FVAP officials acknowledged that "Publications"
version of the Voting Assistance Guide could have been marked better as
an archived document, and have since deleted this version of the Guide
from their Web site.
16;
State: Wisconsin;
Differences identified: FVAP issued an errata sheet on July 24, 2006
for Wisconsin allowing voters to send the Federal Post Card Application
for absentee ballot request by fax or e- mail; This information is not
reflected in the "Publications" Voting Assistance Guide;
Questions: Would voters covered under the Uniformed and Overseas
Citizens Absentee Voting Act know of the option to send the Federal
Post Card Application by fax or e-mail if they relied on the
"Publications" Voting Assistance Guide instead of the errata sheet?;
FVAP response: See note below on "Publications" version of the Voting
Assistance Guide.[A];
GAO observation: FVAP officials acknowledged that "Publications"
version of the Voting Assistance Guide could have been marked better as
an archived document, and have since deleted this version of the Guide
from their Web site.
Source: GAO analysis of DOD information.
[A] FVAP stated that the "Publications" version of the Voting
Assistance Guide in PDF format
(http://www.fvap.gov/pubs/vag/pdfvag/2006-07vag.pdf) created on October
25, 2005, was the original book version of the Voting Assistance Guide
in electronic format. Since it was considered an archived document it
was not intended for update.
[End of table]
[End of section]
Appendix III: Comments from the Department of Defense:
Under Secretary Of Defense:
4000 Defense Pentagon:
Washington, D.C. 20301-4000:
Personnel And Readiness:
May 23 2007
Mr. Derek B. Stewart:
Director, Defense Capabilities and Management:
U.S. Government Accountability Office:
441 G Street, N.W.
Washington, DC 20548:
Dear Mr. Stewart:
This is the Department of Defense (DoD) response to the GAO draft
report, `elections: Action Plans Needed to Fully Address Challenges in
Electronic Absentee Voting Initiatives for Military and Overseas
Citizens,' dated May 9, 2007, (GAO Code 350900/GAO-07-774).
The Department concurs with the recommendations in the report. The
Director of the Federal Voting Assistance Program (FVAP) administers
the federal provisions of the Uniformed and Overseas Citizens Absentee
Voting Act (UOCAVA) on behalf of the Secretary of Defense. Since 1990,
the FVAP has had a proven record of success with electronic
alternatives to the by-mail absentee voting process and it continues to
coordinate with all major stakeholders in this process, including the
state and local level election officials and the U.S. Election
Assistance Commission. The Department welcomes input from the GAO and
will continue to make improvements to the program in order to better
assist citizens covered under the UOCAVA.
Thank you for your recommendations and the opportunity to comment on
this report.
Sincerely,
Signed by:
David S.C. Chu:
Attachment:
1. Comments to the Recommendations:
GAO Draft Report - Dated May 9, 2007 GAO Code 350900/GAO-07-774:
"Elections: Action Plans Needed to Fully Address Challenges in
Electronic Absentee Voting Initiatives for Military and Overseas
Citizens"
Department Of Defense Comments To The Recommendations:
Recommendation 1: The GAO recommends that the Secretary of Defense
direct the Under Secretary of Defense for Personnel and Readiness to
comply with the information security requirements in the DoD
Certification and Accreditation Process guidance.
DOD Response: Concur. The Department of Defense will contract for
services to comply with the Federal Information Systems Management Act
(FISMA) for the Electronic Transmission Service (ETS) through the DoD
Information Assurance Certification and Accreditation Process (DIACAP).
An extensive set of management, operational and technical controls is
currently in place to manage the possible risk to voters and the DoD
has begun the process to obtain the necessary certification and
accreditation of these controls.
Recommendation 2: The GAO recommends that the Secretary of Defense
direct the Under Secretary of Defense for Personnel and Readiness to
incorporate lessons learned into plans for future systems such as those
we identified including adding cautionary statements to future ballot
request and receipt systems to warn Uniformed and Overseas Citizens
Absentee Voting Act (UOCAVA) voters to remove personal data from their
computers.
DOD Response: Concur. The Department of Defense will incorporate
lessons learned for future registration, ballot request and receipt
systems, including warnings to remove personal data from computers to
guard against voters' personal information being compromised.
Recommendation 3: The GAO recommends that the Secretary of Defense
direct the Under Secretary of Defense for Personnel and Readiness to
institutionalize a process to review online Uniformed and Overseas
Citizens Absentee Voting Act (UOCAVA) guidance to ensure that DoD
provides accurate and consistent information to UOCAVA voters.
DOD Response: Concur. The Federal Voting Assistance Program (FVAP) has
already streamlined its online information considerably by eliminating
an archived 'Publications' version of the Voting Assistance Guide (VAG)
entirely, and by deciding to post only a 'PDF' version of the VAG's
State by State instructions for the 2007-2008 VAG. Additionally, the
FVAP will also establish a revised review process for online
information. These changes will reduce the possibility of human error
and simplify the review and verification process of online information.
Recommendation 4: The GAO recommends that the Secretary of Defense
direct the Under Secretary of Defense for Personnel and Readiness to
create an integrated, comprehensive, long-term, results-oriented plan
for future electronic voting programs that specifies, among other
things, the goals to be achieved along with tasks, milestones, time
frames, and contingencies, and synchronizes them with planned
development of the Commission's guidelines for Internet voting and
safeguards for the security and privacy of all DoD's voting systems -
both electronic and Internet. The plan should be developed in
conjunction with major stakeholders - including state and local
election officials, the Election Assistance Commission, overseas voting
groups, and each of the armed services. The plan should also include
initiatives that will be done well in advance of Federal elections, to
allow adequate time for training and dissemination of information on
the options available to Uniformed and Overseas Citizens Absentee
Voting Act (UOCAVA) voters.
DOD Response: Concur. The DoD developed and implemented comprehensive
plans for Voting Over the Internet and Secure Electronic Registration
and Voting Experiment. It is in full support of a long-term,
comprehensive plan for future electronic voting projects that would
allow for sufficient time to involve the major stakeholders, train and
disseminate information and ultimately serve UOCAVA voters. We look
forward to working on this multi-year project plan in cooperation with
the Election Assistance Commission (EAC), the National Institute of
Standards and Technology (KIST) and other major stakeholders. A joint
Federal Voting Assistance Program-EAC-NIST meeting is being scheduled
to lay the groundwork for "an integrated, comprehensive, long-term,
results-oriented plan for future electronic voting programs." We look
forward to working with the EAC as they take the lead on the
recommended 'action plan' and as we develop our long-term plan in
conjunction with them.
[End of section]
Appendix IV: Comments from the Election Assistance Commission:
U. S. Election Assistance Commission:
Office Of The Executive Director:
1225 New York Avenue, NW, Suite 1100:
Washington, DC. 20005:
May 25, 2007:
Mr. Derek B. Stewart:
Director, Defense Capabilities And Management:
Government Accountability Office:
Washington, DC 20548:
Re: Comments regarding proposed GAO-07-774 Report:
Mr. Stewart:
Thank you for the opportunity to comment on the GAO report entitled:
Elections: Action Plans Needed to Fully Address Challenges in
Electronic Absentee Voting Initiatives for Military and Overseas
Citizens (GAO-07-774) submitted to the Election Assistance Commission
(EAC) on May 10, 2007. The EAC appreciates GAO's accuracy in its
portrayal of the EAC and its current activities regarding military and
overseas voters. The EAC is grateful to GAO for its recognition of the
EAC's current research efforts to engage election officials and UOCAVA
voters prior to the development of these guidelines for military and
overseas voters. The EAC also accepts the recommendations as outlined
in the report and has begun efforts to achieve the goals as provided to
us in the recommendation.
As noted in your report, for the EAC's 2007 research on military and
overseas voters, the EAC is conducting the largest survey of UOCAVA
voters ever conducted. This survey of ten thousand UOCAVA voters is
designed to explore the challenges faced by those voters and determine
what solutions have been effective in meeting their unique needs as
overseas voters. At last update the EAC had received five thousand
replies to the survey and is anticipating more before the data is
compiled. As surveys go, this is an excellent response at this point in
the process. Based on the replies already received, the EAC is
extremely optimistic that the survey results will provide an invaluable
look into the UOCAVA experience, and guidance leading to the
development of guidelines that are realistic and effective. Also as
part of this study, the EAC is conducting case studies of four states
that are using new techniques in technology to meet the needs of their
UOCAVA voters. The EAC has scheduled a conference to discuss the
research results in September of 2007. The EAC will invite election
officials, FVAP, NIST, the Overseas Vote Foundation, and other
stakeholders to discuss the results of the research and possible
solutions to the problems UOCAVA voters face. Also at the conference,
the EAC will be conferring with officials from the four states that are
participating in the EAC's case studies in order to further explore the
unique ways that these states are meeting the demands of their military
and overseas voters, and thus help shape the agenda for future
guidelines development.
In response to one of the recommendations presented in the report, the
EAC would like to note its constant and continued use of election
officials in its projects. Besides the election officials who are
appointed to the three statutory boards who are regularly updated on
EAC projects, the EAC constantly updates election officials throughout
the country on research and ongoing projects in order to ensure the
work is accurate and useful. The EAC recognizes how important input
from these officials is and will continue to work with them, especially
those who use creative or new solutions to serve UOCAVA voters.
The EAC would like to reiterate its long held belief that National
Institute of Standards and Technology (KIST), because of its
internationally recognized technical expertise in developing standards,
is essential to the development of voting guidelines for UOCAVA voters.
NIST has in the past played a critical role in the development of
voting system guidelines. With NIST's guidance the EAC released the
newest version of the Voluntary Voting System Guidelines (VVSG) in
2005. Currently NIST is working with the EAC's Technical Guidelines
Development Committee to create the next iteration of the VVSG which is
a total re-write of VVSG 2005. NIST has consulted FVAP on a several
occasions in the past to assist them in regard to UOCAVA voting and the
use of the internet.
The EAC has met with FVAP and NIST and reached an agreement to work
over the next several months to develop a timeline for the creation of
UOCAVA guidelines. We all agree that the release of the EAC's UOCAVA
study in September 2007 will be an important first step in this process
as it will provide valuable information to help inform the guideline
development process. Prior to the release of our study, the EAC, FVAP,
and NIST will continue to meet in order to create a reasonable timeline
for the creation of the guidelines pursuant to your recommendations.
Again, the EAC would like to thank GAO for the careful analysis of our
work in this report and the recommendations to us. The Commission views
this issue very seriously and GAO's guidance on this matter is greatly
appreciated. We look forward to continued work with FVAP and NIST on
this matter and eventually the successful creation of realistic and
effective UOCAVA absentee ballot guidelines. Should you have any
further questions, please feel free to contact me at (202) 566-3109 or
twilkey@eac.gov.
Sincerely yours,
Signed by:
Thomas R. Wilkey:
Executive Director:
[End of section]
Appendix V: GAO Contact and Staff Acknowledgments:
GAO Contact:
Derek B. Stewart, (202) 512-5559 or stewartd@gao.gov:
Acknowledgments:
In addition to the individual named above, David E. Moser, Assistant
Director; Marion A. Gatling; Pawnee A. Davis; Amber M. Lopez; Joanne
Landesman; Paula A. Moore; John K. Needham, John J. Smale; and Julia C.
Matta made key contributions to this report.
[End of section]
Related GAO Products:
Elections: All Levels of Government Are Needed to Address Electronic
Voting System Challenges. GAO-07-576T. Washington, D.C.: March 7, 2007.
Elections: DOD Expands Voting Assistance to Military Absentee Voters,
but Challenges Remain. GAO-06-1134T. Washington, D.C.: September 28,
2006.
Elections: The Nation's Evolving Election System as Reflected in the
November 2004 General Election. GAO-06-450. Washington, D.C.: June 6,
2006.
Election Reform: Nine States' Experiences Implementing Federal
Requirements for Computerized Statewide Voter Registration Lists. GAO-
06-247. Washington, D.C.: February 7, 2006.
Elections: Views of Selected Local Election Officials on Managing Voter
Registration and Ensuring Eligible Citizens Can Vote. GAO-05-997.
Washington, D.C.: September 27, 2005.
Elections: Federal Efforts to Improve Security and Reliability of
Electronic Voting Systems Are Under Way, but Key Activities Need to Be
Completed. GAO-05-956. Washington, D.C.: September 21, 2005.
Elections: Additional Data Could Help State and Local Elections
Officials Maintain Accurate Voter Registration Lists. GAO-05-478.
Washington, D.C.: June 10, 2005.
Department of Justice's Activities to Address Past Election-Related
Voting Irregularities. GAO-04-1041R. Washington, D.C.: September 14,
2004.
Elections: Electronic Voting Offers Opportunities and Presents
Challenges. GAO-04-975T. Washington, D.C.: July 20, 2004.
Elections: Voting Assistance to Military and Overseas Citizens Should
Be Improved. GAO-01-1026. Washington, D.C.: September 28, 2001.
Elections: The Scope of Congressional Authority in Election
Administration. GAO-01-470. Washington, D.C.: March 13, 2001.
FOOTNOTES
[1] Pub. L. No. 99-410 (1986), 42 U.S.C. §§ 1973ff et seq.
[2] Voluntary voting system guidelines are to provide a set of
specifications and requirements to be used in the certification of
computer-assisted voting systems, both paper-based and fully
electronic; states are free to adopt these guidelines in whole or in
part or reject them entirely.
[3] In 1998, DOD had voluntarily initiated a proof of concept called
"Voting Over the Internet," which was a small-scale Internet-based
project used in the 2000 elections. DOD's report on this proof of
concept acknowledged that a larger-scale pilot would result in more
visibility and potentially attract those with malicious intent to harm
the system, but suggested ways to mitigate such future attacks. To
address these security concerns and other issues, Congress asked DOD,
in 2002, to develop a large-scale, Internet-based demonstration project
to ensure a methodical progression from the current mail-based process
to a secure, easy-to-use Internet registration and voting system.
[4] One of the primary objectives of the electronic demonstration
project was to assess the use of such technologies to improve UOCAVA
participation in elections.
[5] The conference report for the bill noted that DOD's prototype for
electronic voting was important and should not be abandoned and
encouraged the Secretary of Defense to provide funding to the
Commission to advance electronic absentee voting by UOCAVA voters. H.R.
Rep. No. 108-767, at 680 (2004) (Conf. Rep.)
[6] The Federal Voting Assistance Program reported that some states, by
law, allow voting materials to be sent by fax but not by e-mail.
[7] DOD, Interim Department of Defense (DOD) Certification and
Accreditation (C&A) Process Guidance, July 6, 2006.
[8] Emergency Supplemental Appropriations Act for Defense, the Global
War on Terror, and Hurricane Recovery, 2006. Pub. L. No. 109-234
(2006).
[9] FVAP reported that, since ballot requests could be printed and
returned through the mail or by fax instead of the secured server, an
accurate reporting could not be obtained through Tool 2. FVAP also
reported that ballot requests submitted using Tool 1 could not be
tracked and reported because voters sent the requests directly to local
election officials using their personal e-mail accounts, mail, or fax.
[10] GAO, Elections: DOD Expands Voting Assistance to Military Absentee
Voters, but Challenges Remain, GAO-06-1134T (Washington, D.C.: Sept.
28, 2006).
[11] UOCAVA voters in Florida, South Carolina, Texas, and Utah, who
were away from their legal residences, cast a total of 84 votes from
their homes, workplaces, or duty stations on personal computers.
[12] The U.S. Senate Committee on Armed Services report on Senate bill
1416 regarding the NDAA for Fiscal Year 2002 noted that the Voting Over
the Internet project was an important first step in assessing how to
use the Internet to enhance absentee voting; reducing traditional
barriers to participation in elections by absentee voters; and
providing insight into issues that must be considered for broader use
of remote registration and voting through the Internet. (S. Rep. No.
107-62, at 307 [2001]).
[13] GAO, Elections: Absentee Voting Assistance to Military and
Overseas Citizens Increased for the 2004 General Election, but
Challenges Remain, GAO-06-521 (Washington, D.C.: Apr. 7, 2006).
[14] Security Peer Review Group, A Security Analysis of the Secure
Electronic Registration and Voting Experiment (SERVE), January 21,
2004. The Security Peer Review Group consisted of 10 experts on
computer security and voting systems drawn from academia and the
private sector. As stated above, the report was written by 4 of the 10
experts.
[15] GAO, Elections: Voting Assistance to Military and Overseas
Citizens Should be Improved, GAO-01-1026 (Washington, D.C.: Sept. 28,
2001) and Elections: Perspectives on Activities and Challenges Across
the Nation, GAO-02-3 (Washington, D.C.: Oct. 15, 2001).
[16] Various approaches to Internet voting are possible, ranging from
the use of Internet connections at traditional polling stations to the
ability to remotely vote from anywhere (remote Internet voting). An
intermediate step along this range is an option referred to as "kiosk
voting," which uses conveniently located voting terminals provided and
controlled by election officials.
[17] Ballot secrecy refers to protecting the content of the vote.
[18] Voter privacy refers to protecting the voters' ability to cast
votes without being observed. In poll-site voting, voter privacy is
generally ensured by election officials and observers. However, we
reported that remote Internet voting would not protect voters' physical
privacy, leaving them open to the risk that they might be coerced
(through threats, bribery, or other forms of pressure).
[19] Other challenges that affect implementation of Internet voting
include the costs of the voting method versus its benefits and the
availability of Internet technology to voters.
[20] H.R. Rep No. 108-767, at 680 (2004) (Conf. Rep.)
[21] The FVAP reported that some states, by law, allow voting materials
to be sent by fax but not by e-mail.
[22] DOD, Interim Department of Defense (DOD) Certification and
Accreditation (C&A) Process Guidance, July 6, 2006.
[23] 5 U.S.C. § 552a.
[24] Pub. L. No. 107-347 (2002).
[25] OMB, Guidance for Implementing the Privacy Provisions of the E-
Government Act of 2002, September 26, 2003. (M-03-22).
[26] Every officer of election must retain and preserve all election
records and papers for certain federal elections for a period of 22
months from the date of the election. Civil Rights Act of 1960, § 301,
42 U.S.C. § 1974.
[27] States and territories participating in the 2004 IVAS included
Kansas, Kentucky, Maryland, Mississippi, Montana, New Mexico, South
Carolina, the Virgin Islands, and Wisconsin.
[28] Verification was made by the use of WebGuard, which determines the
status of an individual enrolled in the Defense Manpower Data Center's
Defense Enrollment Eligibility Reporting System database using that
individual's name, Social Security number, and date of birth. Ballot
requests saved and downloaded to the voter's computer for voters who
used Tool 1 and those requests sent to the election officials using
Tool 2 both include text indicating the forms were generated via IVAS.
[29] FVAP reported that, since ballot requests could be printed and
returned through the mail or by fax instead of the secured server, an
accurate reporting could not be obtained through Tool 2. FVAP also
reported that ballot requests submitted using Tool 1 could not be
tracked and reported because voters sent the requests directly to local
election officials using their personal e-mail accounts, mail, or fax.
[30] Congress directed DOD, in June 2006, to reestablish the 2004 IVAS
program. Congress also directed, in October 2006, that DOD continue
IVAS for the general election and all elections through December 31,
2006.
[31] DOD, Report on IVAS 2006, As Required by Section 596 of the
National Defense Authorization Act for Fiscal Year 2007, December 2006.
[32] FVAP reported that states and territories allowing e-mail of the
ballot request include Alaska, Colorado, Illinois, Indiana, Iowa (2006
only), Minnesota, Mississippi, Montana, North Carolina, North Dakota,
Oregon, Puerto Rico, South Dakota, Virginia, Washington, and Wisconsin.
[33] As reported by FVAP, 7 states require the full Social Security
number, 41 require the last 4 digits or driver's license, and 7 do not
require the Social Security number.
[34] DOD established this Web site in 1995.
[35] Service Voting Action Officers, for example, are responsible for
voting assistance operations within their service.
[36] PDF means Portable Document Format; it is a file that is used to
view electronic copies of paper documents, which allow an exact copy of
the paper document. HTML means Hypertext Markup Language and is used to
structure and format documents to be displayed on the World Wide Web.
[37] The Executive Branch's "Access Board," which consists of cabinet-
level officials from twelve federal agencies, among others, developed
standards to implement section 508 of the Rehabilitation Act, which
required federal agencies to have electronic information that is
accessible to people with disabilities on government Web sites. FVAP
stated that they provide access to an HTML version of their Voting
Assistance Guide on their Web site to comply with this act. They also
provide a PDF format of the Voting Assistance Guide for UOCAVA voters.
[38] GAO, Assessing Internal Controls in Performance Audits, GAO/ OP-
4.1.4 (Washington, D.C.: September 1990) and Standards for Internal
Control in the Federal Government (Exposure Draft), GAO/AIMD-98-21.3.1
(Washington, D.C.: December 1997).
[39] Pub. L. No. 108-375 § 566(c) (2004).
[40] These guidelines provide a set of specifications and requirements
to be used in the certification of computer-assisted voting systems,
both paper-based and fully electronic, and are voluntary--that is,
states are free to adopt them in whole or in part or to reject them
entirely.
[41] For example, Commission officials told us that the Development
Committee is working on updates to the Voluntary Voting System
Guidelines that were established in 2005. These guidelines will become
effective December 2007. The guidelines focus primarily on electronic
voting machines and ballot counters, but not on Internet voting systems
for UOCAVA voters.
[42] Department of Defense, Federal Voting Assistance Program: Voting
Over the Internet, June 2001.
[43] Statement of U.S. Election Assistance Commission before the U.S.
House Of Representatives, Committee on House Administration, dated June
17, 2004.
[44] GAO, Executive Guide: Effectively Implementing the Government
Performance and Results Act, GAO-GGD-96-118 (Washington, D.C.: June
1996) and Military Readiness: Navy's Fleet Response Plan Would Benefit
from a Comprehensive Management Approach and Rigorous Testing, GAO-06-
84 (Washington, D.C.: Nov. 22, 2005).
[45] Pub. L. No. 103-62 (1993).
[46] GAO-01-1026; GAO-02-3.
[47] Pub. L. No. 103-62 (1993). GAO/GGD-96-118.
[48] GAO, Executive Guide: Information Security Management, Learning
From Leading Organizations, GAO/AIMD-98-68 (Washington, D.C.: May
1998).
[49] DOD, Report on IVAS 2006.
[50] PDF means Portable Document Format; it is a file format that is
used to view electronic copies of paper documents, which allows an
exact copy of the paper document.
[51] HTML means Hypertext Markup Language and is used to structure and
format documents to be displayed on the World Wide Web.
[52] This 2006-2007 VAG was accessed at
http://www.fvap.gov/pubs/vag/pdfvag/2006-07vag.pdf; but DOD deleted
this link in February 2007.
[53] We found 16 instances in total. Two of the states had two separate
discrepancies identified.
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site (www.gao.gov). Each weekday, GAO posts
newly released reports, testimony, and correspondence on its Web site.
To have GAO e-mail you a list of newly posted products every afternoon,
go to www.gao.gov and select "Subscribe to Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office 441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125
Washington, D.C. 20548:
Public Affairs:
Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548:
