Our  reports were among the resources that Congress drew on in  enacting the Help America Vote Act (HAVA) of 2002, which  provided a framework for fundamental election administration  reform and created the EAC mission to oversee the election  administration reform process. Actions EAC has taken since 2004 to improve voting systems  include publishing the Best Practices Toolkit and specialized  management guides to assist states and local jurisdictions with  managing election-related activities and equipment;  issuing voting system standards in 2005, referred to as the  Voluntary Voting System Guidelines; establishing procedures for certifying voting systems; establishing a program for accreditation of independent testing  laboratories, with support from NIST’s National Voluntary  Laboratory Accreditation Program; disbursing to states approximately $2.3 billion in appropriations  for the replacement of older voting equipment and election  administration improvements under Title III of HAVA; and conducting national surveys of the 2004 general election,  uniformed and overseas voters, and other studies. Contextual Role and Performance Characteristics of Electronic Voting Systems Are Important to Understanding Their Use

Voting systems are one facet of a multifaceted, continuous elections  process that involves the interplay of people, processes, and  technology. All levels of government—federal, state, and local— share responsibilities for aspects of elections and voting systems. Such performance can be viewed in terms of several  characteristics, such as security, reliability, ease of use, and cost  effectiveness. Management of Electronic Voting System Performance Is a Continuous Process

The performance of any information technology system, including  electronic voting systems, is heavily influenced by a number of  factors, including how well the system is defined, developed,  acquired, tested, and implemented. Among other things, this phase includes  activities associated with the physical environments in which the  system operates. Reliability. Ease of use depends on how well  jurisdictions design ballots and educate voters on the use of the  equipment. Widespread Concerns about Electronic Voting Systems Have Been Reported

Election officials, computer security experts, citizen advocacy  groups, and others have raised significant security and reliability  concerns with electronic voting systems, citing, for example,  inadequacies in standards, system design and development,  operation and management activities, and testing. In 2005, we  examined the range of concerns raised by these groups and aligned  them with their relevant life cycle phases. We also examined EAC’s  efforts related to these concerns. Inadequate System Operation and Management Activities

Several reports raised concerns about the operational practices of  local jurisdictions and the actual performance of their respective  electronic voting systems during elections. These include incorrect  system configurations, inadequate security management programs,  and poor implementation of security procedures. Several  reports indicated that state and local officials did not always  follow security procedures. Regarding voting systems,  states’ and jurisdictions’ responses to our surveys showed that  differing versions of the national voting system standards were used  (not always the most current version); voting system life cycle  management practices were not consistently implemented; and  certain types of system testing were not widely performed. Roles and responsibilities. Addressing Voting System Challenges Requires the Combined Efforts of All Levels of Government

The challenges in ensuring that voting systems perform securely and  reliably are not unlike those faced by any technology user— application of well-defined standards for system capabilities and  performance; effective integration of the people, processes, and  technology throughout the voting system life cycle; rigorous and  disciplined performance of security and testing activities; objective  measurement to determine whether the systems are performing as  intended; and analytical and economically justified bases for making  informed decisions about voting system investment options. These  challenges are complicated by other conditions common to both the  national elections community and other information technology  environments: the distribution of responsibilities among various  organizations, technology changes, funding opportunities and  constraints, changing requirements and standards, and public  attention. Therefore, all  levels of government need to work together to address these  challenges, under the leadership of the EAC. To assist the EAC in executing its leadership role, we previously  made recommendations to the commission aimed at better planning  its ongoing and future activities relative to, for example, system  standards and information sharing. While the EAC agreed with the  recommendations, it told us that its ability to effectively execute its  role is resource constrained. The challenge facing all voting jurisdictions will be to ensure  that these activities are fully and properly performed, particularly in  light of the security and reliability concerns that have been reported  with electronic voting systems.
Why GAO Did This Study

Since the 2000 national elections, concerns have been raised by various groups regarding the election process, including voting technologies. Beginning in 2001, GAO published a series of reports examining virtually every aspect of the elections process. GAO's complement of reports was used by Congress in framing the Help America Vote Act of 2002, which, among other things, provided for replacement of older voting equipment with more modern electronic voting systems and established the Election Assistance Commission (EAC) to lead the nation's election reform efforts. GAO's later reports have raised concerns about the security and reliability of these electronic voting systems, examined the EAC's efforts to address these concerns, and surveyed state and local officials about practices used during the 2004 election, as well as plans for their systems for the 2006 election. Using its published work on electronic voting systems, GAO was asked to testify on (1) the contextual role and characteristics of electronic voting systems, (2) the range of security and reliability concerns that have been reported about these systems, (3) the experiences and management practices of states and local jurisdictions regarding these systems, and (4) the longstanding and emerging challenges facing all levels of government in using these systems.

What GAO Found

Voting systems are one facet of a multifaceted, year-round elections process that involves the interplay of people, processes, and technology, and includes all levels of government. How well these systems play their role in an election depends in large part on how well they are managed throughout their life cycles, which begins with defining system standards; includes system design, development, and testing; and concludes with system operations. Important attributes of the systems' performance are security, reliability, ease of use, and cost effectiveness. A range of groups knowledgeable about elections or voting systems have expressed concerns about the security and reliability of electronic voting systems; these concerns can be associated with stages in the system life cycle. Examples of concerns include vague or incomplete voting system standards, system design flaws, poorly developed security controls, incorrect system configurations, inadequate testing, and poor overall security management. For the 2004 national elections, states' and local governments' responses to our surveys showed that they did not always ensure that important life cycle and security management practices were employed for their respective electronic voting systems. In particular, responses indicated that the most current standards were not always adopted and applied, security management practices and controls were employed to varying degrees, and certain types of system testing were not commonly performed. Moreover, jurisdictions' responses showed that they did not consistently monitor the performance of their systems. In GAO's view, the challenges faced in acquiring and operating electronic voting systems are not unlike those faced by any technology user--adoption and application of well-defined system standards; effective integration of the technology with the people who operate it and the processes that govern the operation; rigorous and disciplined performance of system security and testing activities; reliable measurement of system performance; and the analytical basis for making informed, economically justified decisions about voting system investment options. These challenges are complicated by other conditions such as the distribution of responsibilities among various organizations and funding opportunities and constraints. Given the diffused and decentralized allocation of voting system roles and responsibilities across all levels of government, addressing these challenges will require the combined efforts of all levels of government, under the leadership of the EAC. To assist the EAC in executing its leadership role, GAO has previously made recommendations to the commission aimed at better planning its ongoing and future activities relative to, for example, system standards and information sharing. While the EAC agreed with the recommendations, it stated that its ability to effectively execute its role is constrained by a lack of adequate resources.