3). These systems are also designed not to allow overvotes. HAVA established the Election Assistance Commission  (EAC) and gave this commission responsibility for activities and programs  related to the administration of federal elections. Accrediting laboratories. Certifying systems. 4). However, in a series of recent reports, election officials, computer security  experts, citizen advocacy groups, and others have raised significant  concerns about the security and reliability of electronic voting systems,  citing instances of weak security controls, system design flaws, inadequate  system version control, inadequate security testing, incorrect system  configuration, poor security management, and vague or incomplete  standards, among other issues. In viewing these concerns, it is important to note that many involved  vulnerabilities or problems with specific voting system makes and models  or circumstances in a specific jurisdiction’s election, and that there is a lack  of consensus among elections officials, computer security experts, and  others on the pervasiveness of the concerns. System failures during elections. Recommended Practices Address Electronic Voting Systems’ Security and Reliability

Several federal, academic, and nongovernmental organizations have issued  guidance to help state and local election officials improve the election and  voting processes. This  compendium, among many suggested practices, includes activities to help  ensure a secure and reliable voting process throughout a voting systems’  life cycle. EAC, with the support of TGDC and  NIST, is in the process of updating voluntary voting system standards, is  establishing federal processes to accredit independent test laboratories  and certify voting systems to national standards, and is supporting state  and local election management by providing a library for certified software  and acting as a clearinghouse for information on voting system problems  and recommended election administration and management practices. Federal Initiatives to Improve Voting Systems Security and Reliability Are Under Way

EAC, in collaboration with NIST and TGDC, has initiated efforts on several  of its key responsibilities relating to the security and reliability of  electronic voting systems, including improving voting system standards,  developing a process to facilitate testing systems against the standards, and  supporting state and local governments’ election management. EAC has not yet determined when it will have a national program  for voting system certification in place. Software library. These concerns have led to action. Further, EAC  has not consistently defined plans, processes, and time frames for  completing these activities, and as a result, it is unclear when their results  will be available to assist state and local election officials. 2. Objectives, Scope, and Methodology

Our objectives were to (1) determine significant security and reliability  concerns that have been identified for electronic voting systems;  (2) identify recommended practices relevant to the security and reliability  of such systems; and (3) describe the actions that federal agencies and  other organizations have taken, or plan to take, to improve the security and  reliability of electronic voting systems. Federal Information System Controls Audit Manual (FISCAM).
Why GAO Did This Study

The Help America Vote Act of 2002 established the Election Assistance Commission (EAC) to help improve state and local administration of federal elections and authorized funding for state and local governments to expand their use of electronic voting systems. EAC began operations in January 2004. However, reported problems with electronic voting systems have led to questions about the security and reliability of these systems. GAO was requested to (1) determine the significant security and reliability concerns identified about electronic voting systems, (2) identify recommended practices relevant to ensuring the security and reliability of these systems, and (3) describe actions taken or planned to improve their security and reliability.

What GAO Found

While electronic voting systems hold promise for improving the election process, numerous entities have raised concerns about their security and reliability, citing instances of weak security controls, system design flaws, inadequate system version control, inadequate security testing, incorrect system configuration, poor security management, and vague or incomplete voting system standards. It is important to note that many of these concerns were based on specific system makes and models or a specific jurisdiction's election, and there is no consensus among election officials and other experts on their pervasiveness. Nevertheless, some have caused problems in elections and therefore merit attention. Federal organizations and nongovernmental groups have issued both election-specific recommended practices for improving the voting process and more general guidance intended to help organizations manage information systems' security and reliability. These recommended practices and guidelines (applicable throughout the voting system life cycle) include having vendors build security controls and audit trails into their systems during development, and having election officials specify security requirements when acquiring systems. Other suggested practices include testing and certifying systems against national voting system standards. The federal government has begun efforts intended to improve life cycle management of electronic voting systems and thereby improve their security and reliability. Specifically, EAC has led efforts to (1) draft changes to existing federal voluntary standards for voting systems, including provisions addressing security and reliability; (2) develop a process for certifying voting systems; (3) establish a program to accredit independent laboratories to test electronic voting systems; and (4) develop a library and clearinghouse for information on state and local elections and systems. However, these actions are unlikely to have a significant effect in the 2006 federal election cycle because important changes to the voting standards have not yet been completed, the system certification and laboratory accreditation programs are still in development, and a system software library has not been updated or improved since the 2004 election. Further, EAC has not consistently defined specific tasks, processes, and time frames for completing these activities; as a result, it is unclear when their results will be available to assist state and local election officials.