Hart Intercivic

Hart Intercivic eSlate

Make / Model: Hart Intercivic eSlate
Equipment Type: Direct Recording Electronic (DRE)

Summary

The Hart InterCivic eSlate is a direct recording electronic voting device. eSlate is typically used in polling places that have implemented a fully-electronic voting experience as an alternative to hand-marked paper ballots, for example. The eSlate electronic voting device allows voters to navigate through an electronic ballot presented on a display screen and mark choices. After voters are finished marking all their preferred choices, the device presents a “summary page” that allows voters to double-check their choices on their ballot. (And if voters skip any contests, the screen indicates “No selection.”) After voters have had the opportunity to review all choices on the summary page, to cast the ballot, voters select “Cast Ballot,” which causes their choices to be recorded directly in the voting device’s electronic memory.

Although eSlate is an electronic device, it is not a touch screen. Instead, the eSlate’s interface is dominated by a rotary wheel marked “Select,” which the voter uses to navigate and highlight different choices, and an “Enter” button, to mark choices. The eSlate device includes additional tactile buttons to page forward and back, to request help, and to cast the ballot.

eSlate devices can also be configured to support additional accessible features for voters with disabilities. Machines that are configured as “disabled access units” or DAUs, permit voters with visual, dexterity, or cognitive impairments to mark choices using audio and/or alternatives to the Select Wheel, such as paddles, or sip-and- puff devices.

eSlate voting devices are typically set up in polling places in series, i.e. in a “daisy chain” (like Christmas lights), on a single long chain of connected cords. The chain of voting devices is, in turn, connected to a poll worker console called the Judge’s Booth Controller. After voters check-in at the polling place, poll workers use the Judge’s Booth Controller to select the electronic ballot style that each voter needs. Poll workers also issue each voter a randomly-generated, anonymous four-digit Access Code, which corresponds to each voter’s ballot style. To start an electronic voting session on an individual eSlate device, each voter simply inputs the Access Code, and the ballot is displayed.

In most jurisdictions, the eSlate is deployed as an electronic-only device, with no paper records of each voter’s choices. In this paperless configuration, at the conclusion of each voting session, the voter’s choices are recorded directly in the voting device’s memory. However, a minority of eSlate jurisdictions deploy the voting device with an attached voter-verifiable paper audit trail (VVPAT). This enclosed unit, which is installed alongside the eSlate screen, has a spool-to-spool paper record under a clear plastic window, and it allows voters to verify their choices on paper before casting the ballot. Once the ballot is cast, the VVPAT advances the paper through the motorized spool until blank paper is displayed, to protect the privacy of the voter’s choices. The paper records of all electronic ballots cast are stored in the self-enclosed VVPAT unit, which is retained by election officials in case a post-election audit or recount is necessary.

Individual eSlate devices do not have tabulating capabilities; instead, after the polls close, poll workers use the attached Judges’ Booth Controller to tabulate results from all eSlate devices in the attached “daisy chain.” (The Judge’s Booth Controller consolidates the results.) The Judge’s Booth Controller can print out the race results and other information on a paper tape (if configured to do so).

Voting Process

When a voter enters the polling place, she registers as usual with a poll worker and signs her name into the poll book. If she wants to use the eSlate, a poll worker selects ”Add Voter” from the JBC’s main menu. The JBC produces a 4-digit access code, and the poll worker prints this access code for the voter on a small printout (looking like a traditional register receipt) with the date, time, location, precinct, and access code. The voter then goes to the eSlate, and ducks under a privacy screen that shields her actions from others’ views. The eSlate greets her with a welcome screen providing some basic instructions on how to operate the device. At this point, she has the option to navigate the eSlate using the wheel and buttons on the face of the device or to use an alternate input device. The eSlate is pre-equipped with two large buttons, called jelly switches, as an accessibility aid to those whose tactile skills do not lend easily to operating the eSlate with the embedded buttons. The jack into which these tactile inputs are plugged is a standard 3.5mm jack, allowing those who prefer to provide their own input device (such as a sip/puff device) to do so. Also available to the voter are a pair of standard headphones, or the option to plug in her own headphones, through which all operations on the eSlate will be narrated. This allows a voter with vision impairments to navigate the eSlate without assistance from a third party. The narration is given even if headphones are not used, but in that case the voter cannot hear the narration.

Once the voter has selected the input and feedback options best suited for her use of the eSlate, she is prompted to enter the access code she received from the poll worker. The eSlate verifies that the code is authorizedby communicating with the attached JBC. After her access code has been verified, eSlate displays the first page of the ballot. The voter can navigate through the ballot at her own speed by manipulating the wheel and buttons, or an assistive device. Once the voter has filled out the ballot to her satisfaction, she advances to the first ballot verification screen. If she makes a selection for every option on the ballot, she will be automatically advanced to this screen; she can, however, hit the ”Cast Ballot” button to manually advance herself to cast a ballot with fewer selections.

The eSlate then displays the first ballot verification screen, called the Ballot Summary Page. A two-column table presents every ballot option and the voter’s selection for that option, including a listing of ”No Selection” where applicable, in the order in which the options appeared on the ballot. If the voter is using the headphones, the eSlate will read the ballot to the voter. She can choose to make changes to selected options, in which case the eSlate returns her to the ballot to change her selections. Or, she can choose to accept the ballot as is. In this case, she advances to a second verification screen. At this point, the contents of the ballot selections are printed on the VBO printer, which is situated directly next to the eSlate screen. The voter is encouraged to verify her selections both on the screen and on the paper ballot. A visually impaired voter will be unable to verify the printout, but the eSlate will again read the ballot selections over the audio channel for her verification. If she wants to change something, she can reject the ballot at this point. In this case, the eSlate has the VBO print ”BALLOT REJECTED” on the paper ballot, and a barcode indicating that the voter rejected the set of ballot selections immediately preceding. The eSlate then returns the voter to the original ballot to change her selections. The voter may reject two printed ballots. After that, by law, the voter must accept the third printed ballot.

Voting Instructions

1. Select your language using the Wheel to move the highlight to proper one and push Enter.
2. Use the Wheel to input the access code given to you when you registered. This access code can only be used once.
3. Select candidates by highlighting their names, and using the enter key to make a selection. Undo a selection by pressing enter again. To vote for a write-in candidate, touch the Write-In line – a keyboard will appear. Type in the name of the candidate using the Wheel, touch the Record Write-In button to continue.
4. Review your choices on the Review screen, touch Record Ballot to cast your vote.

Checking The Voter-Verifiable Paper Trail

Some jurisdictions used Hart Intercivic eSlate DRE-Dial voting machines equipped a voter-verifiable paper trail called the Verified Ballot Option (VBO). The VBO printer is a reel-to-reel, cash-register style of printer. The VBO printout is found to the left of the display screen under glass. If the eSlate you are voting on is equipped with a VBO printer be sure to verify that your vote has been recorded correctly before casting your ballot.

After the voter reviews a ballot on the printout, accepting the ballot advances the paper to ensure that the last voter’s choices are not visible to the next voter. Canceling the ballot or changing the contents prints a voided status notice below the ballot. After the voter has changed her ballot and selected “cast ballot”, another ballot is printed for review and a barcode is written with the message “ballot accepted”. If the voter cancels their ballot more than the maximum number of permitted cancellations, the system forces the last ballot and VVPAT to be recorded. VVPATs that span multiple pages require the voter to inspect each page before scrolling to reveal subsequent pages. The VBO prints both human-readable text and machine-readable barcode. The barcode is a standard two-dimensional barcode that encodes the contents of the VVPAT and basic information about the election in which the vote was cast and the machine on which the ballot was cast. The Hart VVPAT can be configured with a serial number (called a “Ballot Key”) in order to detect duplicate ballots.2

When the voter accepts the ballot, the VBO prints ”BALLOT ACCEPTED” and a barcode directly below the human-readable printout of the voter’s selections. This barcode contains a machine-readable encoding of the ballot selections. The VBO then immediately spools the printed ballot out of sight so that the next voter cannot see it. Ballot acceptance also triggers a communication from the eSlate to the JBC to store the ballot contents. The vote is stored electronically on internal eSlate memory, internal JBC memory, and on a memory card known as the MBB (Mobile Ballot Box). The MBB is the primary record of the votes cast on an eSlate, and the data on the MBB is used to generate the results tabulated at the end of an election. At this point, the eSlate shows a blue screen that thanks the voter for voting, and displays a waving American flag. The voter instructions state that a voter knows her vote has been cast when she sees this flag. If she has been using the auditory feedback, she will hear a similar message through the headphones and will know that her voting process is complete.

Background

In 1997, Neil McClure and Kermit Lohry led a patent application for a new networked voting machine. In conception, the network-based aspects of the machine were not very different from the Fidlar ES 2000, but it was a full-face push-button machine. Initially, the developers founded their own company, Worldwide Election Systems, to market the machine they named The Elector. When it came time to market their system, they needed a partner. Hart Information Services, an established Texas ballot printer, bought several small election companies in the late 1990s, including Worldwide, before reorganizing as Hart Intercivic.

With support from Hart, McClure and his associates redesigned their system using a at-panel display, producing the machine they dubbed the eSlate. The eSlate saw successful use in the 2000 presidential election in Tarrant County, Texas and several other counties. It attracted significant attention with its features supporting the needs of voters with disabilities. [918] A few months later, the inventors applied for a patent for the eSlate.

Videos

A Voting Demo for the eSlate without VVPAT Printer

A Voting Demo for the eSlate with a VVPAT Printer

Security Concerns

Security Seals

Ideally, the eSlate’s and JBC’s exposed ports, memory card access areas and case seams would be covered with tamper-evident security seals. The integrity of these seals should be maintained at all times, and only breached under controlled, explained circumstances. Seals should be logged to maintain chain of custody of sensitive materials.

Cables Must Be Secured

The eSlate system is daisy-chained system where the JBC controls multiple eSlate terminals. The places where the first cable connects to the JBC as well as the area on the top of each eSlate where two of these cables connect are particularly sensitive. The last eSlate on the “daisy-chain” – likely the eSlate farthest from the JBC – is especially sensitive as it will have one cable coming from another eSlate, but will also have an exposed serial cable port. A malicious party could connect their own cable or device to this exposed port and essentially take control of the election, the software in the eSlate and JBC as well as vote data stored locally on each eSlate and remotely on the JBC. Ideally, this last exposed serial port will be covered or otherwise disabled. Jurisdiction should use security seals or protected serial cables that cannot be easily disconnected by voters (granted, this might make them difficult for poll workers to connect and disconnect).

VBO Is Sensitive And Sealed

The VBO, Hart’s VVPAT subsystem, is a sealed unit that stores official vote data. The unit should not be opened or serviced except infrequently under monitored and controlled circumstances so that all security seals are logged and reapplied. The entire VBO unit should be replaced when an error or jam occurs. The VBO, if jostled out of its place, can be made to interrupt or duplicate printing.

JBC And JBC Ports Are Sensitive

The JBC controller and the ports on the back of the JBC are sensitive. With access to the JBC, access codes can be printed out to allow duplicate voting. The ports on the back of the JBC should be covered or otherwise disabled. With access to these ports, a malicious party could take control of the election, activate arbitrary numbers of voter Access Codes, cast votes, erase votes and other things. Access to the JBC and to the area in the back of the JBC control panel where these ports reside should be monitored and controlled at all times.

MBB Memory Card Is Sensitive

Corrupt MBB cards can introduce viruses, cause the main election server to crash and falsify votes. Access to the MBB memory card should be controlled, monitored and logged at all times.

Manufacturer Profile

Hart Intercivic

15500 Wells Port Drive
Austin, TX 78728
Phone: 512.252.6400, 800.223.HART
Fax: 512.252.6466

hartintercivic.com

Hart entered the elections industry in 1912, printing ballots for Texas counties. The company, formerly a division of Hart Graphics, Inc., was established as a subsidiary called Hart Forms & Services in 1989, which, in 1995, changed its name to Hart Information Services, Inc. During the next five years, Hart Information Services acquired three election services providers: Texas County Printing & Services, Computer Link Corporation, and Worldwide Election Systems. Worldwide was the developer of the eSlate, Hart’s direct recording electronic (DRE) voting solution. In 1999, the company spun off completely from Hart Graphics and in 2000, the company became Hart InterCivic Inc.