The AccuVote TS and TSX are touch screen direct recording electronic voting machines that record votes on internal flash memory. Voters insert a “smart-card” into the machine and then make their choices by touching an area on a computer screen, much in the same way that modern ATMs work. Both systems offer a summary page once the voter has sequenced through the entire ballot, giving the voter an opportunity to verify their choices and to vote in any race they missed. The votes are then recorded to internal electronic memory.

The AccuVote TS/TSX is configured for each election by inserting a memory card into a slot behind a locked door on the side of the machine. The memory card is a standard PCMCIA flash storage card. Before the election, the file system on the memory card stores the election definition, sound files, translations for other languages, interpreted code that is used to print reports, and other configuration information. As each ballot is cast, the AccuVote TS/TSX stores an electronic record of the votes associated with that ballot onto a file on the memory card. At the close of polls, the AccuVote TS/TSX counts all of the votes and prints a summary tape showing the vote tallies. After the election, poll workers remove the memory card from the machine and send it to election headquarters so that the electronic vote records can be uploaded for tabulation.

Internally, the TSX contains much of the same hardware found in a general-purpose PC. It contains a 32-bit Intel xScale processor, 32 MB of internal flash memory, and 64 MB of RAM. The TSX runs version 4.1 of Microsoft’s Windows CE operating system with modifications written by Diebold. An application called BallotStation runs on top of the operating system and provides the user interface that voters and poll workers see. BallotStation interacts with the voter, accepts and records votes, counts the votes, and performs all other election-related processing. The TSX also contains a custom bootloader and other low-level support software.

Smart cards are used with the AccuVote TS/TSX to authenticate voters and poll workers. Each smart card is a piece of plastic in the shape of a credit card with an embedded computer chip that can communicate with the AccuVote TS/TSX when inserted into a slot on the side of the machine. Smart cards are used to authenticate voters. When a voter signs in, a poll worker gives them an activated voter card. The voter inserts the card into an AccuVote TS or TSX, and the machine allows her to cast one ballot. Once the vote has been recorded, the AccuVote TS/TSX deactivates the voter card so that it cannot be used to vote a second time. The voter returns the card to poll workers, who can reactivate it for subsequent voters. Alternatively, in some jurisdictions poll workers activate the voter card and then insert it into the AccuVote TS/TSX unit for the voter, so that voters do not have to insert it themselves. Supervisor cards are used to authenticate poll workers. The chief poll worker would normally be given a supervisor card. When the supervisor card is inserted into a TSX unit, the poll worker is presented with extra functionality not available to voters, such as the ability to close the polls or examine audit logs. Supervisor cards would normally not be provided to voters.

Voting Process: When the voter enters the precinct, he or she is confirmed as registered and then given a smart card by a poll worker. The smart card is a card the size and shape of a credit card and contains a computer chip, some memory, and basic data, such as the voter’s voting language and political party. The voter then takes the smart card to a voting machine and inserts the smart card into the machine to begin voting. After using the touch screen to vote, the record of the vote is directly recorded electronically to multiple, internal flash memory cards and the voter’s smart card is reset to ensure that it can only be used to vote once. The smart card pops out of the machine with a loud “click” and the voter returns it to a poll worker.

Checking the Voter-Verifiable Paper Trail: If the TSX is equipped with the voter-verifiable paper trail, the printer tape is located to the right of the touch screen under transparent plastic. Voting takes place as described above; however, at the conclusion of voting, a paper ballot is printed and displayed in the Accuview housing so that the voter can verify their selections before the ballot is deposited into a container within the printer module to await retrieval by poll workers.

Pollworker Information: When the polls close, a poll worker or election official inserts an administrator smart card into each voting machine and puts the machine into a post-election mode so it will no longer record votes. At this point, the machine writes the votes from its internal memory to flash memory on a PCMCIA card, a removable form of flash memory. A printed tape of all votes cast or vote totals for the voting machine can also be printed out at this time, depending on local procedure and regulations. The PCMCIA cards are taken out of each machine and either taken to a central tabulation facility or to remote tabulation facilities. At the tabulation facility the votes are read out of the PCMCIA cards and into a central computer database where precincts are combined to result in an aggregate vote. For remote facilities, the votes are transmitted to the central tabulation facility via a closed intranet, the internet, or modem. The PCMCIA cards and any printouts from the voting machines can then become part of the official record of the election.

Bob Urosevich, former president of American Information Systems, left AIS in 1995 to form I-Mark Systems. The new startup’s goal was to develop a voting kiosk that could be placed in shopping malls or other public places, with a “vote anywhere” model that eliminated the need for voters to go to their assigned polling places and had the potential to eliminate the need for poll workers. The prototype I-Mark kiosk enclosed an IBM PC and its CRT video monitor in a laminate-covered pedestal. Input was done with a light pen (a wand the voter could touch to the screen to make selections). The PC ran Microsoft Windows 95. After the prototype had been demonstrated and certied for use in Kansas in mid-1997, a second version of the Electronic Ballot Station was built. The bulky desktop PC inside the kiosk was replaced with what was essentially laptop computer technology, an at-panel display with a touch screen hinged to the top of a lightweight base that incorporated the computer and smart card reader. It was marketed as the EBS model 100, and was certied for use in Kentucky in the fall of 1997.

I-Mark was acquired by Global Election Systems (GES) in 1997. As part of the acquisition, Bob Urosevich was appointed Vice President of Sales and Marketing at Global. Since Global already had signicant market penetration with its Accuvote precinct-count ballot scanner, it was natural to rename the re-packaged EBS Model 100 the AccuVote-TS (touch screen), while the precinct-count scanner became the AccuVote OS (optical scan). The AccuVote TS was oficially announced on November 7, 2000, simultaneously with its first use in Mahoning County, Ohio. The announcement repeated Bob Urosevich’s vision of eventually migrating to the vote-anywhere model, while at the same time making clear that the AccuVote TS was fully functional as a stand-alone voting machine for precinct use. Diebold acquired Global Election Systems in January 2002. GES was renamed Diebold Election Systems (DES), and Robert Urosevich, who had been President of GES, became the CEO of DES.

After unsuccessful efforts to sell the election systems subsidiary, Diebold Election System’s name was changed to Premier Election Solutions in 2007 and Premier was made somewhat independent of Diebold. On September 3, 2009 Diebold announced that the company had sold its election system business to Election Systems & Software (ES&S) for only $5 million. There was an immediate outcry, because the sale would have given ES&S control over more than 75% of the voting machine market. Senator Charles Schumer (D) urged the Justice Department to probe the sale, warning that competition is needed to reduce chances of widespread election fraud. About a week after the announced sale, Hart InterCivic led a lawsuit against Diebold and ES&S, claiming that the sale posed a “significant and imminent threat of irreparable harm to the other vendors like Hart serving less than 20% of voting precincts…” On March 8, 2010 the Department of Justice announced that it was requiring ES&S “to divest voting equipment systems assets it purchased in September 2009 from Premier Election Solutions Inc. in order to restore competition.” Dominion Voting Systems, which purchased the assets that ES&S was forced to sell, subsequently purchased Sequoia Voting Systems.

VVPAT Cover

There is an opaque cover on hinges over the VVPAT viewing window. This cover is intended to give voters with visual impairment a higher degree of ballot privacy since they use the audio ballot and do not use the VVPAT for verification. Unfortunately, this cover can be shut inadvertently or not reopened after a voter with sight impairment votes. This cover should always be open unless a voter with a sight impairment is using the TSX. Alternatively, the cover can easily be removed from its hinges and re-attached when necessary.

Memory Cards

The TSX is susceptible to viruses transmitted through its memory card pack. Great care should be taken when handling the memory packs. A voter should never touch, remove, or otherwise mess with the TSX memory pack. Poll workers should only do so after polls have closed and the election is closed on each TSX terminal.

Security Seals

Many jurisdictions wisely employ tamper-evident seals to indicate when a machine might have been compromised. These seals look like stickers with serial numbers on them. When removed, they change color or otherwise indicate that the seal is no longer covering the security-sensitive area it was before. It is important than any seal that reads “VOID” or something similar that is still in place on a machine be reported immediately to poll workers. Places to expect security seals include over the power switch or the “close polls” button, over the memory card or memory card cover, and over the case seams as someone who gains access to the internals of a TSX by removing its case can install their own software on it.

Integrity of Electronic Voting Systems: Fallacious Use of Cryptography, Computer Science and Engineering Department, University of Connecticut (2011)
Top to Bottom Review, California Secretary of State (2007)
UC Berkekely Premier Source Code Review of the Diebold Voting System (2007)
California Secretary of State Premier Red Team Report
Documentation Assessment of the Diebold Voting Systems (2007)
Analysis of an Electronic Voting Machine, Tadayoshi Kohno, Adam Stubblefield, Aviel D. Rubin, and Dan S. Wallach, IEEE Symposium on Security and Privacy 2004. IEEE Computer Society Press (May 2004)
Trusted Agent Report — Diebold AccuVote-TS Voting System, RABA Technologies (2004)
DRE Security Assessment, Volume 1, Computerized Voting Systems, Summary of Findings and Recommendations, InfoSENTRY (Nov. 21, 2003)

Ohio Secretary of State Evaluation and Validation of Election-Related Equipment, Standards and Testing (EVEREST) Final Report (2007)
Standards and Testing (EVEREST) Final Report (2007)
EVEREST Premier Executive Summary (2007)
EVEREST Premier Technical Manager Report (2007)
EVEREST Premier Technical Details Report (2007)
SysTest Labs Technical Report (2007)
Security Assessment of the Diebold Optical Scan Voting Terminal, UConn VoTeR Center and Department of Computer Science and Engineering,University of Connecticut (2006)
Direct Recording Electronic (DRE) Technical Security Assessment Report, Compuware Corporation (2003)
Risk Assessment Report: Diebold Accuvote-TS Voting System and Processes (redacted), Science Applications International Corporation SAIC-6099-2003-261 (2003)