Process for voting in person at the Precinct on Election Day

There are two scenarios for voting directly at the precinct. The first scenario is Early Voting, which is voting during designated voting periods prior to Election Day. The second scenario is voting on Election Day. Both scenarios contain identical steps through much of its process, with the major difference in the close-out procedure for the final voting period on Election Day.

This process will highlight the meticulous steps that a typical process will incur. Note that this process is illustrated for a properly registered voter, voting at his assigned precinct, and the corresponding actions taken by precinct officials to execute the voting process for the voter, as well as in maintaining due vigilance in the processing of the ballots and voting equipment. This paper only lists the basic steps within the process, including typical navigation on voting equipment and the strict control of ballots in general.

Precinct Security and Initial Setup

Before the precinct is open for the first day of voting during this election, the precinct manager must ensure that the precinct is completely secure.

Setup at the precinct

The setup entails four major sections. Each section is controlled by the Precinct Supervisor, along with his Precinct Voting Witnesses.

1. Voter Check-in/Checkout
2. Polling Booth
3. Ballot Submission Box
4. Precinct Data Controller

The voter checks in with the check-in/checkout clerk. The clerk identifies his name and checks him in, and a timestamp is applied to his name indicating time of check-in.

Next, the clerk gives the voter his ballot. This ballot is pre-printed with the voter’s name and (optional) address, along with the Ballot ID No. The clerk verifies that the voter has received the ballot, a timestamp is applied to the name indicating time of ballot submission.

NOTE: While the two processes can and usually will take place at the same time, each gets its own timestamp for auditing purposes. This will be explained in an alternate step involving missing or non-registered voters.

The ballot is not just a simple piece of paper. It contains the following:

1. The top sheet is made of a heavy-grade paper stock that cannot be seen through, and contains the voter’s name, the voter’s VoterID, the Ballot ID, directional arrows pointing to the top, along with a scan code containing the Ballot ID.
2. Two sheets in same sleeve that cannot be easily breached by hand and cannot be separated cleanly by hand (no perforations). Each sheet has a carbonless face, contains the actual voting information that will be printed by the ballot printer, and collectively comprise the OFFICIAL vote. This will be explained in the next process. The two sheets are of different colors: Light yellow and light red (pink).
3. A final sheet that is a copy of the other two sheets; however, this sheet is mounted on its own perforation sleeve that is easy to tear off the back. Its color is light green.

The voter goes into the voting booth, which contains the Voting Booth Device (VBU). (Information on initialization and operation of the Voting Booth Device is located in the appendix.)

This device consists of two IO’s: A touch screen and a ballot input tray.

The first process step highlights the screen (each step will be referred to “the screen”) welcomes the voter and instructs the voter to enter his ballot into the tray. After reading the scan code, the screen displays the voter’s name, address, and election title on the screen, along with the current date and time. The voter clicks ok. The left side of the screen shows the races in the slate, with the first item highlighted. The main screen shows the highlighted name of the race. The list of people running for that race are all shown on the screen. The order of the candidates is shown in random order, though there may be a “subset” of prioritized candidate groups, particularly for major parties. For instance, the Democratic and Republican candidates may be prioritized to show as either position 1 or position 2, randomized between those two positions for each voter, while the subsequent candidates are randomized between position 3 and the last position.

All candidates are shown by authorized Ballot name, their party (“unaffiliated” for all unaffiliated candidates), and their authorized campaign picture (if available). In addition, there are always two more choices: “Write-in candidate” or “No selection.” In virtually every circumstance, only one candidate or entry may be selected. One of the following steps will occur:

1. Selecting a candidate shown on the ballot: If one of the displayed candidates is shown, then a popup screen activates, which shows the race, candidate information, and picture, and the question, “Is [Candidate name] the candidate that you selected for [office]?”
   1. If “Yes” is selected, then the selected candidate is applied to the race, and the next race or issue in the slate appears with its list of candidates or the issue to vote for.
   2. If “No” is selected, then the screen reverts to the original selection screen for this race.
2. Selecting “Write-in candidate”: A new screen is shown which depicts an on-screen keyboard. The voter now types in the name of the write-in candidate. This is followed by the popup screen activation, with the question, “Is [Candidate name] the candidate that you selected for [office]?” In addition, a disclaimer may be indicated to state that only candidates who are qualified for the position may actually receive the vote, otherwise the vote is disqualified.
   1. If “Yes” is selected, then the selected candidate is applied to the race, and the next race or issue in the slate appears with its list of candidates or the issue to vote for.
   2. If “No” is selected, then the screen reverts to the original selection screen for this race.
3. If “No selection” is selected, then a popup screen activates, which shows the race and the question, “Are you sure you wish to skip this race?”
   1. If “Yes” is selected, then a popup activates, displaying “The race for the office of [race type] will be skipped,” and the next race or issue in the slate appears with its list of candidates or the issue to vote for.
   2. If “No” is selected, then the screen reverts to the original selection screen for this race.

Once the slate is completed, the complete list is presented to the voter in the final screen, in order of the races on the slate, along with the selection by the voter. The voter is given one more opportunity to change his vote on any of the issues. This is done by selecting the candidate or issue he wishes to change. After selecting it, that selected race will show up with the list of candidates, with his current selection highlighted on the screen. After the voter changes his selection and confirming the popup message indicating his new candidate selection, his write-in keyboard screen if he elects to select a write-in candidate, or “No Selection” if he decides not to vote on that race, the screen reverts to the final confirmation screen. Once the voter finishes the confirmation process, he clicks “OK.”

At this time, the ballot is printed. Once the printing is finished, the screen notifies the voter to remove the ballot. After removing the ballot from the slot, the screen tells the voter to remove the last page from the ballot, informing the voter to either keep the copy for his records or own use (advising to pocket or fold it to keep it secure from prying eyes), or to shred it before leaving the precinct at the shredding machine by the check-in/checkout table. The last question the screen asks if the final page was removed from the ballot, after which the machine defaults to its idle position. (Note: the ballot sheet will only have the voter ID on it to identify the voter, as well as the Vote Transaction ID to identify the actual vote transaction. No other personal information is shown to ensure immediate association with an individual and his vote selections.)

The voter returns to check-in. The voter removes the back copy of the ballot. If the voter has not removed the back copy, the clerk reminds him. Once he removes the copy, the clerk takes the ballot and enters it into the Verified Registered Voter Ballot Receptable. Note that the ballot will not be able to enter the machine without the removal of the green copy. The BR prints and dispenses a confirmation receipt for the voter, after which the clerk completes the checkout process with the voter. The receipt contains the Vote Transaction ID number, Vote Transaction Type (ID), the date, time sequence, and precinct. The voter should keep this for future confirmation of his particular vote, including the ability to look up the actual vote at the regional precinct office (explained later).

At official closing time, if there is anyone waiting in line, they are given an Extended Voting Time marker. This indicates that these voters are authorized to vote, and timestamped, after official closing hours, and allowed to vote during the Extended Voting Time period. Each marker has its own ID, and must be entered at check-in and check-out, to indicate that the voter had legally voted. In addition, the ballots must be entered into the check-in/check-out machine by the Supervisor or his immediate delegate, using the password each time a ballot is entered to ensure the integrity of the late entry. This ensures that subsequent additions to the Ballot Receptable are accounted for on a voter-by-voter basis.

Note: The following process only applies to single-day voting election sessions. For multiple-day voting, see next section.

At Close of Final Election Day Voting Session

Once the final voter has checked out, the Precinct Manager takes the Initial Vote Corroborative Device (IVCD) to close out, in order: The Check-in/Checkout stations, the Ballot Receptables, and each Voting Booth Device. Keep in mind there is no actual ability for any of the devices to transmit or expose data, other than through the IVCD, while the devices are under precinct control.

First, the Precinct Manager starts the closeout process on the main computer serving the Check-in/Checkout stations. He inserts the IVCD into the machine, then checks the display to verify that all voters who checked in, also checked out with competed ballot submissions. If the verification is positive, the PM writes his initials onto the IVCD and removes the device from the check-in/checkout station. The CI-CO machines and terminals are now deactivated. An emergency process to reactivate them is discussed later.

Next, he inserts the IVCD into the Verified Registered Voter Ballot Receptable. The IVCD checks the voter ID’s and Ballot ID’s against the entries made from the CI-CO data. If they match (as they always should), the PM writes his initials into the IVCD. Note that this receptable contains the OFFICIAL verified ballots of record. At this point, the Receptable is officially closed for new ballots, and its process transforms to “awaiting first stage of ballot verification” as its contents inside awaiting to be processed.

Next, he inserts the IVCD into the Provisional Voter Ballot Receptable. The IVCD checks the voter ID’s and Ballot ID’s against the entries made from the CI-CO data. If they match (as they always should), the PM writes his initials into the IVCD. At this point, these ballots are provisional and the Receptable is officially closed for new ballots, and its process transforms to the first state of ballot verification as its contents inside awaiting to be processed through the Provisional Voter Verification Process at the regional location before the ballots are either officially counted or officially rejected.

Finally, he goes to each polling booth machine, takes off the panel, inputs the password to unlock the port, then inserts the IVCD into the machines. All Ballot ID’s and Voter ID’s must cumulatively match all polling booth machines. Once that is verified, the PM initials the results of the IVCD. Note that all voting data is being transferred onto the IVCD from each machine.

At this point, the voting booth machines are not only shut off, but they are also completely deactivated from further use, their data transferred onto the internal firmware for verification purposes within the statutory period before being completely re-initialized for future use.

Once everything is deactivated, the IVCD is taken to the Precinct Control Unit (PCU) and inserted into the port. The IVCD contains this information (all public unless otherwise noted):

1. Count of all registered voters
2. Count of all provisional voters
3. Timestamps of all voters of the following:
   1. Check-in
   2. Ballot acceptance
   3. Insertion of ballot into Voting Booth Device
   4. Acceptance of voting rules
   5. Corroboration that all votes have been correctly entered
   6. Removal of ballot from Voting Booth Device
   7. Removal of last sheet on ballot
   8. Ballot submission
   9. Checkout

NOTE: Each step must corroborate with other steps as relevant. In additions, some timestamps my indicate simultaneous actions above, providing they are in sequence.

• Total votes for each race on slate
  • Votes from verified voters
  • Votes from provisional voters
• Total votes for each candidate in each race, or non-candidate referendums
  • Votes from verified voters
  • Votes from provisional voters
• Total votes for each race on each voting booth device
  • Votes from verified voters
  • Votes from provisional voters
• Total votes for each candidate on each voting booth device
  • Votes from verified voters
  • Votes from provisional voters
• Total ballots entered into verified voter ballot box
• Total ballots entered into provisional voter ballot box

During each step of the process above, each step must match up with previous process steps when relevant. For instance, all counts for ballots in verified voter ballot box must match the counts for all verified voter check-ins, as well as cumulative total of verified voters in each voting booth device. Verification accuracy can be calibrated, as necessary.

Once all verification steps are completed, the following power-down sequence must be performed:

1. Power down of each voting booth
   1. Removal of power cord from power supply
   2. Locking power switch connector
   3. Applying warranty seal and initialing its application by the PM
2. Power down verified voter ballot box
   1. Removal of power cord from power supply
   2. Locking power switch connector
   3. Applying warranty seal and initialing its application by the PM
3. Power down provisional voter ballot box
   1. Removal of power cord from power supply
   2. Locking power switch connector
   3. Applying warranty seal and initialing its application by the PM
4. Power down check-in/checkout station boxes
   1. Removal of power cord from power supply
   2. Removal of connecting cables to main Precinct Control Unit
   3. Locking power switch connector
   4. Applying warranty seal and initialing its application by the PM

Once all steps have been performed, all devices must be placed into the Transport Crate and locked BUT NOT SEALED, and the Transport Crate must remain out of public access zones.

Creation and Distribution of Voter Information statistics

This process may be open to revision. For now, the following sequences must be followed.

1. The IVCD must print all reports derived from the IVCD, making three copies, making one set of copies at a time. The sets of the copies are as follows:
   1. One set for the State Voting Control location under direct auspices of the Voter Registrar for the state
   2. One set to accompany the voting equipment in the Transport Crate
   3. One set to remain in the precinct safe
2. The set for the SVC will be inserted into a pre-addressed insured, registered mail packet to take to the USPS branch when it is open in the morning, and places it into the Precinct Safe. This set will be sent to the State Voting Control location under direct auspices of the Voter Registrar for the state.
3. The next set will be signed off and placed into an envelope that will accompany the devices in the Transport Crate.
4. The last set of copies will remain in the Precinct Safe until the State Registrar validates the election, usually in the following month, after which the copy should be filed within a local official government office (city, county), in a controlled, but unclassified (FOIA request-enabled) status.

Once these steps are finished, then the transmission of the voting results can be processed.

Transmission of Voting Results

It must be duly noted that at no time was any device or apparatus connected to the Internet or outside digital network, either through hard wire (ethernet cable) or through wireless means. In addition, all machines are constructed with military-grade RF technology that precludes interception of electronic data transmission through leakage. Now that all devices and other apparatus are properly decommissioned, the transmission of results can be performed. The IVCD should still be inserted into the machine, so the following sequence should be performed by the PM:

1. Press Ctl+Alt+Del (control-alternate-delete) keys to bring up the special menu.
2. The menu will show a screen that will inform the PM to connect the Internet cable.
3. The PM physically connects the cable. (It should be noted that the computer does not work on a commercial or conventional operating system but is a system specifically created for precinct purposes.)
4. Once the computer determines the Internet is connected, it displays the precinct number, the Precinct Manager, and a password box. The PM puts in his designated Precinct password.
5. Once the activation is done, the State office is notified. Once notification is acknowledged, another password box appears. This will be the encrypted password for transmission. NOTE: Telephonic contact may or may not be made between the Precinct Manager and the Regional or State office representative, but not necessary in this process (although it would probably be a good verification component).
6. The PM enters the password into the box.
7. Once confirmation of the password is accepted, the PM is prompted with the “Ready to Send” message.
8. The PM presses the Send button. The data is sent through highly encrypted means to be determined.
9. Once the data is sent, the PM is notified, and prints three copies of the acknowledgement for successful transmission.
10. Once signed by the PM, the reports are processed as follows:
    1. One report is included in the envelope addressed for the State Voting Control location
    2. One report is included in the Transport Crate
    3. One report is left in the Precinct Safe until the State certifies the votes in the following weeks.

The reports are now ready for distribution. This method is explained in the section “Electronic Results Processing and Public Release” below.

Precinct Closure

Once all the reports are sent, the Precinct Manager unlocks the Transport Crate and performs the final inventory check. After signing off on it, he includes all accompanying documentation, and locks the crate with the lock. After locking, he puts on the tamperproof seal that will be verified upon receipt at the regional or state voting location. At this time, he turns the security of the crate over to the service contracted for the Ballot Security, Possession and Transport Authority.

Transport and disposition of Transport Crates

Transport Crates will be transported by BSPTA agents as securely as any financial or legal documents are done. Ideally, armored trucks will be purposed for this detail, with all top security procedures (Ground-based GPS control, contracted police escorts, etc.) in place as deemed appropriate.

Regional Ballot Certification facilities are designated to control all ballots, including secure temporary storage, highly monitored vote-counting tasks, and 100% audit trails.

Once all crates have been received and signed for by the Regional Manager or his authorized delegate, he removes the ballot receptacles from the crates. They are signed off the crate. All other equipment in the crates is also inventoried and signed off but stay in the crates. Once all items are in order, the crates are sealed and taken to their hibernation chamber, awaiting recalibration and assignments for their next use.

The ballot receptacles, once removed, stay together throughout the rest of the process within their own precinct. There will be two, three, or more receptacles per precinct which must be physically secured at all times.