To: Chair Circosta and Members Black, Carmon and Raymond From: Stella Anderson Date: December 2, 2019 Re: Board Consideration of ES&S Request for Certification of EVS 5.2.4.0 I write to explain why I asked that the Board consider the request of ES&S to certify EVS 5.2.4.0 and why I believe administrative approval of certification is inappropriate. Important in this consideration are the requirements of our Certification Program and our experience with ES&S in the process of certifying 5.2.2.0 and in submission of their September 9 request for certifying 5.2.4.0. Contrary to the representation of ES&S in their September 9, 2019 request, the changes they have made in the 5.2.4.0 system, relative to the system we previously certified on August 23, are not mere enhancements. ES&S invoked 08 NCAC 04 .0302(b) as providing authority for the Executive Director’s administrative approval by casting the changes as enhancements. They failed to acknowledge the governing authority of the Certification Program requirements that they are held to by virtue of pursuing NCSBE voting system certification. If we examine how the EAC considered the 5.2.4.0 system, they required VSTL conformance testing and, as stated in the Certificate of Conformance (June 5, 2018), considered EVS 5.2.4.0 as “a modified voting system configuration that includes upgrades to the components of the EVS 5.2.3.0” (Page 3 of 12). Nowhere in the Certificate of Conformance does the EAC recognize this system as representing de minimis changes. Further, 5.2.4.0 is two systems removed from the 5.2.2.0 system we certified. If you examine the EAC Certificate of Conformance for EVS 5.2.2.0 (February 27, 2017) you will find a number of “ECO’s (Baseline Certification Engineering Change Order’s) certified with the voting system” depicted as either “Non-DeMinimis” or “DeMinimis” (page 14 of 15). You find no such notations in the Certificate of Conformance for EVS 5.2.4.0. The EAC’s Voting System Testing and Certification Program Manual (Version 2.0 effective May 31, 2015) states the following with regard to de minimis changes: • • • 3.3.3.Modification. A modification is any change to a previously EAC-certified voting system’s hardware, software, or firmware that is not a de minimis change. Any modification to a voting system will require testing and review by the EAC. 3.4.3.1. VSTL Review. Manufacturers must submit any proposed de minimis change to a VSTL and the EAC for review and endorsement…The VSTL will review the proposed de minimis change and make an independent determination as to whether the change meets the definition of de minimis change or requires the voting system to undergo additional testing as a system modification. 5.12.4. De Minimis Change. Voting systems previously certified and implementing an approved De Minimis Change Order (per Chapter 3) will not be issued a new certification number and are not required to implement a new naming convention. EVS 5.2.4.0 was a modification and as such required VSTL testing as a system modification and was assigned a new system certification number. So it is simply inaccurate to claim the 5.2.4.0 changes were considered by the EAC as de minimis or to further advocate that the NCSBE could proceed with administrative approval rather than Board approval of the system. The Board needs to decide what we will require of ES&S at this juncture before granting certification. At a minimum, we need to require the state-level testing and evaluation required by law and our Certification Program. Further, if you compare the declaration of system changes ES&S outlined in their September 9 request letter with the changes Executive Director Brinson-Bell describes in her November 27 report and Recommendation for Administrative Approval, you will find significant differences in the descriptions for changes in both the ExpressVote and DS200 components of the system. Since NCSBE staff have not overseen a Simulated Election Event employing this system or otherwise evaluated the functional effectiveness in an end-to-end test of the system, we are not in any position at this juncture to determine the system “does not and will not compromise the reliability, accuracy, user-friendliness, or secure operation and maintenance of that system.” (Certification Program Section 3.3.4.12) We must seriously examine the information ES&S has provided for our initial certification and their subsequent request for consideration of the modified system. If we do so, we can conclude nothing less than submission of inaccurate and misleading information at multiple points in the process. Following our certification of EVS 5.2.2.0 when the ‘end-of-life’ issues for the ExpressVote were brought to light, we were given assurances that they were prepared to fulfill NC contracts with the ExpressVote units we certified. They had, in fact, already told Tennessee and Michigan, but not North Carolina, that they no longer manufactured the ExpressVote HW 1.0 version. Then, in the 11th hour (only on November 15) we are told they only have available 1/6th of what NC counties expected to be able to purchase. This certainly appears to be part of a strategy by ES&S to tip the scales in favor of a quick approval process requiring no further testing or evaluation the 5.2.4.0 system. Let there be no mistake that we are not required to administratively approve 5.2.4.0 out of fear that the counties wanting to replace their now decertified Ivotronic units with ExpressVote units would have no certified voting system option for conducting 2020 elections. They already tested the DS200 and EMS that were part of 5.2.2.0 system certification. For an ADA option, they could either acquire the version of ExpressVote we certified, acquiring the needed one unit per voting location. Alternatively, if ES&S maintains they still do not have sufficient units for this purpose, these counties can surely plan to deploy AutoMark units for at least the upcoming March 2020 elections. Finally, we should also acknowledge that ES&S failed to accurately disclose, as required, the location of manufacturing for both the ExpressVote and DS200 units at the time of their initial submission of documents in 2017 (as part of Corporate Information, Certification Program Section 3.5.1.5, Item 7). ES&S’ initial statement on the location of manufacturing facilities indicated Pivot International as their contract manufacturer located in Kansas. Only after we learned (in October) that these units are actually manufactured in the Philippines did they submit a corrected disclosure statement. This corrected disclosure statement was only transmitted to Executive Director Brinson Bell on November 11, 2019. Taking all of this into consideration, there is a clear pattern of actions on the part of ES&S that represent a fundamental lack of candor in the certification process. We should not simply take their word for representing the changes in the 5.2.4.0 system as enhancements or otherwise eligible for administrative approval by the Executive Director. We have already gotten indications that there may well be forthcoming litigation based on our certification of the EVS 5.2.2.0 system. We should not take further action that would add to the current litigation risk by failing to require state-level (post-EAC) testing and evaluation of EVS 5.2.4.0 before moving forward with a Board vote on certification.