[Updated version as of 12/26/2004 of Bob Kibrick's remarks on the RFP]

Summary report of Connecticut's RFP to DRE voting systems

1. This is an RFP only for the purchase of DREs
Until someone presents compelling evidence to the contrary, it appears that the voting systems RFP issued by Connecticut on December 21 is strictly a solicitation for proposals for DRE voting systems, as indicated both in official description on the front page of the RFP document ("DESCRIPTION: Direct Recording Electronic ("DRE") Voting Machines") and in the official notice of the RFP's release:

Summary:
Direct Recording Electronic ("DRE") Voting Machines

Synopsis:

The Connecticut Secretary of the State's Office is seeking to contract with a firm capable of providing Direct Recording Electronic (DRE) Voting Systems, as defined in Connecticut General Statutes and Regulations, for the cities and towns of the State of Connecticut.

2. It does not appear to include other HAVA-compliant voting systems
The definition of "DRE" as contained in the Connecticut General Statutes and Regulations (as referenced in both the official notice of the RFP's release and in the RFP itself does not appear to be inclusive of alternative HAVA-compliant voting systems, such as precinct-based optical scanners used in conjunction with ballot marking devices:

(Conn. Regs.--Stands. DRE Vot. Mach.)
STANDARDS FOR APPROVAL OF DIRECT RECORDING ELECTRONIC VOTING MACHINES Sec. 9-241-1. General Standards. The secretary of the state may approve only those direct recording electronic voting machines which have been certified by an independent test authority, accredited by the National Association of State Election Directors, as meeting the voluntary performance and test standards for voting systems adopted by the Federal Election Commission on January 25, 1990, as amended from time to time, and which meet the standards specified in Sections 9-241-1 to 9-241-36, inclusive, of these regulations and the requirements of the Connecticut constitution and the general statutes. Sec. 9-241-2. Definition. As used in sections 9-241-1 to 9-241-36, inclusive, of these regulations, a direct recording electronic (DRE) voting machine is a machine or system that records votes by means of a ballot display provided with mechanical or electro-optical devices which can be actuated by the voter, that processes the data by means of a computer program, and that records voting data and ballot images in internal memory devices. It produces a tabulation of the voting data at the individual machine or system level in the polling place in both hard copy and on a removable memory device. These memory devices are removed at the completion of voting and individually read into a special device which is capable of tallying the results contained on all removable memory devices to provide voting district and town-wide election totals.

This appears to contradict the informal remarks made by Connecticut's Deputy SOTS Maria Greenslade following the Dec. 22 press conference, in which she suggested that the definition of "DRE" used in the RFP could be read as including alternative HAVA-compliant voting systems. At this time, we are still awaiting a response from Donald Maloney, the Project Director for this RFP, to whom Greenslade has apparently delegated the responsibility for answering our inquiry regarding this contradiction.

3. Optical scan (or Marksense) voting systems are separately defined and not included
As further evidence that the RFP is not inclusive of other HAVA-compliant voting systems (e.g., precinct based optic scanners used in conjunction with ballot marking devices):

a) the RFP references another section (Sec. 9-241) of the Connecticut General Statutes and Regulations (which is included as one of the appendices contained within the RFP document package) that specifically defines optical scan (also known as marksense) voting systems as a clearly distinct entity from the DRE voting systems defined in Sec. 9-241-2:

(Conn. Regs.--Stands. MS Vot. Mach.)
STANDARDS FOR APPROVAL OF MARKSENSE AND PUNCHCARD VOTING MACHINES Sec. 9-242-1. General Standards. The secretary of the state may approve only those marksense and punchcard voting machines which have been certified by an independent test authority, accredited by the National Association of State Election Directors, as meeting the voluntary performance and test standards for voting systems adopted by the Federal Election Commission on January 25, 1990, as amended from time to time, and which meet the standards specified in sections 9-242-1 to 9-242-39, inclusive, of these regulations and the requirements of the Connecticut constitution and the general statutes. Sec. 9-242-2. Definition. As used in sections 9-242-1 to 9-242-39, inclusive, of these regulations, a punchcard or marksense voting system is one which records votes, counts votes, and produces a tabulation of the vote count, using one or more ballot cards imprinted on either or both faces with text and voting response locations. The punchcard voting system records votes by means of holes punched in designated voting response locations; the marksense voting system records votes by means of marks made in the voting response locations. The voting machine shall be of the precinct count system type wherein ballot cards are fed into the machine by the voter and the ballots are tabulated at the polling place. The system shall tabulate ballots as they are cast and shall print the results after the close of polling. It shall produce a tabulation of the voting data at the individual machine or system level in the polling place in both hard copy and on a removable memory device. These memory devices are removed at the completion of voting and individually read into a special device which is capable of tallying the results contained on all removable memory devices to provide voting district and town-wide election totals. These voting machines shall, in accordance with Conn. Gen. Stat. Section 9-242(c), warn the voter of overvotes by returning the ballot to the voter with such message, shall not record over-votes, and shall not record more than one vote of a voter for the same person for an office.

b) While the RFP request that voting systems vendors answer dozens of detailed questions about the specifications, performance characteristics, and testing procedures specifically targeted to the technology of DRE voting systems (e.g., calibration procedures for touch screen), it does not ask those vendors to answer a single question targeted to the technology of optical scan voting systems (e.g., calibrating optical sensors for different types of ink).

c) An exhaustive search of the entire RFP document package turned up very few references to "optical scan" voting technologies, and none of these appeared in the context of any sort of solicitation for proposals specifying the use of such systems. The only places in which reference was made to "optical scan" voting systems was in:

i) the an initial background section of the RFP that describes what type of voting systems are currently deployed in Connecticut, and

ii) in the appendix containing the complete text of the Help America Vote Act, where "optical scanning" voting systems are mentioned in HAVA Sec. 301(a)(1)(A) among a list of other voting systems currently in use.

d) An exhaustive search of the entire RFP document package turned up very few references to "marksense" voting technologies, other than those that appeared in the previously cited appendix that contains Section 9-242 of the Connecticut General Statutes and Regulations; none of these appeared in the context of any sort of solicitation for proposals specifying the use of such systems. The only place outside of that appendix in which reference was made to "marksense" voting systems was in another appendix (on physical pages 285, 288, and 298) dealing with application process for getting any voting system certified in CT. Once again, those references do not appear in the context of any sort of solicitation for proposals specifying the use of such systems.

4. RFP is structured to negate the cost-savings of alternative HAVA-compliant technologies
The RFP takes a "divide-and-conquer" approach to masking the fact that replacing Connecticut's current inventory of lever voting machines with DREs is a more expensive (and less verifiable) solution than deploying precinct-based optical scanners and ballot marking devices. It does this by breaking up the purchase of DRE voting systems into two distinct phases:

a) Initially, the State will purchase sufficient DRE voting machines to provide one DRE voting system per polling place. [These machines are to be deployed in time for the Nov. 2005 election to provide access for voters will disabilities; in that election, these DREs will be used alongside the existing lever machines, which will service non-disable voters.]

b) On a longer time scale, Connecticut's townships will be required to purchase additional voting systems, to replace their existing lever-machine voting systems by 2006 in order to comply with HAVA manual audit capacity requirement (Sec. 302(a)(2)(B). Townships will be required to purchase any DRES through the State contract that results from this RFP.

Since the State will have already put in place one DRE voting machine per polling place, townships will have a very strong incentive to follow the State's lead for two reasons:

i) Election administration will be much more difficult if townships have to maintain more than one type of voting system at each polling place
ii) The overall cost savings associated with a precinct-based optical scan/ballot marking device solution are at least partially negated by the prior purchase of one DRE per polling place.

By structuring the purchases into these two phases, the State has effectively stacked the deck in favor of a 100% DRE solution, even though the overall cost of that solution is significantly higher than a solution that deploys precinct-based optical scanners/ballot marking devices instead of DREs.

5. The RFP language is weak, vague, and ambiguous regarding voter-verified paper "receipts" (VVPR)


The RFP gives hardly any mention to the question of requiring a voter verified paper record (VVPR) for DREs, and provides only the weakest acknowledgment that this is even a significant area of concern. It also erroneously uses the word "receipt" rather than "record" so as to further confound and confuse the issue. The phase "voter verified" appears only twice in the entire RFP document:

4.5.2.3.8. Verified Voter Paper Receipt – Verified Paper Audit Trail.
The Vendor must include a provision to install a Voter Verified Paper Receipt and/or a Verified Paper Audit Trail (VVPR- VPAT) that meets all Federal and State Certification, at no additional cost to the State, Town or City, to every DRE machine purchased as a result of this RFP, should such be required by the Federal Government or the State of Connecticut.

4.6.5. Hardware Requirements. System shall contain, at a minimum, the hardware components necessary to process voters and deliver totals for closing the polls, i.e., voting devices, controller unit (if required for system), printer for zero tapes, overall results and voter receipt (if required). System shall be capable of printing a receipt should it ever be required to do so. Vendor must explain what revisions must be made to the proposed equipment to incorporate a Voter Verified Paper Receipt or a Verified Paper Audit Trail. Vendor must explain how such receipt may be retained by the equipment and not retained by the voter. System shall produce, at the time the voter votes his or her ballot or at the time the polls are closed, a paper version or representation of the voted ballot or of all the ballots cast on a unit of the voting system in accordance with Federal law and Connecticut Statutes and Regulations. The paper version shall not be provided to the voter but shall be retained with the election returns.

In both instances, the phrase "Voter Verified" is used in the context of a "Voter Verified Paper Receipt" (VVPR), and in both cases, the reference to a VVPR is made in the same sentence as a "Verified Paper Audit Trail" (VPAT). Note this missing "V" in VPAT, i.e., the "Verified Paper Audit Trail" is not required to be "Voter Verified".

The language of these two sections is somewhat slippery, because VVPR and VPAT are combined in the same sentence using either the conjunction "and/or" (in Requirement 4.5.2.3.8) or the conjunction "or" (in Requirement 4.6.5), rather than being treated in two separate sentences, or more appropriately, in two separate sections of the requirements. As such, the language used here tries to blur the distinction between a VVPR (or VVPAT) and a VPAT, even though a VVPR and a VPAT (i.e., a paper at the time the polls are closed) are not at all equivalent, since only the VVPR is voter-verified.

The "and/or" construction is 4.5.2.3.8 is troubling, because it makes it unclear as to what the "such" refers to at the end of this sentence. For example, if the Federal Government or the State of Connecticut requires a VVPR, is the vendor required to supply, at no cost to the State, a VVPR or only a VPAT?

Since one can argue that a VPAT (i.e., the capability to print a paper record of all ballot images at the time the polls are closed) will (in 2006) be required by the Federal Government under HAVA Sect. 301(a)(2)(B), the triggering clause of Requirement 4.5.2.3.8 is certain to become operative at that time. Thus, one might argue that Requirement 4.5.2.3.8 is already satisfied if a vendor supplies a DRE that by 2006 can print a VPAT. If subsequent legislation requires DREs to provide a VVPR, it is not clear that vendors would be required to provide that capability on a cost-free basis if they can successfully argue that they have already met Requirement 4.5.2.3.8 by providing a VPAT capability by 2006.

The language of 4.6.5 is also sloppy, because the opening line reads:

System shall contain, at a minimum, the hardware components necessary to process voters and deliver totals for closing the polls, i.e., voting devices, controller unit (if required for system), printer for zero tapes, overall results and voter receipt (if required).

without defining what is meant by a "voter receipt". This might be a VVPR or it might be a VPAT, or perhaps neither, since the term is not defined. The next sentence is even more vague, and simply refers to "a receipt":

System shall be capable of printing a receipt should it ever be required to do so.

The next sentence of Requirement 4.6.5 reads:

Vendor must explain what revisions must be made to the proposed equipment to incorporate a Voter Verified Paper Receipt or a Verified Paper Audit Trail.

Note the use of "or" rather than "and". One could read this as meaning that if a vendor explains what revisions must be made to provide a VPAT, then they are not required to explain what revisions must be made to incorporate a VVPR.

Vendor must explain how such receipt may be retained by the equipment and not retained by the voter.

Note the use of the word "may" rather than "must". Thus, it is apparently sufficient that the receipt may not be retained by the voter, but there is not requirement that it must be retained by the equipment or that it be retained at all.

System shall produce, at the time the voter votes his or her ballot or at the time the polls are closed, a paper version or representation of the voted ballot or of all the ballots cast on a unit of the voting system in accordance with Federal law and Connecticut Statutes and Regulations.

This language is really weak, in that it doesn't specify that the "a paper version or representation of the voted ballot" printed "at the time the voter votes his or her ballot" must be verified by that voter or in any way even be made visible to the voter.

Once again, the notion of a contemporaneous paper record and a VPAT (printed at the close of the polls) are intertwined into the same sentence with the conjunction "or", and using different language ("paper version or representation of the voted ballot") than the terms VVPR or VPAT that were used in the previously in Regulation 4.5.2.3.8. If Federal law or Connecticut Statutes and Regulations require both a VVPR and a VPAT, is this condition of the Requirement 4.6.5. satisfied if the System produces only a VPAT that is printed in accordance with those laws and regulations?

The language of these two regulations is ill-defined, vague, and ambiguous; that ambiguity appears to potentially create various loopholes that might allow vendors to avoid having to provide a future VVPR capability on a cost-free basis. This is the same sort of vague and ambiguous language that was used in HAVA's "manual audit capacity" language" (Sect. 301(a)(2)(B)), and which has been interpreted in the weakest possible way and not as Senator Ensign and many others had intended.

The language of these two Requirements (4.5.2.3.8 and 4.6.5) is not the sort of clear, unambiguous, and legally water-tight language that I would hope to see in an RFP that was truly serious about holding the vendors' feet to the fire if and when a VVPR is mandated either by state or federal legislation. Had they being serious about this, the writers of this RFP would have handled requirements for VVPRs and for VPAT in separate and clearly written requirements.

6. Were the RFP authors forced to specify only DREs in this RFP because of Connecticut's HAVA State Plan?

Some have suggested that the authors of the RFP had no choice but to restrict it to DRE voting systems because of what is written in Connecticut's HAVA State Plan. After having read that plan, my conclusion was that this was not the case, and we said as much in our letter to the Connecticut SOTS (Bysiewicz) and her deputy in the submission we made in October.

In that letter, we stated:

In the Introduction to the July 23, 2003 version of Connecticut’s HAVA State Plan (http://www.sots.ct.gov/ElectionsServices/HAVA/HavaPDF/StatePlan.pdf), you pledge that the State of Connecticut will continue to: “investigate all aspects of voting systems to identify which systems will most benefit all electors in our state” and “update and refine the State plan as necessary to reflect changes and progress in election reform.” ...
We would also encourage Connecticut to take as comprehensive a view as possible when evaluating “all aspects of voting systems to identify which systems will most benefit all electors in our state”, as doing otherwise could shortchange those electors of potentially superior and more cost-effective solutions. The State Plan goes on to state (on page 2) that:
“(c)onsiderable efforts are necessary for the State to meet all of the other HAVA requirements” and that the State will need to “investigate voting systems alternatives (through passage of H.B. 6592...)”.

Most importantly, Connecticut's HAVA State Plan states:

“the State of Connecticut will purchase one electronic voting system for each polling location in Connecticut (currently 746 statewide) for use by individuals with disabilities.”

Note that the Plan uses the more inclusive term "electronic voting system", not the more restrictive term "direct recording electronic", or DRE. An "electronic voting system" certainly can be read as including precinct-based optical voting systems and ballot marking devices. Nowhere in the Plan does it define "electronic voting system" as including only DREs.

Thus, to argue that the HAVA State Plan forces the RFP to include only DREs and to exclude other HAVA-compliant electronic voting systems suggests an overly-restrictive reading of that term "electronic voting system". Had the HAVA State Plan intended to restrict the RFP to include only DREs, why did it not state that explicitly?

7. Is there anything good about this RFP?

Some.

It requires vendors to provide a great deal of useful information about both the operation of their companies and their machines, and it requires those machines to meet a lengthy list of operational and performance requirements. (The list of requirements is pretty thorough, although the elaboration of many of these requirements is rather terse.) In addition, it requires vendors that clearly describe the training programs that they will provide to elections officials and to voters, and to conduct a public demonstration of the proposed systems as part of the bidding process.

Note that the RFP is not structured so that the lowest bidder is guaranteed. Rather, the decision will be made by comparing the vendor proposals using a detailed list of criteria (see Section 6), only one of which is the cost of the proposal. The survey results from the publication demonstrations of the competing DRE voting systems are one of the selection criteria.

The RFP does not appear to describe the weighting system that will be used in summing the scores of the vendors on each of the selection criteria. The goal appears to be to provide enough flexibility to allow selection of the vendor whose proposal provides the best performance within a reasonable cost.

In terms of specific requirements, I was pleased to see some that address at least some of the concerns we raised about DREs in our October submission. For example, one of the deficiencies of DREs that we described at some length in our submission was the problem of DREs sometimes presenting voters with either the wrong ballot (e.g., in a primary election, presenting a ballot for a party different than what the voter requested) or an incomplete ballot (e.g., certain races are missing, or are not presented depending on choices made in prior races on the ballot), and that voters often became aware of such problems only after they had started voting. We contrasted situation with optical scan paper ballots, where voters at least have an opportunity to fully inspect (prior to entering the voting booth) the ballot that they have been handed.

The RFP appears to address this concern in Requirement 4.4.1.5.4, "Verification of Correct Ballots", which reads:

The Proposed System shall permit verification that the ballots are correct before the polling places open. Explain here how the Proposed system permits verification that the ballots are correct before the polling place opens.

We will likely never know whether or not this requirement is there as a result of the concerns we raised in our submission, because the CT SOTS and her deputy assert that they never received it.

As mentioned previously, although the RFP lists a very extensive set of requirements that the proposed DRE system must meet, many of these requirements are so tersely specified that either their meaning or the rationale for their existence is unclear. Here are some examples:

Requirement 4.4.1.5.1. Printing of Ballots The Proposed System shall allow for printing of ballots by any vendor/manufacturer.

The meaning of this requirement is unclear, particularly as to how it would apply to a DRE. It might possibly make sense in the context of a precinct-based optical scanner and/or a ballot marking device, but as noted earlier, those devices don't appear to be included in this RFP.

Requirement 4.2.4: “Any Equipment proposed by a vendor must be currently in production and available for sale on the due date of this RFP. “

The meaning and rationale for this requirement is clear. I note it here since it could serve as an additional cause for disqualifying devices like the AutoMark, should someone determine that RFP can be interpreted to be inclusive of ballot marking devices in general. This depends on how rapidly devices like the AutoMark can complete certification and ramp up production, i.e., can they get that done before the due date of this RFP?

4.4.1.1.1. Programmable Ballot The DRE Machine shall display a full-faced ballot to the voter, in accordance with State of Connecticut Statutes, as the voter initiates voting.

Without reading the relevant statute, it is unclear whether this requires the "full-faced ballot" to remain "full-faced" following its initial display to the voter. If so, then how do visually-impaired voters uses the magnification capability to enlarge the fonts, as specified in:

4.4.1.3. Accommodation of Voters With Disabilities The design and installation of Proposed System equipment used in the polling place shall accommodate access by voters with disabilities in compliance with the Americans with Disabilities Act (ADA), HAVA and all applicable federal and state laws that address accessibility to voting for persons with disabilities. The DRE Machine must display a full-faced ballot to the voter, in accordance with State of Connecticut Statutes, as the voter initiates a voting session. The size of a ballot position and the font size of candidate information must be in accordance with such statutes. The proposal must stipulate the maximum available positions on the voting device, based on such size of a ballot position and the font size of candidate information, to be used for an election. The Proposed System must include adequate lighting for use and operation by voters, polling place workers and staff.

If the fonts are greatly magnified, the entire "full-face" ballot will not be simultaneously visible on the display screen.

4.4.1.10.4. Election Day Power Loss The Proposed System shall provide, in case of power interruption, a means for voting operations to continue. This means shall consist of either an un-interruptible power supply (UPS) or other means to keep voting equipment active. Shall provide for an optional battery back-up unit, which can provide continuous operation for a minimum of sixteen (16) hours in case of power failure.

This requirement specifies that the proposed system must enable voting operations to continue in the event of a power interruption, and requires the provision of an OPTIONAL battery back-up unit that can keep the system operating continuously for 16 hours in case of power failure. However, it doesn't set a requirement for how long of a power interruption the system must be able to survive if the OPTIONAL battery back-up unit is not attached. Nor does it set any requirement on how many of these OPTIONAL battery back-up units the vendor must be able to deliver should the State decide to acquire such units. This requirement does not appear to establish any standards with regard to battery lifetime or with regard to how often batteries must be recharged. This requirement seems overly terse and weak.

4.4.1.10.6.1. Functional Use ...

...

Device shall prompt the voter to confirm the voter's choices before casting their ballot, signifying to the voter that casting the ballot is irrevocable and directing the voter to confirm the voter's intention to cast the ballot, and shall further signify to the voter that the ballot has been cast after the vote is stored successfully;

This is a good requirement as far as it goes. But if fails to require that the System signify to the voter (e.g., with some sort of alarm or highly-visible error message) in the case where the voter attempts to cast a vote but it is not stored successfully (e.g., as happened in Cateret County, NC in the Nov. 2004 election, where a DRE voting machine failed to adequately notify voters or election officials that "cast" ballots were not being stored successfully).

4.4.1.10.10.13. Screen Registration The Proposed System shall have all screen registration requirements completed during Logic and Accuracy testing and shall not become mis-aligned during the course of an election. If the Proposed System involves the registration of the ballot screen and the registration becomes mis-aligned in the course of Election Day, the system shall log the condition and automatically be disabled from further voting. Explain here any other requirements of the Proposed System that would require adjustment or other action by the poll workers after opening the polls aclosing the polls of an election.

Touch screen sensor calibration / screen registration problems was one of the largest area of complaints the were received by our EIRS voter hotline during the Nov. 2 election, and they are dealt with rather tersely in this requirement. The requirement first asserts that they "shall not become misaligned during the course of an election", but then assumes that they will, which seems to negate the "shall not". If further asserts that if a misalignment occurs "in the course of Election Day", the system shall log the condition and AUTOMATICALLY be disabled from further voting, but does not describe how the system can automatically detect when it is misaligned. Misalignments are typically detected and reported by voters who then must seek the aid of poll workers to deal with the misaligned machine. Also, by specifying "in the course of Election Day", it does not establish a requirement for what happens when a misalignment occurs during period of early voting. In sum, given the seriousness of the "screen registration" problem, this requirement appears to be have been given inadequate attention.

4.5.1.4. Location of Source Code
4.5.1.4.1. Ballot Generation Software The State expects that the successful proposer shall deliver the currently operational source code used by the Proposed System for programming voting devices for each election, together with complete documentation for the installation and backup of the source code to the Connecticut Secretary of the State for disposition in escrow pursuant to the requirements of the Secretary of the State. Upon delivery of the system, the vendor will place all such operational Source Code in an escrow account with both the State of Connecticut and the Secretary of the State named as beneficiaries.
4.5.1.4.2. DRE Application Software The State expects that the successful proposer shall deliver the currently operational DRE Application source code used by the Proposed System, together with complete documentation for the installation and backup of the source code in escrow pursuant to the requirements of the Secretary of the State. Upon delivery of the system, the vendor will place all such operational Source Code in an escrow account with both the State of Connecticut and the Secretary of the State named as beneficiaries. The Proposer must warrant the source code used to program the proposed system. Explain your company’s controls regarding access to the source code used to program the proposed system. Explain your company’s position should the Secretary of the State require an audit of the source code used to program the proposed system. List those qualifications necessary to be deemed an expert in the source code used to program the proposed system. Is the source code used to program the proposed system open code? What steps have your company taken to insure that no malicious code has been introduced into the system? Explain how your company would voluntarily comply with the U.S. Election Assistance Commission’s request to deposit your company’s software in the National Software Reference Library. Explain how an election official could check software installed and used on an individual voting machine and compare it to the software code stored in the library.

These sections require that the source code must be deposited into an escrow account but they do not actually require the vendors to allow the State to audit or inspect that code. This section merely asks each vendor to explain its position should the CT SOTS require an audit of that source code. Similarly, these sections don't require a vendor to deposit their "software" (presumably, executable code) into the National Software Reference Library, they only ask the vendor to explain whether or not they intend to do so. Vendors are asked to explain how an election official could check the software installed in any given voting machine against that deposited in the NSR library, but that is pointless if the vendor elects not to deposit it in that library.
In terms of making such software auditable and transparent, I find these requirements extremely weak.

4.5.3. Storage Requirements

This is actually a pretty good section, and certainly indicates that the authors of this RFP are sensitive to the environmental requirements for storing DRE voting systems.

4.5.10. Maintenance and Support Term Vendor must provide a plan for maintenance and support to satisfy the State of Connecticut, Secretary of the State’s Regulations requiring each system to have a minimum service life of twenty (20) years. (see Durability).

This is an ambitious requirement. It will be interesting to see how vendors respond to it. How many 20-year old PCs are still in operation?

4.7. Audit and Security
4.7.1. Security. Describe audit trail capabilities included in the solution. Describe encryption used in the solution, either external or internal. Has the solution experienced any security-related exposures? If so, describe the exposures and what corrections were made. Provide a complete list of equipment failure and software failure by type of failure. Include dates, locations, contact individuals and corrective action as well as time for replacement or restoration in service. Describe the method whereby your company assures the security of the operational software/firmware of the DRE system. Shall have the capability of backing up and recovering system. Shall permit diagnostic testing of all the major components within each unit. Shall provide for contingency back-up system and procedures, which can be implemented by election staff that will ensure that all ballots cast shall be counted as quickly as possible. Explain your company’s contingency plan for back up.
Provide that each voter's ballot is secret and the voter cannot be identified by image, code or other methods. Integrity and security of data maintained according to time frame for federal, state and local elections. Prevention of functions in an improper sequence. Prevent the voter from selecting two or more candidates by pressing two or more entries at a time. Explain what safeguards are in place to prevent two or more selections with a single selection by the voter. e.g., the voteentry by pressing multiple candidates at the same time.

Given the importance of DRE security issues, this section is awfully short and terse, while at the same time including some items that might not normally considered under this category. It is worth noting that this section includes a requirement for ballot secrecy that would probably rule out Sequoia's reel-to-reel VVPAT printer solution.

4.9. Public Voting Machine Demonstration Vendors must agree to the following public demonstration and comment sessions. As part of the evaluation of proposals by the State of Connecticut, vendors which remain under consideration for a contract, as a result of this RFP, will be required to provide, at no expense to the State or the Cities or Towns of the State, an overview of the company's training and on the following day an opportunity for the public to actually use the proposed voting machines.

This section is pretty good (I've only copied the first part here). Too bad that public input was not permitted regarding the choice of voting technology to deploy. Rather, it appears that the public will only be given input on what flavor of DRE to deploy.