CHAPTER 15. BALLOT CARD AND ELECTRONIC VOTING SYSTEMS; ADDITIONAL STANDARDS AND PROCEDURES FOR APPROVING SYSTEM CHANGES
IC 3-11-15
Chapter 15. Ballot Card and Electronic Voting Systems;Additional Standards and Procedures for Approving System Changes
IC 3-11-15-1
Applicability of chapter
Sec. 1. Except as otherwise provided, this chapter applies to anyelection in Indiana where voting is by means of a ballot card orelectronic voting system.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-2
Applicability of performance and test standards and fees
Sec. 2. The performance and test standards and fees under thischapter apply to an optical scan voting system or an electronic votingsystem described in IC 3-11-7 or IC 3-11-7.5.
As added by P.L.3-1997, SEC.332. Amended by P.L.221-2005,SEC.92.
IC 3-11-15-3
Vendors; application to examine voting system
Sec. 3. A vendor may apply to the election division to examine avoting system and report on its accuracy, efficiency, and capacity.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-4
Application for certification; fee; disposition of fee
Sec. 4. Each application for certification of a voting system shallbe accompanied by a fee of one thousand five hundred dollars($1,500). All fees collected under this section shall be deposited withthe treasurer of state in the voting system technical oversightprogram account established by IC 3-11-17-6.
As added by P.L.3-1997, SEC.332. Amended by P.L.120-2009,SEC.9.
IC 3-11-15-5
Vendors; reimbursement to election division for cost ofexamination
Sec. 5. Each vendor shall reimburse the election division anamount equal to the total cost of examining the system.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-6
Approval of system dependent on payment of fees and expenses
Sec. 6. The commission shall not approve any system until the feeand the expenses incurred by the election division (or the persondesignated under IC 3-11-16) in making the examination are paid bythe person making the application.
As added by P.L.3-1997, SEC.332. Amended by P.L.221-2005,SEC.93.
IC 3-11-15-7
Applications; contents
Sec. 7. (a) Each application must be in writing, sworn to oraffirmed by the applicant, under the penalties of perjury, on a formprescribed by the commission, and must satisfy the followingrequirements:
(1) Provide the name and address of the vendor submitting theapplication.
(2) Provide the telephone number of the vendor.
(3) Provide the name, address, and telephone number of theindividual representing the vendor regarding the application.
(4) Provide the model name and number of the submitted votingsystem, stating the hardware, firmware, and software versionnumbers of the system.
(5) State whether the voting system is a direct record electronicvoting system or an optical scan ballot card voting system.
(6) Provide a description of the voting system and itscapabilities, including the following:
(A) Photographs.
(B) Engineering drawings.
(C) Technical documentation.
(D) Fail-safe and emergency backup information.
(E) Environmental requirements for storage, transportation,and operation.
(7) Include an agreement to pay for the total costs of theexamination.
(8) Provide documentation of the escrow of the voting system'ssoftware, firmware, source codes, and executable images withan escrow agent approved by the election division.
(9) Provide a functional description of any softwarecomponents.
(10) Provide schematics or flowcharts identifying software anddata file relationships.
(11) Describe the type of maintenance offered by the vendor.
(12) Provide the names, addresses, and telephone numbers ofthe vendor's maintenance providers.
(13) Provide a description of the training courses offered by thevendor for the voting system.
(14) Provide user manuals, operator and system manuals, andproblem solving manuals.
(15) Provide a statement of the current and futureinterchangeability of all subcomponents of the voting system.
(16) Provide documentation from all independent testingauthorities that have examined the system.
(17) Provide documentation from all election jurisdictions thathave previously approved the system.
(18) Pay the application fee required under section 4 of thischapter.
(b) If an application does not include any of the applicablerequirements listed in subsection (a), those requirements must be
filed with the election division before the application may beconsidered by the commission.
As added by P.L.3-1997, SEC.332. Amended by P.L.14-2004,SEC.133.
IC 3-11-15-8
Applications; length of validity
Sec. 8. An application under this chapter is valid for one (1) yearafter the date that the application is filed with the election divisionand for any additional time that the commission considers necessaryto act upon the application.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-9
Prompt response to inquiries by applicant required
Sec. 9. An applicant must vigorously and continuously seekapproval of an application by promptly responding to inquiries fromthe commission and the election division. The commission may,following a hearing under IC 4-21.5, dismiss an application if thecommission determines that the applicant has not complied with thisrequirement.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-10
Repealed
(Repealed by P.L.221-2005, SEC.144.)
IC 3-11-15-11
Repealed
(Repealed by P.L.221-2005, SEC.144.)
IC 3-11-15-12
Applications; form
Sec. 12. Each application under this chapter must be in writing ona form prescribed by the commission and must comply with therequirements of this chapter.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-13
Repealed
(Repealed by P.L.164-2006, SEC.143.)
IC 3-11-15-13.1
Voting system display of candidate name and designation
Sec. 13.1. If a voting system has the capability, the voting systemmust display on the medium used by the voter to cast the voter'sballot the following information for each candidate:
(1) The name of the candidate.
(2) A ballot number or other candidate designation uniquelyassociated with the candidate.As added by P.L.66-2003, SEC.43.
IC 3-11-15-13.3
Federal voting system standards; use of voting system with expiredcertification
Sec. 13.3. (a) To be approved by the commission for use inIndiana, a voting system must meet:
(1) the Voting System Standards adopted by the FederalElection Commission on April 30, 2002; or
(2) the Voluntary Voting System Guidelines adopted by theUnited States Election Assistance Commission on December13, 2005.
(b) A county may continue to use an optical scan ballot cardvoting system or an electronic voting system whose approval orcertification expired on or before October 1, 2009, if the votingsystem:
(1) was:
(A) approved by the commission for use in elections inIndiana before October 1, 2009; and
(B) purchased by the county before October 1, 2009; and
(2) otherwise complies with the applicable provisions of HAVAand this article.
However, a voting system vendor may not market, sell, lease, orinstall a voting system described in this subsection.
(c) As provided by 42 U.S.C. 15481, to be used in an election inIndiana, a voting system must be accessible for individuals withdisabilities, including nonvisual accessibility for the blind andvisually impaired, in a manner that provides the same opportunity foraccess and participation (including privacy and independence) as forother voters.
(d) As provided by 42 U.S.C. 15481, an election board conductingan election satisfies the requirements of subsection (c) if the electionboard provides at least one (1) electronic voting system or othervoting system equipped for individuals with disabilities at eachpolling place.
(e) If a voter who is otherwise qualified to cast a ballot in aprecinct chooses to cast the voter's ballot on the voting systemprovided under subsection (d), the voter must be allowed to cast thevoter's ballot on that voting system, whether or not the voter is anindividual with disabilities.
As added by P.L.209-2003, SEC.164. Amended by P.L.221-2005,SEC.94; P.L.164-2006, SEC.118; P.L.120-2009, SEC.10.
IC 3-11-15-13.4
Voting system and voters with disabilities
Sec. 13.4. (a) This section does not apply to the purchase, lease,or lease-purchase of additional or replacement components of avoting system in use in a county before January 1, 2005.
(b) The commission shall determine whether a voting systemprovides a practical and effective means for voters with disabilities
to cast ballots in private.
(c) If the commission determines that any voting system meets thecriteria described in subsection (b), a county may not purchase, lease,or lease-purchase any other voting system that does not meet thecriteria described in subsection (b).
As added by P.L.97-2004, SEC.10.
IC 3-11-15-13.5
Repealed
(Repealed by P.L.97-2004, SEC.133.)
IC 3-11-15-13.6
Compliance with standards for disability access
Sec. 13.6. (a) This section applies only to a voting systempurchased with funds made available under Title II of HAVA (42U.S.C. 15321 through 15472) after December 31, 2006.
(b) As required by 42 U.S.C. 15481, the voting system mustcomply with the Voting System Standards for disability accessreferred to in section 13.3 of this chapter and 42 U.S.C. 15481(a)(3)to be used in an election.
As added by P.L.97-2004, SEC.11.
IC 3-11-15-13.7
Requirements of voting systems to indicate overvotes
Sec. 13.7. (a) If a voting system has any of the followingfunctions, the functions must be operable in the voting system'sequipment actually in use in a precinct:
(1) The voting system can demonstrate to the voter that thevoter has cast votes for too many candidates for an office.
(2) The voting system can demonstrate to the voter that thevoter has cast votes both in favor of and in opposition to apublic question.
(b) Except as provided in subsection (c), a voting systemdescribed in subsection (a) must be able to inform the voter how thevoter may correct errors on the voter's ballot.
(c) A voting system is not required to provide the informationrequired by subsection (b) if the information is provided in writingconspicuously on or near the components of the voting system wherethe voter casts the voter's votes.
As added by P.L.126-2002, SEC.76.
IC 3-11-15-14
Ballot counting devices and equipment; verification
Sec. 14. In ballot card voting systems, each precinct ballotcounting device, and all central counting equipment, must containprovisions for verifying:
(1) its proper preparation for an election; and
(2) that both the hardware and the software are functioningcorrectly.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-15
Ballot counting devices and equipment; tests and diagnosticprocedures
Sec. 15. The tests and diagnostic procedures described in section14 of this chapter:
(1) may be executed manually or automatically; and
(2) must allow for operator intervention to validate the properexecution of individually selected equipment functions.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-16
Electronic voting system; verification
Sec. 16. Each electronic voting system or vote recording and dataprocessing device shall contain hardware and software provisions forverifying:
(1) its proper preparation for an election; and
(2) that both the hardware and the software are functioningcorrectly.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-17
Electronic voting system; tests and diagnostic procedures
Sec. 17. The tests and diagnostic procedures described in section16 of this chapter:
(1) may be carried out manually or automatically; and
(2) must allow for operator intervention to validate the properexecution of individually selected equipment functions.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-18
Repealed
(Repealed by P.L.26-2000, SEC.46.)
IC 3-11-15-19
Repealed
(Repealed by P.L.26-2000, SEC.46.)
IC 3-11-15-20
Voting system; accuracy
Sec. 20. (a) A voting system must be able to record accuratelyeach vote and be able to produce an accurate report of all votes cast.
(b) As used in this subsection, "error rate" refers to the error rateof the voting system in counting ballots (determined by taking intoaccount only those errors that are attributable to the voting systemand not attributable to an act of the voter). As required by 42 U.S.C.15481, a voting system must comply with the error rate standardsestablished under section 3.2.1. of the Voting System Standardsapproved by the Federal Election Commission on April 30, 2002, asthose standards were in effect on October 29, 2002.
(c) The inclusion of control logic and data processing methods
incorporating parity and check-sums (or equivalent error detectionand correction methods) must demonstrate that the system has beendesigned for accuracy.
As added by P.L.3-1997, SEC.332. Amended by P.L.209-2003,SEC.166.
IC 3-11-15-21
Voting system; software
Sec. 21. Software used in a voting system must monitor theoverall quality of data read-write and transfer quality status, checkingthe number and types of errors that occur in any of the relevantoperations on data and how they were corrected.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-22
Ballot card voting system; verification and accuracy
Sec. 22. Ballot card voting systems must rely on the retention ofballots as a redundant means of verifying or auditing election results.As a means of assuring accuracy in electronic voting systems, theunit must incorporate multiple memories in the machine itself and inits programmable memory devices.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-23
Electronic voting system; preservation of electronic images ofballots
Sec. 23. To attain a measure of integrity over the process, theelectronic voting systems must also maintain an image of each ballotthat is cast, such that records of individual ballots are maintained bya subsystem independent and distinct from the main vote detection,interpretation, processing, and reporting path. The electronic imagesof each ballot must protect the integrity of the data and theanonymity of each voter, for example, by means of storage locationscrambling. The ballot image records may be eithermachine-readable or manually transcribed, or both, at the discretionof the vendor.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-24
Voting system; status and degree of operability
Sec. 24. Ballot card voting and electronic voting systems mustinclude built-in test, measurement, and diagnostic software, andhardware for detecting and reporting the system's status and degreeof operability.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-25
Voting system; recording and reporting capabilities
Sec. 25. A voting system must include capabilities of recordingand reporting the date and time of normal and abnormal events and
of maintaining a permanent record of audit information that cannotbe turned off. A voting system must include provisions to detect andrecord significant events, such as casting a ballot, error conditionsthat cannot be disposed of by the system itself, or time-dependent orprogrammed events that occur without the intervention of the voteror a polling place operator.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-26
Ballot counting software
Sec. 26. The ballot counting software must be designed in amodular fashion and not be self-modifying. Modular programs mustconsist of code written in relatively small and easily identifiablesections, with each unit having a single entry point and a single exitpoint. Each module must have a specific function that can be testedand verified more or less independently of the remainder of the code.Appendix E of the Performance and Test Standards for Punchcard,Marksense, and Direct Recording contains numerical guidelines forprogram modules.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-27
Repealed
(Repealed by P.L.26-2000, SEC.46.)
IC 3-11-15-28
Repealed
(Repealed by P.L.26-2000, SEC.46.)
IC 3-11-15-29
Repealed
(Repealed by P.L.26-2000, SEC.46.)
IC 3-11-15-30
Repealed
(Repealed by P.L.26-2000, SEC.46.)
IC 3-11-15-31
Repealed
(Repealed by P.L.26-2000, SEC.46.)
IC 3-11-15-32
Compliance with other preferred coding practices and softwarecharacteristics
Sec. 32. In considering the compliance of a voting system withthis chapter, the commission may determine whether the systemconforms with other preferred coding practices and softwarecharacteristics set forth in the Voting System Standards adopted bythe Federal Election Commission on April 30, 2002.
As added by P.L.3-1997, SEC.332. Amended by P.L.209-2003,
SEC.167.
IC 3-11-15-33
Real-time monitoring of system status and data quality
Sec. 33. The vendor shall provide for the real-time monitoring ofsystem status and data quality. The election division (or thecompetent person designated by the commission to act on behalf ofthe election division) shall determine methods of assessment with theadvice of a test authority. Implementation options include thefollowing:
(1) Hardware monitoring of redundant processing functionswhich are carried out in parallel or serially.
(2) Statistical assessment and measures of system operation.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-34
Quality assessment
Sec. 34. Measurement of the relative frequency of entry toprogram units and the frequency of exception conditions must beincluded as part of the quality assessment.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-35
Repealed
(Repealed by P.L.176-1999, SEC.134.)
IC 3-11-15-36
Errors in operations; corrections
Sec. 36. Software used in all systems must monitor the overallquality of data read-write and transfer quality status, checking thenumber and types of errors that occur in any of the relevantoperations on data and how the errors were corrected. If the totalnumber of corrected errors exceeds a predetermined threshold, or iferrors on any one (1) type occur repeatedly, then the operation of theaffected device must be suspended until the condition generating theerrors has been corrected. Any uncorrectable error must result in animmediate halt and provide an appropriate message to the voter orpolling place official.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-37
Retention of ballots for verification of election results
Sec. 37. Ballot card voting systems must rely on the retention ofballots as a redundant means of verifying election results. As ameans of assuring accuracy in electronic voting systems, the unitmust incorporate multiple memories in the machine itself and in theunit's programmable memory devices. To attain a measure ofintegrity over the process, an electronic voting system must alsomaintain images of each ballot that is cast so that records ofindividual ballots are maintained by a subsystem independent and
distinct from the main vote detection, diagnostic, processing, andreporting path.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-38
Stored images of ballots
Sec. 38. The stored images of each ballot must protect theintegrity of the data and the anonymity of each voter by such meansas storage location scrambling. The ballot image records may beeither machine readable or manually transcribed, or both, at thediscretion of the vendor.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-39
Firmware instructions; undervoting permitted
Sec. 39. The electronic voting system firmware instructions mustcontain necessary logical instructions to determine correct recordingof each and every candidate or public question selection made by thevoter to the appropriate memory registers and tables. In the case ofa partially voted ballot, deliberate undervoting by a voter must bepermitted. This undervoting must be validated by machinedetermination that particular candidate or public question selectionshave not been made. In cases where a selected candidate or vote ona public question is not recording correctly upon casting of the ballot,the electronic voting system equipment must generate an error signaland automatically stop operation of the machine until the problem isresolved.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-40
Reconciliation of sum of selections and undervotes
Sec. 40. After every ballot is cast, a reconciliation of the sum ofselections and undervotes must occur. The undervotes may not begenerated as a default but must be generated as the result of scanningthe ballot as the ballot is cast.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-41
Status messages
Sec. 41. Status messages must become part of the real-time auditrecord. Latitude in software design is necessary so that considerationcan be given to various user processing and reporting needs. The usershall require status and information messages to be displayed andreported in real-time.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-42
Status messages; display
Sec. 42. Depending on the critical nature of the message, and theparticular jurisdiction's needs, status messages shall preferably be
displayed and reported by suitable, unambiguous indicators orEnglish language text. Noncritical status messages may be displayedif the message does not require operator intervention by means ofnumerical codes, for subsequent interpretation and reporting asambiguous text.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-43
Audit record; ability of voter to change vote before ballot cast
Sec. 43. (a) The audit record provisions in this chapter areessential to the complete recording of election operations andreporting of the vote tally. This list of audit records must reflect allof the idiosyncrasies of a system.
(b) As required by 42 U.S.C. 15481, the voting system must:
(1) produce a permanent paper record with a manual auditcapacity for the system; and
(2) provide the voter with an opportunity to change the ballot orcorrect any error before the permanent paper record isproduced.
(c) The paper record produced under subsection (b) must be madeavailable as an official record for a recount or contest conducted withrespect to any election in which the voting system was used.
As added by P.L.3-1997, SEC.332. Amended by P.L.209-2003,SEC.168.
IC 3-11-15-44
In-process audit records; contents
Sec. 44. In-process audit records consist of data documentingprecinct and central count system operation during diagnosticroutines and the casting and tallying of ballots. At a minimum, thein-process audit records for all systems must contain the followingitems, except as otherwise noted:
(1) Machine generated error and exception messages to ensurethat successful recovery has been accomplished. Examplesinclude the following:
(A) The source and disposition of system interrupts resultingin entry into exception handling routines.
(B) All messages generated by exception handlers.
(C) The identification code and number of occurrences foreach hardware and software error or failure.
(D) Notification of system log-in or access errors, file accesserrors, and physical violations of security as they occur, anda summary record of these events after processing.
(E) For ballot card voting systems, an event log of anyballot-related exceptions, such as the following:
(i) Quantity of ballots that are not processable.
(ii) Quantity of ballots requiring special handling.
(iii) In a central count environment, quantity identificationnumber of aborted precincts.
(F) Other exceptional events such as power failures, failure
of critical hardware components, data transmission errors, orother types of operating anomalies.
(2) Critical system status messages other than informationalmessages displayed by the system during the course of normaloperations. These items include the following:
(A) Diagnostic and status messages upon startup.
(B) The "zero totals" check conducted before opening thepolling place or counting a precinct centrally.
(C) For ballot card voting systems, the initiation ortermination of card reader and communications equipmentoperations.
(D) For electronic voting system machines, the event (andtime, if available) of enabling/casting each ballot that is eachvoter's transaction as an event. This data can be comparedwith the public counter for reconciliation purposes.
(3) Status messages that are generated by the machine's dataquality monitor or by software and hardware conditionmonitors. For example, a cumulative or summary record of dataread-write-verify, parity, or check-sum errors and retries isrequired. The intent is to gauge the accuracy of the ballot dataand adequacy of the system in monitoring and detecting systemprocessing errors.
(4) System generated log of all normal process activity andsystem events that require operator intervention so that eachoperator access can be monitored and access sequence can beconstructed.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-45
General features and capabilities of access policy; disclosure
Sec. 45. The vendor shall disclose the general features andcapabilities of the access policy. The generic capabilities shouldinclude the following:
(1) Software access controls.
(2) Hardware access controls.
(3) Effective password management.
(4) The protection abilities of a particular operating system.
(5) The general characteristics of supervisory access privileges.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-46
Access policies defined by using jurisdiction
Sec. 46. The using jurisdiction in charge of voting systemoperations is responsible for defining the specific access policiesapplying to each election and for defining any variations of theseresulting from use of the system in more than one (1) environment.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-47
Access control policy; limitations on access Sec. 47. The access control policy must identify all persons towhom access is granted and the specific functions and data to whicheach holds authorized access. If an authorization is limited to aspecific time, time interval, or phase of the voting or countingoperations, this limitation must also be specified.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-48
Access control policy; requirements
Sec. 48. The access control policy:
(1) may not affect the ability of a voter to record votes andsubmit a ballot; and
(2) must preclude voter access to all other physical facilities ofthe vote-counting processes.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-49
Approval required before voting system is marketed, sold, leased,installed, or implemented
Sec. 49. Before a vendor markets, sells, leases, installs, or permitsthe implementation of a voting system in Indiana, the commissionmust have approved the vendor's application for the approval of thevoting system.
As added by P.L.3-1997, SEC.332. Amended by P.L.14-2004,SEC.135.
IC 3-11-15-50
Repealed
(Repealed by P.L.221-2005, SEC.144.)
IC 3-11-15-51
Repealed
(Repealed by P.L.221-2005, SEC.144.)
IC 3-11-15-52
Repealed
(Repealed by P.L.221-2005, SEC.144.)
IC 3-11-15-53
Repealed
(Repealed by P.L.221-2005, SEC.144.)
IC 3-11-15-54
Software or source code changes
Sec. 54. Notwithstanding any other provision of this chapter, thesoftware or source code of a voting system may not be changed whilean election is being conducted or during the canvassing of theelection's results.
As added by P.L.3-1997, SEC.332.
IC 3-11-15-55
Repealed
(Repealed by P.L.221-2005, SEC.144.)
IC 3-11-15-56
Repealed
(Repealed by P.L.221-2005, SEC.144.)
IC 3-11-15-57
Repealed
(Repealed by P.L.221-2005, SEC.144.)
IC 3-11-15-58
Repealed
(Repealed by P.L.221-2005, SEC.144.)