The Help America Vote Act of 2002 (HAVA) established the Election Assistance Commission (EAC) to assist the States as they complied with the election-system renovation required of them by HAVA. The primary duty of the EAC was to serve as a national clearinghouse for information related to the administration of Federal elections during this challenging period of upheaval. Specifically, the EAC was directed to maintain a clearinghouse of information on the experiences of State and local governments in implementing the guidelines and in operating voting systems in general; provide for the testing, certification, decertification, and recertification of voting systems; develop voluntary voting system guidelines; disburse HAVA payments and grants to the States; and conduct studies and programs to promote effective election administration.

Congress should not tolerate the EAC’s failure to comply with its mandate. It should immediately appoint well-qualified, competent Commissioners and Executive Director to replace those now in office, or it should refuse to authorize further funding for this agency.

Because the appointment of the Commissioners was nine months late, the EAC did not begin operations until January 2004 — ten months after the date mandated by HAVA. This late start and the lack of funding in 2004 prevented the EAC from meeting some of the early deadlines imposed by HAVA.

In September 2005, twenty-one months after the EAC began operations, the Government Accountability Office (GAO) published a report, “Federal Efforts to Improve Security and Reliability of Electronic Voting Systems Are Under Way, but Key Activities Need to Be Completed.”

The 2005 report discussed many Congressional mandates the EAC had not yet completed and listed five urgently needed actions in the form of “Recommendations for Executive Action” directed explicitly toward the EAC, to assist the Commission in fulfilling its role.

In March 2007, seventeen months after their first report, the GAO published another report: “All Levels of Government Are Needed to Address Electronic Voting System Challenges.” Of the five urgent actions that the GAO considered essential to fulfilling the EAC’s HAVA mandate, the EAC had accomplished only a portion of one.

The Five Recommendations – What Happened Between September 2005 and March 2007?

This paper draws heavily on information in the two GAO reports to examine the EAC’s failure to fulfill its legal mandate during the “interim period” – the seventeen critical months during which the election infrastructure of American states and counties was being modified to comply with HAVA.

A. Improve guidelines for election security and reliability.
	The 2005 GAO report pointed out that “key security and reliability improvements to the existing standards” were not included in the 2005 voting system guidelines, but had been “deferred until the subsequent set of voting system guidelines.” To address the omission of these important standards, the GAO recommended to the EAC: “Collaborate with NIST and the Technical Guidelines Development Committee to define specific tasks, measurable outcomes, milestones, and resource needs required to improve the voting system standards that affect security and reliability of voting systems.” The 2007 GAO report pointed to the need for standards to “govern integration of election systems, such as the accuracy, reliability, privacy, and security of components and interfaces.” In language remarkably similar to the 2005 report, the GAO again recommends: “Accordingly, we have recommended that the EAC collaborate with NIST and the Technical Guidelines Development Committee to define the specific tasks, measurable outcomes, milestones, and resource needs required to improve the voting system standards.” During the seventeen months after the GAO’s urgent recommendation, the EAC failed to even plan for these crucial improvements to the guidelines.
B. Establish a national voting system certification program.
	In 2005, the GAO studied voting system malfunctions, saw an immediate need for a more effective certification program, and pointed out that HAVA had given the EAC full responsibility for that program. The GAO’s second recommendation to the EAC had two parts: 1. “Expeditiously establish documented policies, criteria, and procedures for certifying voting systems that will be in effect until the national laboratory accreditation program for voting systems becomes fully operational,” The 2007 report does not include the development of such an interim program among its list of the EAC’s accomplishments. In fact, the EAC did nothing to either establish or guide an interim program. It left the entire process under the responsibility of the National Association of State Election Directors (NASED) until the EAC took over the process in July 2006. In contrast to the GAO’s statement of the EAC’s duties, Brian Hancock, ITA Secretariat for NASED at the time, wrote in a May 2005 email to John Gideon of VotersUnite: “First, the EAC currently has no role in the process of voting system qualification and testing. NASED administers the voting system testing and qualification program.” On February 27, 2007, in a conference call with Tom Wilkey, Donetta Davidson, Brad Friedman, and Michael Richardson, Mr. Hancock again emphasized the EAC’s complete lack of oversight of any interim program. In direct opposition to the 2005 report, which tells us that the “EAC agreed with the recommendations,” Mr. Hancock said: “The EAC would not have been able or had the authority to task NASED to do anything. NASED kept the program until such time as they saw the EAC was ready to take it over.” 2. “and define tasks and time frames for achieving the full operational capability of the national voting system certification program.” The 2007 report does list, as EAC accomplishments, establishing procedures for certifying voting systems and establishing a program for accreditation of independent testing laboratories. However, in 2007, the GAO points out that the program for testing and certifying is not yet operational, nor even scheduled, when it recommends again, in language identical to the 2005 recommendation: “Accordingly, we have recommended that EAC define tasks and time frames for achieving the full operational capability of the national voting system certification program.”
C. Set up and facilitate the use of a National Software Reference Library.
	The September 2005 report pointed out that the national software reference library — essential for state and local officials to ensure that their installed systems are the same as certified systems — had not been updated since the 2004 election. The report recommended that the EAC: “Improve management support to state and local election officials by collaborating with NIST to establish a process for continuously updating the National Software Reference Library for voting system software; take effective action to promote use of the library by state and local governments; identify and disseminate information on resources to assist state and local governments with using the library; and assess use of the library by states and local jurisdictions for the purpose of improving library services.” The 2007 report does not include any of these tasks in its list of EAC’s accomplishments, nor does it reiterate the recommendation. Nevertheless, the GAO points out the impact the EAC’s failure to set up the reference library has had on state and local officials’ ability to tell whether the systems they use in elections have ever been tested and approved for use (highlighting mine): “[F]or the 2004 general election, we estimated that 68 percent of jurisdictions did not know whether their respective systems were nationally certified. This uncertainty surrounding the certification status of a specific version of voting system at the local level underscores our concern that even though voting system software may have been qualified and certified at the national or state levels, software changes and upgrades performed at the local level may not be.”
D. Provide for information sharing among election officials about voting system problems.
	The 2005 GAO report stated, several times, that one of the responsibilities of the EAC was to serve as a clearinghouse for information on voting system problems and that fulfilling the responsibility promptly was crucial for the states to be able to make informed decisions and run smooth elections as they renovated their election systems. The GAO stated: “The continued absence of a national clearinghouse for voting system problems means that segments of the election community may continue to acquire and operate their systems without the benefit of critical information learned by others regarding the security and reliability of those systems.” The report further stated that the EAC acknowledged the need but had given that task a “third-tier” priority and deferred it until after the 2005 standards were published. Accordingly, in 2005, the GAO recommended that the EAC: “Improve management support to state and local election officials by collaborating with TGDC and NIST to develop a process and associated time frames for sharing information on the problems and vulnerabilities of voting systems.” The 2007 report states that in 2006 the EAC spent “$3.5 million (25 percent) for research and study and to establish the EAC as a national clearinghouse of election administration information.” But after spending $3.5 million dollars on “research and study,” the EAC does not yet have this essential clearinghouse in place, nor even planned, as a 2007 GAO recommendation illustrates, once again using language that mirrors the 2005 recommendation: “Accordingly, we have recommended that the EAC develop a process and associated time frames for sharing information on voting system problems and vulnerabilities across the election community. ... Not yet defined are the mechanisms to collect and disseminate information on problems and vulnerabilities that are identified by voting system vendors and independent groups outside of the national certification process.” In fact, the EAC takes no action whatsoever to notify jurisdictions of known bugs that have wreaked havoc in other jurisdictions. In March 2006, for example, it was discovered that 70% of the memory cards ES&S delivered to Summit County, Ohio had failed, and a large number of those they delivered to North Carolina were also failing. John Gideon of VotersUnite, asked the EAC if they were informing other jurisdictions about the problem. Jeannie Layson, spokeswoman for the EAC, replied that they were not and would not: “Per your inquiry, EAC staff was made aware of this situation by the vendor, and the vendor said these customers have already been notified about the situation. When EAC assumes responsibility for the certification program, the agency will certainly share this kind of information with election officials.”
E. Establish management support for local officials, via information-based best practices.
	The 2005 report was clear that the infrequent and inadequate administration guidelines the EAC provided to local officials did not fulfill the HAVA mandate for management support. The GAO recommended that the EAC: “Improve management support to state and local election officials by establishing a process and schedule for periodically compiling and disseminating recommended practices related to security and reliability management throughout the system life cycle ... and ensuring that this process uses information on the problems and vulnerabilities of voting systems.” The 2007 report is equally clear that little has changed. It acknowledges that the EAC disseminated information in 2004 and again in 2006, but points out that “as the election environment and voting systems continue to evolve, additional lessons and topics will undoubtedly surface.” The 2007 report then virtually repeats the 2005 recommendation, and adds the reason why it is important to provide on-going information dissemination, based on on-going studies of the experiences of other election officials: “Accordingly, we have recommended that the EAC establish a process and schedule for periodically compiling and disseminating recommended practices for security and reliability across the system life cycle and that the practices be informed by information it collects on the problems and vulnerabilities of these systems. Incorporating the feedback obtained through actual voting system development, acquisition, preparation, and operations into practical guidance will allow the election community to be more robust and efficient.”
Conclusion After eight months of study in 2005, the GAO recommended that the EAC immediately take five actions that the GAO considered essential to fulfill the Commission’s HAVA mandate. To date, the EAC has accomplished only a portion of one of them. The 2005 report emphasized the need for the EAC to complete “key activities.” In recognition of the EAC’s on-going failure to do so, the GAO’s 2007 report emphasizes the need for state and local governments to “address electronic voting system challenges.” It is clear that the responsibilities Congress assigned to the EAC must now, indeed, be taken over by the state and local governments. Donetta Davidson, the current Chairwoman of the Election Assistance Commission, likes to say, “Assistance is our middle name.” However, the 2007 GAO report shows otherwise. It reveals that, after having spent nearly $30 million, the EAC is now begging off from its federally mandated duties to assist the States, claiming it is “resource constrained.” The EAC’s recent history suggests that money is not the impediment. The Commissioners appear to have no intention of fulfilling their duties under HAVA. The 2007 GAO report says (in the summary of findings, then again on page 3, and again on page 47): “To assist the EAC in executing its leadership role, GAO has previously made recommendations to the commission aimed at better planning its ongoing and future activities relative to, for example, system standards and information sharing. While the EAC agreed with the recommendations, it stated that its ability to effectively execute its role is resource constrained.” In 2002, HAVA established the EAC to be in effect through 2005. Now in 2007, the Commission has little to show for its three years in existence and $30 million spent. It has failed to provide the election assistance mandated by Congress and sorely needed by the States during the most significant overhaul of election systems in the history of the country. By its failures, the Commission allowed the state and local officials to flounder in confusion as they attempted to meet their own HAVA deadlines, which is precisely the situation that Congress was trying avoid by establishing the EAC. The Commissioners knew from the start that the States were being forced into election disarray. In April 2004, and again in January 2005, the EAC pointed out to the President and Congress that the delayed start up of the EAC would impact the ability of the States to effectively meet their HAVA deadlines. However, to truly assist the States, the EAC could have become a public champion for delaying the States’ deadlines, instead of standing silent while the Department of Justice intimidated States into rushing into implementation without the guidance guaranteed to them by HAVA. Reliable elections are the bedrock of representative democracy. Because of the EAC’s failure to effectively execute its role, public dissatisfaction with the electoral process grows with each election, and the country is now in an election system crisis. Bills recently introduced into both houses of Congress would establish and fund the EAC permanently, but such provisions defy common sense, and Congress should reject them. Congress should not tolerate the EAC’s failure to comply with its mandate. It should immediately appoint well-qualified, competent Commissioners and Executive Director to replace those now in office, or it should refuse to authorize further funding for this agency.

We believe that if Congress had intended to allow states
to delay their implementation of HAVA's voting system standards
until the first election for federal office after January 2006
(as opposed to being ready on January 1, 2006),
Congress would have used language saying just that.
~ Hans A. von Spakovsky
Counsel to the U.S. Assistant Attorney General
in response to a plea from the Louisiana Secretary of State
and Commissioner of Elections