2.03 - Democracy Suite R EMS Functional Description...308 2017-01-26 tijana.todorovic Added minor...

TO LEARN MORE ABOUT OUR TECHNOLOGY, PEOPLE AND SERVICES

VISIT DOMINIONVOTING.COM TODAY

2.03 - Democracy Suite R© EMS Functional Description

Version: 5.2-CO::319

February 16, 2017

NOTICE OF CONFIDENTIALITYAND NONDISCLOSURE

This document contains information that is protected as an unpublished work by Dominion Voting Sys-tems (Dominion) under applicable copyright laws. The Recipient is to retain this document in confidenceand is not permitted to copy, reproduce, or to incorporate the contents hereof into any other media otherthan as permitted in a written agreement with Dominion. The below statutory copyright notice shallnot imply or be deemed publication of this product.

PROPRIETARY NOTICE

The statements in this work, including, without limitation, directions, commentary, notes, and other ele-ments contained herein, and their selection, expression, format, ordering and other attributes, constituteproprietary and confidential technical information and are protected under Canadian, United States andInternational copyright and other intellectual property laws. Title and all rights thereto, including, butnot limited to all copyrights, trademarks and any trade secrets belong solely to Dominion. No distribu-tion of any contained statements by a licensee or use by a distributee, whether as a product or a service,including without limitation, the right to copy, duplicate, reproduce, adapt, publish, quote, translate orincorporate into other formats, media, or derivative works of any kind, is permitted.

ii

RELEVANT DISCLAIMERS

The final list of items to be disclaimed in this release is to be confirmed.Please be advised that this document may make reference to the following Democracy Suite R© function-alities:

• AIMS Data Translator

• Avalue tablets

• EMS Enterprise configuration

• Election Data Exchange Station (EDES)

• ImageCast R© Evolution

• ImageCast R© Evolution Dual Monitor functionality

• ImageCast R© Listener

• ImageCast R© Precinct

• ImageCast R© Precinct Audio

• ImageCast R© Precinct Ballot Marking Device (BMD)

• ImageCast R© Precinct BMD Audio

• Rank Choice Voting (RCV)

• Recall Issues

• Mode 2 asymmetric cryptography

• Mode 3 asymmetric cryptography

• NYS General and Primary Ballot Template

• Modem and transmission functionality

• WinEDS Importer

These functionalities are not components of the current Democracy Suite R© 5.2-CO certification campaign,and should be disregarded throughout the document.

iii

Revision History

Revision Date Author Summary319 2017-02-16 brian.fitzsimmons Set majorrevision to 5.2-CO, set disclaimer to 5.2CO318 2017-02-15 brian.fitzsimmons Created 5.2CO branch from 5.2 branch317 2017-02-02 brian.fitzsimmons Propset on all .tex files316 2017-02-02 brian.fitzsimmons Created 5.2 branch from trunk315 2017-02-02 brian.fitzsimmons Revised naming of Adjudication client application and EMS Adjudication ...308 2017-01-26 tijana.todorovic Added minor change.307 2017-01-06 dave.anderson Revised Adjudication section for 5.2.306 2016-12-15 tijana.todorovic Added disclaimers for 5.2.305 2016-12-14 tijana.todorovic Added minor change.304 2016-12-14 tijana.todorovic Updated document version.298 2016-08-30 dave.anderson 5.1 updates.295 2016-04-19 dave.anderson Small changes for 5.0: Removed references to EMS Adjudication Ser ...292 2016-04-19 tijana.todorovic Editing content for 5.0.291 2016-04-13 tijana.todorovic Updated document references.290 2016-04-05 tijana.todorovic Merging content from 4.21CO.287 2016-03-03 tijana.todorovic Merging content from branch 4.21CO.280 2016-01-14 tijana.todorovic Updated document version.279 2016-01-12 tijana.todorovic Updated section Domain Implementation - Adjudication, updated document ...278 2015-10-02 tijana.todorovic Editing document version.277 2015-10-02 tijana.todorovic Merging changes from CO branch.276 2015-04-20 tijana.todorovic Editing Audit Log subsection.275 2015-04-06 jelena.bozic Merged ADJ updates from CO branch and EMS updates into funk273 2015-04-06 tijana.todorovic Adding minor changes.272 2015-04-06 tijana.todorovic Added disclaimers for 4.19.271 2015-04-06 tijana.todorovic Editing System Overview and EMS Security description sections.266 2015-03-30 jelena.bozic deleted a dir commited by mistake265 2015-03-30 jelena.bozic Updating trunk content based on CO branch238 2013-09-20 devan.vandenboomen Removing outdated image.236 2013-08-21 julia.watson Grammatical edit235 2013-08-13 julia.watson Grammatical edits - (Chapters 1-3.4)234 2013-01-30 devan.vandenboomen Merging FL3 changes into trunk.227 2012-10-16 devan.vandenboomen Adding Document Use section.226 2012-10-05 tijana.todorovic Updated purpose and scope chapter.225 2012-09-18 devan.vandenboomen Updating disclaimer language and related tables.224 2012-09-13 tijana.todorovic Updated The Democracy Suite EMS Election Domain Model chapter.223 2012-09-12 tijana.todorovic Updated Election Event section.222 2012-09-07 tijana.todorovic Added Contest Headings and Line subsections. Updated TheDemocracySuite ...221 2012-09-06 tijana.todorovic Updated The Democracy Suite EMS Election Domain Model chapter.220 2012-09-05 tijana.todorovic Updated error message list.219 2012-09-04 tijana.todorovic Added new error messages.218 2012-09-04 tijana.todorovic Updated error message list.217 2012-09-04 tijana.todorovic Updated System Overview chapter.216 2012-08-20 tijana.todorovic Reporting section updated, Divisioning and Election Event section.215 2012-08-20 tijana.todorovic Updated Democracy Suite EMS Election Domain Model. Added Global Order ...214 2012-08-16 tijana.todorovic Updated EMS Election Domain Model chapter.209 2012-03-20 devan.vandenboomen Adding Telecommunications content.208 2012-03-20 devan.vandenboomen Changing title of capabilities checklist.207 2012-03-20 devan.vandenboomen Adding capabilities checklist.206 2012-03-16 devan.vandenboomen Adding BMD disclaimer.205 2012-03-16 devan.vandenboomen Adding landscape disclaimer.

iv

Allowed Authors (alphabetical)

subversionID Firstname Lastname TitlePositionbrian.fitzsimmons Brian Fitzsimmons Documentation Managerdave.anderson Dave Anderson Software Architectdevan.vandenboomen Devan Vanden Boomen Documentation Managerjelena.bozic Jelena Bozic Product Managerjuliawatson Julia Watson Documentation Editortijana.todorovic Tijana Todorovic Documentation Manager

v

Contents

Notice of Confidentiality and Nondisclosure ii

Relevant Disclaimers iii

Revision History iv

Allowed Authors v

List of Figures x

List of Tables xi

1 Purpose and Scope 11.1 Document Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.3 Document Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21.4 Referenced External Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

2 System Overview 32.1 Democracy Suite R© EMS Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32.2 Democracy Suite R© EMS Operational Environment . . . . . . . . . . . . . . . . . . . . . . 52.3 System Capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

3 The Democracy Suite R© EMS Election Domain Model 83.1 The Election Domain Entities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

3.1.1 Election Project Divisioning and Domain Objects . . . . . . . . . . . . . . . . . . . 113.2 The Election Domain Stakeholder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193.3 The Basic EMS Workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203.4 Domain Implementation - Election Event Designer . . . . . . . . . . . . . . . . . . . . . . 24

3.4.1 Election Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243.4.2 Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

3.4.2.1 User Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273.4.2.2 Database Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303.4.2.3 Network Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313.4.2.4 System Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313.4.2.5 Document Viewers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

3.4.3 Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313.4.3.1 Help Documentation and About Box . . . . . . . . . . . . . . . . . . . . 313.4.3.2 Localization Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

3.4.4 Divisioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323.4.4.1 Subdivision Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

vi

CONTENTS CONTENTS

3.4.4.2 Subdivisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333.4.4.3 Polling Subdivisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363.4.4.4 Political Parties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393.4.4.5 Elector Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413.4.4.6 Ballot group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433.4.4.7 Offices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453.4.4.8 District Rotations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473.4.4.9 Line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

3.4.5 Election Event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493.4.5.1 Election Event Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . 493.4.5.2 Project Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513.4.5.3 Ballot Style . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533.4.5.4 Prototypes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543.4.5.5 Contests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563.4.5.6 Choices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 593.4.5.7 Ballot Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 613.4.5.8 Activation codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633.4.5.9 Language Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 643.4.5.10 Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673.4.5.11 Contest Headings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693.4.5.12 Ballots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 703.4.5.13 Ballot Production . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

3.4.6 Tabulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713.4.6.1 Voting Locations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713.4.6.2 Tabulators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733.4.6.3 Counting Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 753.4.6.4 Programming Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763.4.6.5 Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 773.4.6.6 Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 783.4.6.7 Programming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

3.4.7 Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813.4.7.1 Election Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813.4.7.2 Divisioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 823.4.7.3 Election Event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 833.4.7.4 Tabulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 853.4.7.5 System Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 853.4.7.6 Audit Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

3.5 Domain Implementation - Results Tally and Reporting . . . . . . . . . . . . . . . . . . . . 873.5.1 Results Acquisition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

3.5.1.1 Local Import . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 883.5.1.2 Manual Entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

3.5.2 Results Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 893.5.2.1 View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 893.5.2.2 Analyze . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 893.5.2.3 Validate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

3.5.3 Results Publishing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 893.5.3.1 Transfer Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 903.5.3.2 Publishing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

3.5.4 Results Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 903.5.4.1 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 903.5.4.2 Produce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 903.5.4.3 View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

vii

CONTENTS CONTENTS

3.5.5 Results Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 913.5.5.1 Lookup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 913.5.5.2 Ballots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 923.5.5.3 Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

3.5.6 Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 923.6 Domain Implementation - Audio Studio . . . . . . . . . . . . . . . . . . . . . . . . . . . . 923.7 Domain Implementation - EMS Adjudication . . . . . . . . . . . . . . . . . . . . . . . . . 93

3.7.1 Adjudication Project Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 933.7.1.1 Outstack Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 933.7.1.2 Common Outstack Conditions . . . . . . . . . . . . . . . . . . . . . . . . 933.7.1.3 RCV Outstack Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . 943.7.1.4 Additional Outstack Conditions . . . . . . . . . . . . . . . . . . . . . . . 94

3.7.2 Starting Adjudication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 953.7.3 Results Acquisition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

3.7.3.1 Cast Vote Record (CVR) Service . . . . . . . . . . . . . . . . . . . . . . . 953.7.3.2 Batches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

3.7.4 Adjudication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 963.7.4.1 Ballots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 963.7.4.2 Contests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 973.7.4.3 Choices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 973.7.4.4 User Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

3.7.5 Reopening a ballot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 983.7.6 Spoiling Batches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 993.7.7 Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

3.7.7.1 Summary Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 993.7.7.2 Activity Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 993.7.7.3 Write-In Resolution Report . . . . . . . . . . . . . . . . . . . . . . . . . . 993.7.7.4 Statistics Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

3.7.8 Stopping Adjudication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

4 Democracy Suite R© EMS Security Description 1014.1 Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

4.1.1 Access Control Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014.1.2 EMS User Access Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1024.1.3 Monitoring System Access and Use . . . . . . . . . . . . . . . . . . . . . . . . . . . 1044.1.4 Data Retention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1044.1.5 ImageCast R© Precinct User Access Management . . . . . . . . . . . . . . . . . . . . 1044.1.6 ImageCast R© Central User Access Management . . . . . . . . . . . . . . . . . . . . 105

4.2 Data Integrity and Confidentiality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1054.3 System Level Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

4.3.1 System Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1064.3.2 System Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1074.3.3 System Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

4.4 Error Message Comprehension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1084.4.1 Democracy Suite R© EMS EED Error Handling . . . . . . . . . . . . . . . . . . . . . 108

4.4.1.1 Validating Input Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1084.4.1.2 Tracking Errors, Warnings and Status Information of Objects . . . . . . 109

4.4.2 Error Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1094.4.2.1 Memory Object Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . 1104.4.2.2 Database Redundant Server Recovery . . . . . . . . . . . . . . . . . . . . 1104.4.2.3 Database Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

4.4.3 ImageCast R© Error Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

viii

CONTENTS CONTENTS

4.5 Network Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1114.6 System Availability and Continuity of Operation . . . . . . . . . . . . . . . . . . . . . . . 112

Appendices 113

A EMS Error Messages List 114A.1 EED Client Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114A.2 Adjudication Client Application Error Messages . . . . . . . . . . . . . . . . . . . . . . . . 148A.3 DCM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155A.4 Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156A.5 Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161A.6 File System Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163A.7 USB File System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164A.8 Permission Exceptions within the EED Client . . . . . . . . . . . . . . . . . . . . . . . . . 166A.9 Permission Exceptions within the RTR Client . . . . . . . . . . . . . . . . . . . . . . . . . 166

ix

List of Figures

2.1 The Democracy Suite R© High-level Block Diagram . . . . . . . . . . . . . . . . . . . . . . 42.2 The EMS Flowchart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

3.1 The Election Project State Diagram. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103.2 Example of Political Divisioning Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . 123.3 The Election Domain - Independent Divisioning . . . . . . . . . . . . . . . . . . . . . . . . 133.4 The EMS Domain Model - Elector and Reporting Groups (example). . . . . . . . . . . . . 143.5 The EMS Election Domain - Election for Office of Congress (example). . . . . . . . . . . . 153.6 The Ballot Composition - Ballot Headers, Contests and Options . . . . . . . . . . . . . . 173.7 The Democracy Suite R© EMS Election Domain Stakeholders. . . . . . . . . . . . . . . . . 203.8 The EMS Election Event Designer Workflow. . . . . . . . . . . . . . . . . . . . . . . . . . 223.9 The EMS Results Tally and Reporting Workflow. . . . . . . . . . . . . . . . . . . . . . . . 233.10 The EMS Results Tally and Reporting Activities Structure. . . . . . . . . . . . . . . . . . 873.11 The Election Results Processing State Diagram. . . . . . . . . . . . . . . . . . . . . . . . . 88

4.1 The Computer Awareness and Data Security Compliance Confidentiality Statement . . . 103

x

List of Tables

3.1 Examples of Political Divisioning Types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113.2 The Election Project Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . 263.3 The EMS System Roles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273.4 The Roles Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . . . . . . 283.5 The Users Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . . . . . . 303.6 The Political Divisioning (Subdivision Types) Entity Attributes and Activities. . . . . . . 333.7 The Subdivisions Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . . 353.8 The Polling Subdivision Entity Attributes and Activities . . . . . . . . . . . . . . . . . . . 383.9 Political Parties Entity Attributes and Activities . . . . . . . . . . . . . . . . . . . . . . . 413.10 The Elector Groups Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . 423.11 The Ballot Group Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . . 443.12 The Offices Entity Attributes and Activities . . . . . . . . . . . . . . . . . . . . . . . . . . 473.13 The District Rotations Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . 483.14 The Line Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . . . . . . . 493.15 The Election Event Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . 513.16 The Project Settings Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . 533.17 The Prototypes Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . . . 563.18 The Contest Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . . . . . 593.19 The Choice Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . . . . . 613.20 The Ballot Types Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . . 633.21 The Activation Codes Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . 643.22 The Language Profiles Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . 663.23 The Template Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . . . . 683.24 Contest Headings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693.25 The Ballot Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . . . . . . 713.26 The Voting Location Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . 733.27 The Tabulator Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . . . . . . 753.28 The Counting Groups Entity Attributes and Activities. . . . . . . . . . . . . . . . . . . . 763.29 The Programming Groups Entity Attributes and Activities. . . . . . . . . . . . . . . . . . 773.30 The Configuration Profiles Entity Attributes and Activities. . . . . . . . . . . . . . . . . . 793.31 The Tabulator Configuration Items. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

4.1 File Type to Security Algorithm Mapping. . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

A.1 EED Client Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147A.2 Adjudication Client Application Error Messages . . . . . . . . . . . . . . . . . . . . . . . . 154A.3 DCM Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156A.4 Framework Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161A.5 Utilities Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162A.6 File System Service Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

xi

LIST OF TABLES LIST OF TABLES

A.7 USB File System Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

xii

Chapter 1

Purpose and Scope

VVSG vol II 2005§2.3

1.1 Document Use

This document is intended for use with the Democracy Suite R© 5.2 platform.

1.2 Introduction

Democracy Suite R© Election Management System (EMS) represents a set of enterprise grade, N-TierVVSG 2005 vol I§2.1.6software applications for defining and managing election projects of various sizes and complexities. This

document provides information specific to election domains to help all interested parties (developers,business stakeholders, etc.) understand the problem domain within Democracy Suite R© Election Man-agement System (EMS).

This document represents a functional description of the Democracy Suite R© EMS software platform.The internal structure of the software is covered in the following documents:

• 2.02 - Democracy Suite R© System Overview

• 2.05 - Democracy Suite R© EMS Software Design and Specification

• 2.06 - Democracy Suite R© System Security Specifications

• 2.07 - Democracy Suite R© System Test and Verification

• Democracy Suite R© EMS System Installation and Configuration Procedure

• Democracy Suite R© EMS Election Event Designer User Guide

• Democracy Suite R© EMS Results Tally & Reporting User Guide

• Democracy Suite R© EMS Audio Studio User Guide

• Democracy Suite R© ImageCast R© Adjudication User Guide

• Democracy Suite R© EMS Election Data Translator User Guide

• Democracy Suite R© EMS Results Transfer Manager User Guide

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 1

• Democracy Suite R© EMS Mobile Ballot Production User Guide

• Democracy Suite R© ImageCast R© Voter Activation User Guide

1.3 Document Organization

This document is organized as follows:

• Section 1 - Purpose and Scope - provides introductory information about the system as well asa list of applicable (TDP) specification documents contained within the Democracy Suite R© EMStechnical data package.

• Section 2 - System Overview - provides an overview of the primary components and functions of thesystem. It also includes logical and physical views into the system, as well as a workflow depictinghow the system is used. This section also describes the system requirements of the EMS platform.

• Section 3 - The Democracy Suite R© EMS Domain Model - provides a description of the electiondomain model defined for the system including domain entities, domain stakeholders and domainimplementation.

• Section 4 - System Security Description provides an introductory overview of the security aspects ofthe system. 2.06 - Democracy Suite R© System Security Specification includes a detailed descriptionof the security aspects of the system.

1.4 Referenced External Documents

• 2.02 - Democracy Suite R© System Overview

• 2.05 - Democracy Suite R© EMS Software Design and Specification

• 2.06 - Democracy Suite R© System Security Specification

• 2.07 Democracy Suite R© System Test and Verification

• Democracy Suite R© EMS System Installation and Configuration Procedure



• Democracy Suite R© EMS Audio Studio User Guide

• Democracy Suite R© ImageCast R© Adjudication User Guide

• Democracy Suite R© EMS Election Data Translator User Guide

• Democracy Suite R© EMS Results Transfer Manager User Guide

• Democracy Suite R© EMS Mobile Ballot Production User Guide

• Democracy Suite R© ImageCast R© Voter Activation User Guide

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 2

Chapter 2

System Overview

VVSG 2005 vol I§4.1.3.1

2.1 Democracy Suite R© EMS Overview

The Democracy Suite R© Election Management System (EMS) set of applications are responsible for allpre-voting and post-voting activities in the process of defining and managing elections. The completeEMS software platform consists of client (end-user) and server (back-end) applications as follows:

• Democracy Suite R© EMS Election Event Designer - main pre-voting phase end-user applicationintegrating election definition functionality.

• Democracy Suite R© EMS Results Tally and Reporting - main post-voting phase end-user applicationintegrating election results acquisition, validation, tabulation, reporting and publishing capabilities.

• Democracy Suite R© EMS Audio Studio - end-user helper application used to record audio files fora given election project. As such, it is utilized during the pre-voting phase of the election cycle.

• Democracy Suite R© EMS Adjudication Application - optional application that reviews voter intenton a ballot by ballot basis from the ImageCast R© Central device utilized during either the absenteevoting or post-voting activity phases.

• Democracy Suite R© EMS File System Service - stand-alone service running on client machinesenabling access to low level operating system API for partitioning CF cards, reading raw partitionon ICP CF cards, etc.

• Democracy Suite R© EMS Election Data Translator - end-user application used to export electiondata from election project and import election data into election project.

• Democracy Suite R© EMS Result Transfer Manager - stand-alone application used to transfer resultfiles from the remote locations to one or more central locations where the results can be tallied andreported on.

• Democracy Suite R© EMS Mobile Ballot Production - Windows application that is used to search,preview and print ballots via a local printer device.

• Democracy Suite R© Smart Card Helper Service - stand-alone service running on client machinesenabling ability to read to and write from smart cards.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 3

• Democracy Suite R© ImageCast R© Voter Activation - a Windows applications that is used by pollworkers to activate voting sessions by means of smart cards.

• Democracy Suite R© EMS Election Data Exchange Station - end-user helper application used toprogram the memory cards and iButton security key required to properly operate the ImageCast R©

series of ballot marking and counting devices. As such, it is utilized during the pre-voting phase ofthe election cycle.

• Democracy Suite R© EMS Data Center Manager client - system-level configuration application usedin EMS back-end data center configuration.

• Democracy Suite R© EMS Application Server - server side application responsible for executing longrunning processes, such as rendering ballots, generating audio files and election files, etc.

• Democracy Suite R© EMS Database Server - server side RDBMS repository of the election projectdatabase which holds all the election project data, including pre-voting and post-voting data.

Figure 2.1 shows a simplified, high-level logical block diagram of the Democracy Suite R© system. Thediagram includes EMS software components, as well as the ImageCast R© series of ballot marking andcounting devices. The diagram also contains election domain stakeholders, such as election administrativepersonnel and voters.

Figure 2.1: The Democracy Suite R© High-level Block Diagram

As shown in Figure 2.1, election administrative officers and their designees use the Democracy Suite R©

EMS EED client application to define the election project either manually or by importing data fromexternal sources. The system also allows users to define ballot styling parameters and record/synthesize

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 4

the corresponding audio files. Users can either utilize the audio synthesis capabilities of the EMS plat-form, or the audio recording capabilities of the EMS Audio Studio client application to perform thisactivity. As a primary output, this process provides ready to print ballot artwork, and if configured todo so, electronic ballots and audio files for AVS (Accessible Voting Session) voting.

The last step in election project definition is the generation of election definition and device behavioraland configuration files. This process analyzes the correlation between voting locations, geo-politicaldivisioning and all election event related data, such as ballots, contests and candidates, creating a setof files for each instance of the ImageCast R© device. These files are used to program memory cardsand iButton security keys, smart cards or ImageCast R© X voting systems for a particular election event.The EMS EED application provides integrated memory card, iButton and smart card security keyprogramming functionality, which allows one card/iButton/smart card to be programmed at a time.

Before utilizing produced ballots, memory cards and iButton/smart card security keys for a real electionevent, Dominion recommends that the jurisdictions perform logic and accuracy testing to confirm thatthe system is ready for election day deployment. On election day, jurisdictions can utilize ImageCast R©

Precinct or ImageCast R© Evolution or ImageCast R© X ballot counter and marking devices for pollingplace voting, or ImageCast R© Central ballot counters for central site processing of absentee, early votingor vote-by-mail ballots.

Each ImageCast R© device is designed to provide a set of result files, log files and scanned ballot images.These files are acquired by the EMS RTR client application. This application is used to validate,tally, report and publish election results. Figure 2.2 provides a high-level block diagram of the EMSplatform components and illustrates how they correlate with each other to provide an integrated electionmanagement platform.

EMS EED

Data ImportXML

EMS AS EMS APPS

EMS DB

EMS NAS

EMS EPS

EMS RTR

Utility Apps - No direct access to EMS Data Center

EMS Server Apps

EMS Client Apps

EMS DCM

Data ExportXML

Figure 2.2: The EMS Flowchart

2.2 Democracy Suite R© EMS Operational Environment

VVSG vol I 2005§2.5

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 5

Depending on the deployment scenario, Democracy Suite R© EMS system requirements can vary. However,due to its modularized architecture, it is possible to define the system requirements for each of thecomponents.1 The Democracy Suite R© EMS platform can be deployed in one of the following hardwareconfigurations:

• EMS Express hardware configuration - deploys all EMS software components on a single PC orlaptop. Envisioned for jurisdictions with up to 250 electoral districts (precincts/polls)

• EMS Standard hardware configuration - local network deployment of EMS software componentsutilizing one or more client PC or laptop computers for enduser applications (EED, RTR, AS,ADJ, FSS, EDT and RTM) and a single server hosting backend applications (DB, NAS, APPS,EMSService). Envisioned for jurisdictions with up to 1000 electoral districts (precincts/polls)

The Democracy Suite R© EMS platform consists of multiple software components as listed below:

• EMS Election Event Designer (EED) - enduser application

• EMS Results Tally and Reporting (RTR) - enduser application

• EMS Audio Studio (AS) - enduser application

• EMS Adjudication Application (ADJ) - enduser application

• EMS File System Service (FSS) - service component

• Smart Card Helper Service (SCS) - service component.

• EMS Election Data Translator(EDT) - enduser application

• EMS Result Transfer Manager(RTM) - enduser application

• EMS Mobile Ballot Production (MBP): enduser application

• EMS ImageCast Voter Activation (ICVA) - enduser application

• EMS Election Data Exchange Station (EDES) - enduser application

• EMS Application Server (APPS) - backend application

• EMS Service (EMSService) - backend application

• EMS Network Attached Storage (NAS) - backend file repository component

• EMS Database Server (DB) - backend database repository component

• EMS Data Center Manager (DCM) - backend configuration component

Detailed information about EMS Configurations can be found in 2.02 - Democracy Suite R© SystemOverview.

12.06 - Democracy Suite R© System Security Specification and 2.09 - EMS System Maintenance Manual describe main-tenance, transportation and storage procedures for all EMS applications. Please refer to manufacturer’s documentation forpreventive and corrective maintenance of EMS hardware.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 6

2.3 System Capabilities

Please refer to the following sections for descriptions on overall system capabilities, pre-voting, votingand post-voting capabilities and maintenance, transportation and storage capabilities:

Overall System Capabilities

• Security: Chapter 4

• Accuracy: Section 3.5.2

• Error Recovery: Section 4.4.2

• Integrity: Section 4.1.4

• System Auditability: Section 3.5.5

• Election Management System: This document provides a description of the Democracy Suite R©

Election Management System.

• Vote Tabulation: Section 3.4.6

• Telecommunications: Please see the Democracy Suite R© EMS Results Transfer Manager User Guide

• Data Retention: Section 4.1.4

Pre-Voting Capabilities

• Ballot Preparation, General Capabilities, Ballot Formatting, Ballot Production: Section 2.1

• Election Programming: Section 3.4.6.7

• Ballot and Program Installation and Control: Section 3.4.6.7

• Readiness Testing: Section 3.3

• Verification at the Polling Place: Section 3.5.2.3

Voting Capabilities

• Opening the Polls, Precinct Count Systems, Paper-Based Systems, DRE System Requirements:N/A

• Activating the Ballot: Please see the Democracy Suite R© ImageCast R© Voter Activation User Guide.

• Casting a Ballot, Common Requirements, Paper-based System Requirements, DRE Requirements:N/A

Post-Voting Capabilities

• Closing the Polls: N/A

• Consolidating Vote Data: This document provides a description on consolidating vote data.

• Producing Reports: Section 3.4.7

• Broadcasting Results: Section 3.5.3

Maintenance, Transportation, and Storage Capabilities

• Maintenance, Transportation, and Storage: Section 2.2

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 7

Chapter 3

The Democracy Suite R© EMSElection Domain Model

VVSG 2005 vol II§2.1.2

VVSG 2005 vol I§3.1.4.c

VVSG 2005 vol I§4.1.3.1

VVSG 2005 vol I§4.1.8.1

VVSG 2005 vol I§4.1.8.2

VVSG 2005 vol I§5.4.1

VVSG 2005 vol I§5.4.2

VVSG 2005 vol I§6.1.2

VVSG 2005 vol I§6.1.3

One of the challenges of implementing an election domain model is the heterogeneity of different jurisdic-tions. To reduce this complexity, the characteristics of the various processes in individual jurisdictionalareas must be generalized in order to form a model which can be applied to many different situations.

3.1 The Election Domain Entities

VVSG vol II 2005§2.3

VVSG vol II 2005§2.5.e

VVSG vol II 2005§3.2.3

Democracy Suite R© EMS functionality is based on the election domain model which consists of thefollowing domain entities:1

• An election project represents a top-level election domain element within the EMS election domainmodel.

• All other election domain entities are defined under the election project. Each election projectcontains its own instance of the election data model in the EMS database and can be created,edited, saved, etc.

• Each election project has an associated set of project files (reports, ballot files, audio files, etc.)stored on the EMS NAS server. In this sense, an election project entity represents a placeholderfor all election domain related entities and associated election event artifacts.

Each election project can be in one of many possible states. The following states are defined:

• State 1 - Election Project Definition

– The initial state of the election project which covers the steps of creating an election project,configuring system properties, and defining election entities such as political divisioning, lan-guage profiles, offices, contests and choices. These election entities can be imported into thesystem from external systems, or entered manually.

1To see the list of items supported, refer to Democracy Suite R© 4.0 Supported Functionality Declaration 20110701.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 8

– Once an election event is defined in EMS EED, the ballot structure must be defined. Ballotcreation does not represent the generation of ballot file artifacts, such as PDFs, PNGs, XMLs,etc. Ballots represent a logical or abstract collection of ballot election entities (choices, con-tests, etc.) and other ballot related attributes. Ballots are defined for a specific combinationof geo-political, elector grouping and language profile associations. Once ballots are createdin the EMS Database, the election project transitions from the “Election Project Definition”to the “Election Project Styling” state.

• State 2 - Election Project Styling

– This state covers the styling of paper and accessible voting session (AVS) ballots accordingto the defined language profiles supported within the election project. Choice and contestrepresentations on the physical (PDF or PNG) ballot can be defined, as well as templates forballot headers, contests, choices and other static text on the ballot. In this state, the user canpreview ballot artwork in the form of PDF files.

– Once the ballot artwork has been deemed satisfactory, the process of generating official ballotmanifestations is initiated. Ballot manifestations are generated in PDF, PNG and XML fileformats. Once official ballots are generated, they are stored on the EMS NAS server for agiven election project. Optionally, the system can synthesize audio files for a given set oflanguage profiles. Once this step is finished, the election project transitions to the “BallotsGenerated” state.

• State 3 - Ballots Generated

– A state of the system in which official ballots already exist on the EMS NAS server for agiven project. In this state, the user can proofread generated ballots and play synthesizedaudio files or attach pre-recorded audio files (if required), as well as modify information aboutvoting locations and tabulators.

– Once the final preparation of election project data is finished, election files/databases fortabulators are generated. As a result, a set of election files/databases will be stored on theEMS NAS server for all tabulators defined for a given election project. Finally, the electionproject transitions to “Ready for Election” state.

• State 4 - Ready for Election

– In this state, the system is ready for the election and the user can program memory cards andiButton security keys for an election event.

– Once memory cards and iButton/smart card security keys are programmed and labeled, thesystem can be used for voting. Voting can be performed using different voting channels -absentee voters can vote by mail, or election day voters can use tabulators to cast theirballots on the voting location. In any case, if the official voting session is initiated at thispoint, this also concludes ‘Cycle 1’ of Election Definition for the election project.

• State 1A - Last Minute Definition

– Allows late modifications to be made within the system even after election files have beencreated and the initial voting session starts (i.e. absentee vote by mail). Its functionalityis based on the election definition cycles which allow users to define election projects andeven perform some of the advanced voting features (such as mailing absentee ballots) whilestill correcting (modifying, adding or disabling) some election project data (such as adding ordisabling a candidate, contest, etc.) for election day voting.

– In the transition to the “Last Minute Definition” state, the system enters ‘Cycle 2’ of theElection Definition. After performing the desired set of modifications, the user initiates a newcycle of the project.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 9

• Election Definition Cycle 2: State 2A, 3A and 4A - Election Project Styling, Ballots Generatedand Ready for Election

– Once the election project has passed from “Last Minute Changes” to “Election ProjectStyling”, the system creates new ballot instances based on the newly defined data. In thisstate, the user can filter and delete ballots (abstract ballots, not official ballots) that are notneeded. When transitioning to the new “Ballots Generated” state, the system will only createballot manifestations (PDF and PNG) files for the missing (altered) abstract ballots. In thefinal transition to the “Ready for Election” state, the system will contain all data from allelection definition cycles. As a result, election files will be applicable for all ballots from allelection cycles.

• State 5 - Election Project Closed

– Prepares the system for archiving of the election project. In this state, the election projectcannot be used for election event organization.

See Figure 3.1 for a visual representation of election project states.

Figure 3.1: The Election Project State Diagram.

According to the EMS architecture, it is not possible to skip or bypass any of the states starting withState 1. This means that none of the defined actions from state i + 1 can be performed if state is notdefined and the project state has changed to state i + 1. For example, the system is not allowed to

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 10

produce ballots if the Election Event domain entity is not defined. Transitioning from a lower state(i−1) to an upper state (i) is performed implicitly by the system. If the user wants to perform an actionfrom state i − 1 (for i > 1) while the election project is in state i, he/she has to explicitly change thestate before the action can be performed. In this case, some of the information will be lost, and certainactions will need to be repeated. However, this approach provides full data consistency.

Election project state transitions are controlled by the EMS internal state machine. In the case, whenuser tries to execute a certain action that is not allowed in the given state, or to try to transitionthe election project from one state to the other out of sequence, he/she will be notified with the errormessage. To validate the successful transition from one state to the other, user can verify that all the fileartifacts are created by the system. For example, when system transitions from Ballot Styling to BallotsGenerated state, system generates a set of ballot PDF files with all the corresponding additional files(such as audio files, etc.). In the case that system is not capable of completing the requested operationfor a given state, user will be notified with the error message.

3.1.1 Election Project Divisioning and Domain Objects

VVSG vol I 2005§2.1.7.2

See below for a list of divisions and domain objects comprising an election project.

• Jurisdiction - represents a top-level administrative division for which the election project is defined.This can be State, County2 or in some cases, Municipality, Township, Town, Borough, IncorporatedPlace (City), etc.

• Subdivisions - represents a hierarchical tree-like structure of administrative, electoral and geograph-ical areas defined within the election project. The Jurisdiction domain entity represents a top-leveldivision for which the election project is defined. The top-level entity (i.e. jurisdiction) is seenbelow in the complete hierarchy of subdivision domain objects that can be defined (see Table 3.1and Figure 3.2). Subdivisions are characterized by type and instance below3.

Political Divisioning TypesBorough Parish StateCanton Prefecture Sub-districtCity Province TerritoryCounty Region TownDistrict Republic TownshipFederal state Rural district VillageMunicipality Shire Ward

Table 3.1: Examples of Political Divisioning Types.

2States and counties are the major legally defined political and administrative units in the United States. A county isgenerally a sub-unit of regional self-government within a sovereign jurisdiction, such as a state.

3For example, a constituency with a representative in US Congress is a Congressional District that can be defined withinthe Federal State. In this example, Congress represents an Office domain entity, while a Congressional District representsa type of Subdivision domain entity. An instance of this Subdivision is Congressional District 1, Congressional District 2,etc. Each US Federal State is organized into one or more such subdivisions (in this case, Congressional District type). Onlyvoters living within each of the Congressional Districts are allowed to vote in the election for the member of the Congressfrom that district.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 11

Figure 3.2: Example of Political Divisioning Structure

• Polling Subdivisions - represents the election domain object that is the lowest level administrativesubdivision within which a voter is allowed to vote that does not have a separate governmentalauthority. In the United States, these polling subdivisions are called precincts and in some cases,electoral districts (EDs). Note that polling subdivision is commonplace terminology in the electionsindustry.

– A precinct is generally the lowest-level minor civil division in the United States. Precinctsusually do not have separate governmental authorities, but for the purpose of conducting elec-tions, the next highest-level MCD4, such as a county or township, is subdivided into precinctsand each address is assigned to a specific precinct. Each precinct has a specific location whereits residents go to vote. Sometimes several precincts will use the same polling location. A2004 survey by the United States Election Assistance Commission reported precincts in theUnited States contain an average of approximately 1100 registered voters.

There are different types of divisions and correlations amongst jurisdictions, subdivisions and pollingsubdivisions:

• Hierarchical divisioning - This type of divisioning takes the top subdivision area and divides itinto smaller sub-areas (subdivisions), and each sub-area is then subdivided into smaller portions.A polling subdivision can be as large as the smallest area (subdivision type C), or it can bea subdivision of this type again. For example, Subdivision C2 could contain a set of PollingSubdivisions (see Figure 3.3).

4Minor Civil Division (MCD) is a term used by the US Census Bureau to designate the primary governmental and/oradministrative divisions of a county or township, town, incorporated place (City) or borough.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 12

• Independent Divisioning - This type of divisioning can be seen in Figure 3.3. It allows the topsubdivision area to be divided in many different independent subdivisions. A Polling Subdivisionis a member of various subdivisions. The borders of Polling Subdivisions are usually determinedby the overlaying area borders of all subdivisions, which in turn create disjointed smaller areas.5

Figure 3.3: The Election Domain - Independent Divisioning

• Offices - represents a set of positions to which people or political parties are elected. Offices areclosely related to subdivisions and elector groups. An office is applicable to a certain subdivision,which represents an administrative or geographical grouping of electors. This means that peopleliving in a given subdivision can vote and elect members to office. On the other hand, offices canbe applicable to elector groups, which clusters electors in a non-geographical manner, so that onlymembers of the given elector group can vote for that office. Sometimes there is a need to organizeoffices into office groups, which are used to collect and present related offices on the ballot (i.e.State offices, Judicial office, etc.).

• Language Profile - represents a domain entity for definition of different language presentations ofEMS outputs (ballots, audio files for AV Sessions etc ...). They are divided into two types: “audio”

5Note that polling subdivision is commonplace terminology in the elections industry and does not appear in the appli-cation. Please be advised that the term that appears is precinct.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 13

and “ballot content” (textual) profiles. Single textual profiles can have one or more correspondingaudio profiles6.

• Elector Group and Ballot Group - a non-geographical grouping of electors (voters) in a givenelection. This grouping can be based on different classification criteria, including political partymembership, school board support, early voters, absentee voters, polling day voters, etc. Withinthe domain model, there is always one default election group entity, which encompasses all eligiblevoters (default election group). When different groups of electors are only allowed to vote incertain contests for certain offices, a separate elector group instance is created. Each elector groupis characterized by its type and instance. (see Figure 3.4).

Figure 3.4: The EMS Domain Model - Elector and Reporting Groups (example).

• Political Party - represents a registered political party organization or group of people active withinthe jurisdiction. Typical examples are the Democratic and Republican parties in the United States.

• Election Event - represents an instance of the election in time with its set of contests, candidates,polling locations and ballots (see Figure 3.5). Election Events are characterized by the ElectionEvent Qualifiers, which define the type of election event: General Election and Closed Primary. Inaddition, the election event can contain different options, such as rotation rules7.

6For example “English textual profile” has the “English audio profile” as its counterpart. However, if the ballot isrequired to have both English and Spanish text, then an “English/Spanish” textual profile would be defined and the twocorresponding audio profiles (“English” and “Spanish”) as well. These profiles would be connected to the “English/Spanish”textual profile.

7Please reference Democracy Suite R© EMS Election Event Designer User Guide for supported functionalities.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 14

Figure 3.5: The EMS Election Domain - Election for Office of Congress (example).

– Primary electionsVVSG 2005 vol I§2.1.7.2∗ Open Primary : In this type of election, the elector does not declare a party. He/she is

given a ballot with all parties, issues, and non-partisan contests on one ballot.In the private voting booth, the person decides which of the partisan tickets to vote for.If the elector votes for Democrats and Republicans, the partisan ballot is not counted,but proposition-type contests (i.e. questions) and non-partisan contests (such as schoolboard) are counted.

∗ Closed Primary : Primary election in which voters receive a ballot listing only thosecandidates running for office in the political party with which the voters are affiliated.In some states, non-partisan contests and ballot issues may be included. In some cases,political parties may allow unaffiliated voters to vote in their partys primary.

∗ Pick-a-Party : Similar to an open primary, but the first office/contest is a question as tothe voter’s party preference. If the elector selects political party X, but then he/she straysover to vote for a political party Y, the votes for party Y are ignored.

∗ Blanket/Jungle primary : In the United States, the blanket primary (also known as ajungle primary) is a system used for selecting party candidates in a primary election.In a blanket primary, electors may pick one candidate for each office without regard topolitical party lines; for instance, a voter might select a party X candidate for governorand a party Y candidate for senator. The candidates with the highest votes by party foreach office advance to the general election as the respective party’s nominee. This type of

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 15

Primary differs from the open primary which allows voters to pick candidates regardlessof their own party registration, but stick to candidates from a single party.

– General Elections

∗ Straight Party ticket : the first contest on the ballot is a vote for all candidates of partyX or party Y. This will give a vote to all candidates associated with that party. Theelector must continue to vote for propositions/referendums and non-partisan offices onthe remaining ballot contests.

∗ Direct votes: elector marks individual candidates.

∗ Inclusive straight rules: applicable when a contest has both direct votes and straightparty selections. When a contest has more than one maximum vote and the combinationof direct voting and straight party voting creates an overvote, only the direct vote iscounted. If the straight party vote and direct vote do not create an overvote, all votes arecounted.

∗ Exclusive straight rules: if both direct voting and straight party voting are used for acontest, then straight party votes are not counted; only direct votes.

• Contest - represents a domain entity which contains one instance or representation of the set ofcandidates running for an office. Due to rotations or other contest criteria, contests can differfrom one ballot to another. This entity is defined within the model as a contest manifestation.In addition, each contest has an associated language profile which defines the way contests arepresented on the ballot and within election reports.

• Choice - represents a domain entity which defines a single or composite candidate record or refer-endum question. A referendum question contains a set of options (votes or answer options), but isalways counted as a single vote. In addition, each choice has an associated language profile, whichdefines the way choices are presented on the ballot and within election reports.

• Voting Location - represents a domain entity which defines a physical place where electors casttheir ballots during an election event. This entity is sometimes defined as a polling location or apolling place. Depending on the election automation model deployed (decentralized or centralized),ballots can be cast using Dominion decentralized polling subdivision devices at each of the votinglocations (i.e. ImageCast R© series), or by using regular ballot boxes in which case Dominion centraldevices are used for ballot processing.

• Ballot - represents a domain entity which is an instance or representation of the ballot to beused during the election event. Ballot headers, contests and options including layout, content andlanguage profiles characterize the ballot representation (see Figure 3.6).

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 16

Figure 3.6: The Ballot Composition - Ballot Headers, Contests and Options

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 17

• Tabulator - represents a domain entity used to scan, analyze and tabulate ballots during an elec-tion event. A distinction is made between decentralized and centralized ballot counting devices:ImageCast R© Precinct and ImageCast R© Central optical ballot scan counters.

• Election Result - a domain entity which defines the results produced by a single instance of thetabulator domain entity. Results are acquired from tabulation devices (ImageCast R© Precinct ,ImageCast R© Evolution and ImageCast R© Central ) and are used to produce election reports afterthe results are validated.

• Election Results Tally - represents a domain entity which summarizes the individual election resultentities. The election tally is not only based on individual election results, but also on the definedpolitical divisioning structure.

• Election Report - represents a domain entity which defines a set of election reports created for agiven election event. The level and type of reporting that occurs is based on the report types.

• Election Auditing - represents a domain entity which defines the complete audit log for givenelection results (scanned paper ballots and log files produced by the tabulators).

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 18

3.2 The Election Domain Stakeholder

Within the election domain model, the following stakeholders are defined (see Figure 3.7):

• Democracy Suite R© EMS EED Administrator - an electoral office role with a full set of supervisorypermissions and rights for using the EMS EED application. This includes a full set of rights fordefining an election project domain entity with all associated domain sub-entities, requiring a deepknowledge and understanding of the EMS system. In addition, this role has permission to createand configure all other users of the system for both EMS EED and RTR. This role also acts as amain interface for the Dominion technical and project management team. One or more users ofthis role can be defined within the system. However, by default, the system is delivered, installedand configured with only one EMS EED administrative user.

• Democracy Suite R© EMS EED Operator - a member of the electoral office team with a limited setof permissions for using the EMS EED application. This role is defined to be used for some ofthe more time-consuming tasks, such as defining contests and candidates, creating ballot samples,and running unofficial reports. Users of this role create the EMS EED administrative user. One ormore users of the EMS EED Operator role can be defined within the system.

• Democracy Suite R© EMS EED Technical Advisor - a member of the Dominion technical teamknowledgeable in every aspect of the EMS EED system. This role acts as the primary Dominioncontact for the electoral office administrator.

• Democracy Suite R© EMS EED Languages Operator - a special non-administrative role for opera-tors who define different language translations within the system. This role is primarily used fortranslating ballot elements and tabulator display messages.

• Democracy Suite R© EMS RTR Administrator - an electoral office role with a full set of supervisorypermissions and rights for using the EMS RTR application. This includes a full set of rights foracquiring, validating, publishing, reporting and auditing election results. One or more users of thisrole can be defined within the system. There are no users of this role created by default, whichmeans that the EMS EED Administrator must create users of this role type.

• Democracy Suite R© EMS RTR Operator - a member of the electoral office team with a limited set ofpermissions for using the EMS RTR application. The user of this role can acquire election resultsand create reports, but cannot validate, publish or audit election results.

• Democracy Suite R© EMS RTR Auditor - a member of the electoral office team who only has per-mission to audit election results.

• Democracy Suite R© EMS RTR Technical Advisor - a member of the Dominion technical team withdeep knowledge of every aspect of the EMS RTR system. This role acts as the primary Dominioncontact for the electoral office administrators.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 19

Figure 3.7: The Democracy Suite R© EMS Election Domain Stakeholders.

3.3 The Basic EMS Workflow

VVSG 2005 vol II§2.2 and §2.2.4

The following steps are the main high-level activities to be performed when using the Democracy Suite R©

EMS Election Event Designer for defining elections and are also outlined in Figure 3.8:

1. System data center installation, configuration and testing based on the applicable deployment sce-nario. This includes making the appropriate system architecture layout and component selectionskeeping in mind the size, type and complexity of the election project. During this step, the baselineset of Configuration Items (CIs) for the system will be established for a given project, causing aCMDB update and preparing the system for further service support processes.

2. Hands-on training sessions for different types of stakeholders with appropriate examples on how touse the system. The purpose of this step is to help election project teams become acquainted withdifferent usage scenarios and perform mock-up election project definitions.

3. Initial starting of the application and creation of a new election project for a given jurisdiction.This includes its main attributes, generic settings for applicable language profiles, database settings,network configuration, backup and other system options. After this step, the system will havecreated an instance of the EMS database that is ready to define the election project structure.Only the default administrative users of the platform will be allowed to do so.

4. Definition of users, roles and permissions for the system. The system is delivered with a set ofpredefined system roles with a defined set of permissions for each role. In addition, only one default

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 20

user of the administrative role exists within the system upon its installation and initial startup.The default administrative user will create additional users according to the election organizationstructure. Custom roles can be defined as needed.

5. Generating and reviewing a baseline election and system report showing how the system is config-ured. This top-level system report contains basic information about the election project and itssettings, as well as a list of all defined users and their roles.

6. Defining or importing the administrative, geographical and political divisioning of the jurisdictionfor which the election project is to be defined. This step starts with the definition of the politicaldivisioning hierarchy with the jurisdiction node as a root node. The following activities within thisstep include definition of political parties, elector groups, subdivisions, polling subdivisions, andoffices.

7. Producing and reviewing the divisioning reports. These reports show the political divisioning struc-ture of the jurisdiction for which the election project is defined, including subdivisions, pollingsubdivisions, offices, political parties and elector groups.

8. Defining the election event with its attributes, options, counting groups, contests, candidates, pollinglocations, etc. At this point, the data needed to program election files and produce ballots isdefined. If needed, the style and appearance of the content, including language translations, canbe performed during this step.

9. Defining and producing ballots for the given election event. After correctly performing step 8, thisprocess is mostly automatic. After selecting the ballot template, contest and candidate informationis rendered on the ballot, allowing users to preview created ballot styles.

10. Producing and reviewing election event reports which validate that the election event is definedas required and that ballot layouts are correct. Users are ensured that all candidate and contestinformation is defined correctly, and that produced ballot styles are valid.

11. Defining and configuring optical tabulators - Democracy Suite R© ImageCast R© Precinct , ImageCast R©

Evolution and ImageCast R© Central devices. This process includes the creation of the Device Con-figuration Files (DCF), Machine Behavioural Settings(MBS) and Voting Information Files (VIF)needed for the proper operation of the tabulator devices.

12. Configuring any add-on system options (e.g. AVS voting capabilities).

13. Producing and reviewing the optical tabulator definitions. This step includes producing and review-ing the tabulator definition report, as well as the creation of the Logic and Accuracy test set usedfor performing the system readiness tests.

14. Inspecting the assignment of optical tabulators to designated polling locations.

15. Producing the election master configuration files for optical tabulator programming as well as finalballot layouts for printing. This phase also includes producing (programming) the Compact Flashmemory packs with election files for tabulator devices and programming the iButton security keysfor tabulator access control activities.

16. Producing and reviewing the auditing report. Before the system is officially declared ready fordeployment, the auditing report is inspected. This report lists all the actions performed for thecurrent election project.

17. Saving, backing-up and exporting the election project.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 21

Figure 3.8: The EMS Election Event Designer Workflow.

The main high-level steps to be performed when using the Democracy Suite R© EMS Results Tally andReporting client application (see Figure 3.9) to process election results are:

1. System installation, configuration and testing according to the deployment scenario. This stepinvolves making the appropriate system architecture layout and component selections keeping inmind the size, type and complexity of the election project. At this step, the baseline set of CIs(Configuration Items) for the system will be established for a given project. This will also cause aCMDB update and prepare the system for further service support processes.

2. Hands-on training sessions for different types of stakeholders. This includes appropriate exampleson how to utilize the system. At this stage, Logic and Accuracy testing based on the test data setsproduced by EED will be performed as well.

3. Acquisition of the election results using one of the supported methods. These methods are: loadingresults from e-Counting device memory packs, processing results uploaded using the modem fromthe e-Counting devices, or manual data entry of the results.

4. Validation of the acquired election results. This includes inspection of the contest and ballot levelresults. At this stage, ballot images can be inspected as well. When validating election results,current election result totals are updated.

5. Publishing of the election results. This generates an XML representation of the current validatedelection result totals.

6. Generating and previewing election reports.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 22

7. Auditing by inspecting ballot images and the corresponding recorded votes.

Figure 3.9: The EMS Results Tally and Reporting Workflow.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 23

3.4 Domain Implementation - Election Event Designer

VVSG 2005 vol I§2.1.2

VVSG 2005 vol I§2.1.6

VVSG 2005 vol I§2.1.7

VVSG 2005 vol I§2.2.1

VVSG 2005 vol I§2.2.2

VVSG 2005 vol I§2.2.4

VVSG 2005 vol I§2.2.6

3.4.1 Election Project

VVSG 2005 vol I§2.1.7.2

Election Event Designer is an election project-oriented software tool. This means that each instanceof the election (i.e. an election event for a given jurisdiction) is defined as a project and has its owninstance within the EMS database. Access to the database is tightly controlled and uses two-levels ofauthentication: access to the EMS Database Server and to the EMS client application (EED or RTR).8

Each Election Project domain entity is characterized by the following attributes:

• Create

• Open Projects

• Close Project

• Save Project As

• Create Backup

• Import

• Export

• Exit

The following list defines each attributes in detail:

• Create - action used to define a new election project. Selecting this activity triggers a set ofdialogs for the definition of a new election project, its file system structure and associated electiondatabase. A new instance of the project is created with its file system structure on the networkattached storage drive (used to store associated files such as reports, ballots, election configurationfiles, etc.), and on the database. The database name is a combination of the election project nameand the date of the election event. The database is used to store all the election data model entitiesand their relationships. This action is only allowed for users belonging to the administrative role.

• Open Project - action for opening an existing election project which is related to its correspondingdatabase. This feature allows users to start defining the election project at one time and continuethe definition process at some other time. In addition, this feature allows a number of applicationusers to concurrently work on defining the same election project, possibly from different physicallocations, in a distributed and transactional manner.

• Close Project - action for closing a currently open election project.

• Save Project As - action for saving/copying an election project under a different name. This featurecreates a new instance of the database with the created election data model. The AES key andvector, common HMAC tabulator key, EED digital certificate, and tabulator user passwords (ifpassword type is “Default”) will be reset after creating copy of a project.

8For a detailed description of the system security mechanisms, see Section 4.3.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 24

• Create Backup - action for creating election project backup package, which contains a backup of theelection project database instance from the EMS DB Server and can also contain a set of associatedproject files from the EMS NAS Server, such as reports, audio files, ballots, etc.

• Import - action for importing election entities. This function allows a variety of election projectdata (such as elector counts) from other legacy systems or EMS to be imported. The intermediatefile format used for exchanging data between election projects is XML. This action is only availableto users belonging to the administrative role. In addition, the import function allows users toimport dynamic audio files, template keywords, device configurations and reports.

• Export - action for exporting audio library definition files, ballot on demand definition files (de-pending on selected ballot style) and elector counts (in XML format). The audio library definitionfile is used by the EMS Audio Studio application to record or attach required audio files for a givenelection project. All synthesized audio files along with the xml file can be exported. On the otherhand, ballot on demand definition files correlate ballot IDs and polling subdivisions and can beused by Ballot on Demand applications for at-the-poll ballot printing. The Elector Counts xml fileis used for adding numerous electors. This action is only available to administrative users.

Table 3.2 lists Election Project activities and attributes with their description, visibility/configurabilitystatus, and required roles.

Election ProjectActivityName Description Visibility/ConfigurabilityName Unique name of the election project. Configurable by the

user.Date Date of the election. Configurable by the

user.Type Type of election - General Election or Closed Pri-

mary.Configurable by theuser.

Jurisdiction Name of the jurisdiction for which election project isdefined.The jurisdiction also represents a top level area.

Configurable by theuser.

JurisdictionType

Type of jurisdiction for which the election project isdefined.For possible jurisdiction type values, see 3.1.1.

Configurable by theuser.

Description Free-text description of the election project object. Configurable by theuser.

Database Database configuration string parameters includingserver name, authentication credentials, etc.Access to the database requires database-level au-thentication in addition to application-level (electionproject) authentication.

Not directly config-urable by the user.

File System File system structure for election project output files- (reports, ballots, device definitions, audio files,etc.).This file structure is created on the NAS.

Not configurable bythe user.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 25

ID Unique Election Event ID. Directly config-urable by theuser.

External ID Used for data import and export from external sys-tems.

DigitalCertificateX.509

Common digital certificate for digitally signing bal-lots produced by the EMS system.


CommonAES Key

Common encryption key for the AES algorithm usedfor protecting election files. The key is 128 bits long.One AES key is defined per election project.


CommonSHA-256Key

Common encryption key for HMAC algorithm usedfor signing of election files and other files producedby the EMS system.One SHA key is defined per election project.

Not configurable.

ActivityName Description Role RequiredCreate Create a new election project. Any Role.OpenProject

Open existing election project. Any Role.

CloseProject

Close the currently active election project. Any Role.

Save ProjectAs

Copy the active election project to a new one. Any Role.

Createbackup

Create an election project backup package for theactive election project.

Any Role.

Import Import applicable XML formatted project data intothe election project. Import applicable files: Dy-namic Audio files, Template Keywords, Device Con-figurations (DCF and MBS), Reports and ElectoralCounts.

Any Role. Importelection projectdata to XML fileand Import DeviceConfigurationsfile is allowed forAdministrativerole.

Export Export project data from the election project toXML format. Exportable files: Audio Studio defini-tion file, Ballot on Demand definition file and Elec-toral Counts.

Export can be per-formed by any role.

Exit Exit application. Any Role.Table 3.2: The Election Project Entity Attributes and Activities.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 26

3.4.2 Administration

3.4.2.1 User Management

User management within Democracy Suite R© EMS relies upon a role-based security framework. Thismeans that the system defines a set of applicable roles with certain sets of permissions. Users can onlybelong to one of these roles.

The User Management system within EMS EED integrates the following actions:

• Roles - action for defining user roles. Each role corresponds to one of the predefined user stakeholderprofiles, but custom roles can be created as well. Each role is characterized by a set of permissionsunder the permissible objects of the application for the members (i.e. user) of that role. The rolesare defined as specified in Table 3.3.

Each role is characterized by the following attributes:

– ID

– Name

– Application

– Password Type

– System Role Flag

– Admin Role Flag

– Set of Permissions

– Set of Users

Role Level Configurability ApplicationEMS EED Administrator Administrative System Default EEDEMS EED Operator Operator System Default EEDEMS EED Technical Advisor Administrative System Default EEDEMS EED Languages Operator Operator System Default EEDEMS EED Custom Operator Configurable EEDEMS RTR Administrator Administrative System Default RTREMS RTR Operator Operator System Default RTREMS RTR Technical Advisor Administrative System Default RTREMS RTR Auditing Operator Operator System Default RTREMS EED Custom Operator Configurable RTR

Table 3.3: The EMS System Roles.

Default system roles cannot be deleted and are created by default upon the installation of application.Only users of administrative and technical advisory roles can modify other roles and define custom roles.

In general, roles can contain the following actions: Lookup, Filter, Create New, Edit, Delete, Sort andPrint Preview (see Table 3.4 for more details).

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 27

RolesAttributesName Description Visibility/ConfigurabilityID Unique role ID (GUID - globally unique ID). Not directly configurable

by the user.Name Unique name of the role. The names of the system

roles can not be changed.Directly configurable bythe user for non-system(custom) roles only.

Application Application to which the role is applicable. Two pos-sibilities exist - EED and RTR.

Directly configurable bythe user for non-system(custom) roles only.

PasswordType

Password Strength for a given role: Weak (6 char-acters - lower and upper case characters), Default(8 characters - Lower and upper case characters anddigits), Strong (10 characters - Lower and upper casecharacters, digits and special characters).


System RoleFlag

Read-only flag which shows the given custom role orsystem role.

Not directly configurableby the user.

Admin RoleFlag

Editable flag used to mark a given role as an admin-istrative role.

Configurable by the user.

Permissions Set of permission target objects and permissions fora given role.


Users Set of users defined as members of a given role. Indirectly configurable bythe user.

ActivityName Description Role RequiredLookup andFilter

Perform a lookup/filtering for a specific role. Any Role.

Create New Create a new role object. Administrative.Edit Open for editing an existing role object. Administrative.Delete Delete one or more of the selected role objects. Only

custom roles can be deleted if they are not linked toany of the user accounts.

Administrative.

Sort Advanced sorting and ordering of role records basedon the associated attributes.

Any Role.

Print Pre-view

Allows users to preview and print a list of roles. Any Role.

Table 3.4: The Roles Entity Attributes and Activities.

• Permissions - the EMS system, based on the set of domain entities, actions and commands overthose domain entities, defines a set of permissible target objects within the EMS system. End-userscannot define these permissions. They can only define what permission is given to the custom role.The permissible target objects include:

– Actions - create, modify, delete.

– Associations - links between the different election domain objects.

– Execute - set of custom commands within the system.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 28

• Users - action for defining users of the system. Users of all EMS application domains are managedfrom within the EMS EED User Management system. This action is characterized by the followingattributes:

– ID

– User Name

– Password

– Role

– Status

– First Name

– Last Name

– Position

– Description

– Contact Address

– Contact Phone 1

– Contact Phone 2

– Contact Email

The following actions are defined for User entities: Lookup, Filter, Create New, Edit, Sort and PrintPreview (see Table 3.5 for details).

Note: User records cannot be deleted so that auditing trail records can be preserved.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 29

UsersAttributesName Description Visibility/ConfigurabilityID Unique user ID. Not directly configurable

by the user.User Name Unique user name Directly configurable by

the user for non-system(custom) users only.

Password Unique user password with a minimum length of 6and a maximum length of 10 characters. The pass-word has an associated password strength profile.

Dynamically created bythe system.

Role Role of the user. Directly configurable bythe user for non-system(custom) users only.

Status The user account is either in initial, active or inactivestatus.


First Name Full first name of the user. Configurable by the user.Last Name Full last name of the user. Configurable by the user.Position Optional position of the user. Configurable by the userDescription Optional description of the user. For example, user

department and other info can be defined within thisfield.


Contact Ad-dress

Optional address record for the user in free form. Configurable by the user.

ContactPhone 1

Optional primary phone number for the user. Configurable by the user.

ContactPhone 2

Optional secondary phone number for the user. Configurable by the user.

ContactEmail

Optional email address for the user. Configurable by the user.

ActivityName Description Role RequiredLookup andFilter

Perform a lookup/filtering for a specific user. Any Role

Create New Create a new user object. Any Role.Edit Open for editing an existing user object. Any RoleSort Advanced sorting and ordering of user records based

on associated attributes.Administrative

Print Pre-view

Allows user to preview and print a list of users. Operator

Table 3.5: The Users Entity Attributes and Activities.

3.4.2.2 Database Management

This activity allows the user to restore the election project package. The election project packagerepresents a collection of election project database backup file and can contain a complete set of associatedproject files (reports, audio files, ballots, etc.) from the EMS NAS server. This operation can be usedto restore a complete election project on the NAS.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 30

3.4.2.3 Network Management

This activity is related to the management of the network settings for the EMS Application Server. TheEMS EED and EMS RTR client applications have to be configured to communicate with the designatedEMS Application Server.

Within the Network Management administrative activity, user can define the default EMS ApplicationServer address, applicable TCP communication port and name of the server instance. The configuredEMS APPS associated network settings are stored within the EMS EED configuration file.

3.4.2.4 System Settings

This activity updates the EMS database, permissions, device configurations, scanning configuration,reports, security files and upgrade template keywords.

The EMS Database model will be updated based on the latest EMS domain model. This feature is usedwhen there is existing election project database in the system, but the new release of the EMS platformis released.

3.4.2.5 Document Viewers

This activity allows the user to set the Acrobat Reader application path for previewing ballot manifes-tations.

3.4.3 Help

3.4.3.1 Help Documentation and About Box

All EMS client applications have an embedded Help Menu (User Guide). Each User’s Guide uses a varietyof methods to communicate with the reader, providing background information on problem domains,procedures for executing functions within the application, as well as instructive images and illustrations.In addition to its user documentation, every EMS application has information about application version,supported ballot types (e.g Universal Three Column Ballot Style, New York State General and PrimaryElections and FLorida General and Primary Elections) and localization settings (see 3.4.3.2.)

3.4.3.2 Localization Settings

The EMS platform incorporates localization differences of the user interface for the end-user clientapplications (EED and RTR). Localization settings allow users to have language and election terminology-specific translations of the GUI elements. For example, depending on the localization settings selected,the GUI label for polling subdivision can be presented as precinct, polling subdivision or ED (electiondistrict). The EMS client applications are delivered and installed with a pre-defined set of localizationsettings resource files:

• Default localization settings - English language

• State of Florida localization settings - English language

• State and City of New York localization settings - English language

The user can dynamically change localization settings from within the client application.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 31

3.4.4 Divisioning

Each election project contains different types of divisioning information: administrative, political, geo-graphical, etc. Within Democracy Suite R© EMS EED, a divisioning set of actions are defined to providethe means for defining and manipulating these election related entities. The following section does notinclude the navigation menu structure. Rather, it groups together a variety of activities that are relatedto divisioning.

3.4.4.1 Subdivision Types

This subsection details the actions that must be followed to define the hierarchical structure of theadministrative, geographical and electoral areas for the jurisdiction for the election. In essence, thisaction defines subdivision types and their hierarchy within the jurisdiction. Each divisioning entity ischaracterized by the following attributes:

• ID

• Name

• Abbreviation

• External ID

• In Ballot List

• Global Order

• Association

• Level

This activity includes the sub-activities “Create New”, “Edit” and “Delete” (see Table 3.6 for moredetails).

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 32

Subdivision TypesAttributesName Description Visibility/ConfigurabilityID Unique subdivision type ID. GUID (Globally Unique

ID).Not directly configurableby the user.

Name Unique name of the subdivision type. Configurable by the user.Abbreviation Abbreviated name of the subdivision type. For ex-

ample, this is a two character State identifier (USAonly).


External ID Used for data import and export from external sys-tems.

In BallotList

Used for presenting the list of subdivisions that areassociated with contest. Directly a related to key-words (Area List)


Global Order Used for setting the order of the divisions Configurable by the user.Associations Links toward one or more parent/child subdivision

type objects in the hierarchy.Configurable by the user.

Level Indicates the level in the hierarchy, 1 indicates that itis at the top of the hierarchy, every subsequent num-ber is one level down the hierarchy. Is not requiredto be set.


ActivityName Description Role RequiredCreate New Create a new subdivision type object. Administrative.Edit Open for editing an existing subdivision type object. AdministrativeDelete Delete one or more of the selected subdivision type

objects.Administrative

Table 3.6: The Political Divisioning (Subdivision Types) Entity Attributes and Activities.

3.4.4.2 Subdivisions

VVSG 2005 vol I§2.1.7.2

This subsection details how to define subdivisions for the jurisdiction divisioning structure defined pre-viously in the Subdivision Types activity. Each subdivision is characterized by the following attributes:

• ID

• Name

• Subdivision type

• Parent Subdivision

• Abbreviation

• External ID

• Global Order

• Description

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 33

• Polling Subdivision Associations

This activity includes the sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”, “Delete”, “Sort”,“Print Preview”, “Polling Subdivision Association/Disassociation”, “Create Batch”, “Move Up”, “CreateBatch”, “Create Tabulators”, “Move Down”. (see Table 3.7 for more details).

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 34

SubdivisionAttributesName Description Visibility/ConfigurabilityID Unique subdivision ID. GUID (Globally Unique ID). Not directly configurable

by the user.Name Name of the subdivision. The maximum length is 64

characters.Configurable by the user.

SubdivisionType

Type of the subdivision according to the structuredefined under the Political Divisioning activity.


Parent Sub-division

Parent subdivision for the selected subdivision. Configurable by the user.

Abbreviation Abbreviated name of the subdivision. For example,this is a two-character State identifier for the UnitedStates.


External ID Used for import and export data from external sys-tems.


Global Order Used for setting the order of the divisions. Configurable by the user.Description Free-text description of the subdivision object. The

maximum length is 256 characters.Configurable by the user.

Polling Sub-division As-sociations

Set of polling subdivisions (precincts or electoral dis-tricts) associated with the given subdivision.


ActivityName Description Role RequiredLookup andFiltering

Perform a lookup/filtering for a specific subdivision Any Role

Create New Create a new subdivision object. AdministrativeEdit Open to edit an existing subdivision object. AdministrativeDelete Delete one or more of the selected subdivision ob-

jects.Administrative

Reorder Reorder one or more subdivisions in desired order. Any RoleSort Advanced sorting of subdivision records based on as-

sociated attributes.Any Role.

Polling Sub-division As-sociation

Associate (connect) one or more Polling Subdivisionswith a given subdivision.

Operator

Polling Sub-division Dis-association

Disassociate (disconnect) one or more Polling Sub-divisions from the given subdivision.

Operator

Print Pre-view

Allow users to preview and print a list of subdivi-sions.

Operator

Batch Sub-divisionCreation

Allows user to create all subdivision instances for thesubdivision type.

Administrative

Batch Tab-ulator Cre-ation

Allows user to create tabulator instances for the sub-division type.

Administrative

Table 3.7: The Subdivisions Entity Attributes and Activities.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 35

3.4.4.3 Polling Subdivisions

Polling subdivisions are the smallest geographical and administrative entities. The equivalent term forVVSG 2005 vol I§2.1.7.2the US is “precinct”.9 Each polling subdivision is characterized by the following attributes:

• ID

• Name

• Number of Electors

• Subpolling District Flag

• Include in X of Y Report Checkbox

• External ID

• Key in ID

• Global Order

• Subdivision Associations

• Language Profile Associations

• Elector Counts

• Tabular Associations

• Ballot Associations

A polling subdivision becomes split when a portion of it falls into a different voting area than the restof the polling subdivision. For example, Precinct 1, School District 1, and Precinct 1 School, District 2would vote for the same contests except for school board contests.

The number of eligible electors is the total number of electors within the given polling subdivision,regardless of elector groups. On the other hand, elector counts is an attribute which defines the numberof electors associated with a given polling subdivision within an elector group. This attribute helpsproduce canvass reports.

Within each election project, there is one default language profile for paper and AVS ballots, as well asfor tabulator on-screen instructions. However, additional language profiles may need to be associatedwith a given polling subdivision in some cases. Desired subdivisions and tabulators also need to beconnected to the polling subdivision. Ballots are automatically associated with the appropriate pollingsubdivision after generating ballot content.

This activity includes the following sub-activities: “Lookup/Filter”, “Create New”, “Edit”, “Delete”,“Reorder”, “Sort”, “Print Preview”, “Subdivision Association/Disassociation”, “Language Profile Asso-ciation/Disassociation”, “Tabulator Association/Disassociation” (see Table 3.8 for more details).

9Note that polling subdivision is commonplace terminology in the elections industry and does not appear in the appli-cation. The term that appears is precinct.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 36

Polling SubdivisionAttributesName Description Visibility/ConfigurabilityID Unique polling subdivision ID. GUID (Globally

Unique ID).Not directly configurableby the user.

Name/number Unique name of the polling subdivision. Polling sub-division can consist of three subfields - prefix, nameand suffix or one name field depending on selectedlocalization settings.


SplitPrecincts

Optional list of polling subdivision identifiers (if thepolling subdivision is split).


Numberof EligibleElectors

Number of eligible electors within the polling subdi-vision.


SubpollingDistrict

Polling Subdivision identifier (if its main polling sub-division is split).

Indirectly configurable bythe user.

Numberof EligibleVoters

Number of eligible electors within the polling subdi-vision.




Key in ID Used for import and export data from external sys-tems.


SubdivisionAssociations

Set of subdivisions connected to the given pollingsubdivision.


Global Order Used for setting the order of the divisions.. Configurable by the user.LanguageProfile Asso-ciations

Set of language profiles connected to the givenpolling subdivision in addition to the default Englishlanguage profile.


ElectorCounts

A list of ballot group and the corresponding numberof eligible voters within the elector group for a givenpolling subdivision.


TabulatorAssociations

Set of tabulators connected to the given polling sub-division.


Ballot Asso-ciations

Set of ballots connected to the given polling subdi-vision.



Perform a lookup/filtering for a specific subdivision Any Role

Create New Create a new polling subdivision object. AdministrativeEdit Open to edit an existing polling subdivision object. AdministrativeDelete Delete one or more of the selected polling subdivision


Reorder Reorder one or more polling subdivisions in desiredorder.

Operator

Sort Advanced sorting and ordering of polling subdivisionrecords based on associated attributes.

Operator

SubdivisionAssociation

Associate a set of subdivisions with a given pollingsubdivision.

Operator

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 37

SubdivisionDisassocia-tion

Disassociate a set of subdivisions with a given pollingsubdivision.

Operator

LanguageProfile Asso-ciation

Associate a set of language profiles with a givenpolling subdivision.

Administrative

LanguageProfile Dis-association

Disassociate a set of language profiles with a givenpolling subdivision.

Administrative

ElectorCountsAssociation

Associate a set of count of electors per group with agiven polling subdivision.

Operator

ElectorCounts Dis-association

Disassociate a set of count of electors per with a givenpolling subdivision.

Operator

TabulatorAssociation

Associate a set of tabulators with a given pollingsubdivision.

Operator

TabulatorDisassocia-tion

Disassociate a set of tabulators with a given pollingsubdivision.

Operator

Print Pre-view

Allow users to preview and print a list of pollingsubdivisions.

Operator

BatchPollingSubdivisionCreation

Allows user to create all polling subdivision in-stances.

Administrative


Allows user to create tabulator instances for one ormore polling subdivisions.

Administrative

Table 3.8: The Polling Subdivision Entity Attributes and Activities

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 38

3.4.4.4 Political Parties

Defined political parties are registered and active within the jurisdiction. The defined political party listis used to define elector groups, endorse candidates, create partisan contests in a primary election, aswell as create closed primary ballots. Each political party is characterized by the following attributes:

• ID

• Name

• Abbreviation

• Description

• For Independent Candidates check box

• External ID

• Global Order

• Political Party Logo

• Language Profile Associations

• Audio Profile Associations

• Choices Associations

• Settings (applicable only to NYS ballot styles)

This activity includes the sub-activities “Lookup”, “Filter”, “Create New”, “Edit”, “Delete”, “Reorder”,“Sort”, “Audio Profiles” and “Choices” Association/Disassociation, “Print Preview” and “Batch ElectorGroups Creation” (see Table 3.9 for more details).

Political PartiesAttributesName Description Visibility/ConfigurabilityID Unique party ID. GUID (Globally Unique ID). Not directly configurable

by the user.Name Unique name of the political party. Configurable by the user.Abbreviation Three character abbreviation name of the political

party. For example, DEM, REP, IND, etc.Configurable by the user.

Description Free-text description of the political party record.Maximum number of characters is 256.


ElectorGroup

Defines the association between a political party andan elector group.




PoliticalParty Logo

A graphical file representing a political party crest orlogo. For ballot production, these graphic files mustbe of high-resolution (300 dpi). The file format ofthe images must use RGB color space.


Global Order Used for setting the order of the divisions. Configurable by the user.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 39

LanguageProfile Asso-ciations

Set of language profiles connected to the given polit-ical party in addition to the default English languageprofile. Used for paper and electronic ballot presen-tation.


Audio Lan-guage ProfileAssociations

Set of audio language profiles connected to the givenpolitical party. Used for audio ballot presentation.


Choices As-sociations

Set of choices connected to the given political party. Configurable by the user.

IndependentAffiliationFlag

Flag used to mark one or more independent entitiesaffiliating candidates for a given election event.


Party LineIndex

applicable only to NYS ballot style) Defines a rowindex on the ballot for a given political party. Usedfor general elections only.


Party LetterIdentifier

(applicable only to NYS ballot style) Defines a letteridentifier for a given political party. Used for primaryelections only.


PartyHeaderText Color

(applicable only to NYS ballot style) Defines a textcolor on a ballot header for a given political party.Used for primary elections only.


PartyHeaderBackgroundcolor

(applicable only to NYS ballot style) Defines a back-ground color on a ballot header for a given politicalparty. Used for primary elections only.



Perform a lookup/filtering for a specific politicalparty.

Operator

Create New Create a new political party object. OperatorEdit Open for editing an existing political party object. OperatorDelete Delete one or more of the selected political party

objects.Operator

Reorder Reorder one or more political parties in desired order. Any RoleSort Advanced sorting of political party records based on

associated attributes.Operator

LanguageProfilesAssociation

Associate one or more language profiles for paper andelectronic ballot presentation. Allows users to trans-late political party content to multiple languages.

Languages Operator

LanguageProfile Dis-association

Disassociate one or more language profiles for paperand electronic ballot presentation.

Languages Operator

AudioLanguageProfilesAssociation

Associate one or more audio language profiles forAVS ballot presentation. Allows user to translatepolitical party content into multiple languages.

Languages Operator

AudioLanguageProfiles Dis-association

Disassociate one or more audio language profiles forAVS ballot presentation.

Languages Operator

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 40

Choices As-sociation

Associate a set of choices with a given political party. Operator

Choices Dis-association

Disassociate a set of choices with a given politicalparty.

Operator

Print Pre-view

Allow users to preview and print a list of politicalparties.

Operator

Batch Elec-tor GroupsCreation

Allows user to create partisan elector group instancesfor one or more political parties.

Administrative

Table 3.9: Political Parties Entity Attributes and Activities

3.4.4.5 Elector Groups

Elector groups are defined on a non-geographical basis. Electors can be grouped based on a variety offactors, including political party membership, language profile, etc. Within this activity, elector groupsare created based on the previously defined elector types. Each elector group is characterized by thefollowing attributes:

• ID

• Name

• Type

• Abbreviation

• Description

• Default check box

• Has Count check box

• Apply Crossover Rule check box

• External ID

• Global Order

• Column Index

• Contest Associations

• Elector Counts Association

• Language Profiles Association

• Elector Count Precinct Associations

• Audio Association

This activity includes the following sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”, “Delete”,“Sort”, “Print Preview”, and “Contest Association/Disassociation” (see Table 3.10 for more details).

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 41

Elector GroupsAttributesName Description Visibility/ConfigurabilityID Unique elector group ID. GUID (Globally Unique


Name Unique name of the elector group. Configurable by the user.Type Type of the elector group as defined in Elector Group

Types activity.Abbreviation Abbreviated name of the elector group. Configurable by the user

(using Elector GroupTypes activity).

Description Free-text description of the elector group record. Configurable by the userTop Flag Defines is the given elector group belongs to default

elector group typeNot configurable by theuser.

Global Order Used for setting the order of the divisions. Configurable by the user.Columnindex

Indicates which column the section for an associatedparty in an open primary should appear in.


ElectoralGroup Asso-ciations

Set of electoral counts connected to the given ballotgroup


ElectorCountsAssociations

Set of polling subdivisions connected to the givenelector group via elector count.


Omitted flag Defines if the elector group is omitted and cannot beselected for a con-test. This flag is used when defin-ing a contest in the Election Event set of activities.


Ignore Rota-tion flag

Defines if rotations are ignored for contests con-nected to the elector group.




Contest As-sociations

Set of contests connected to the given elector group.Allows users to define for what contests a given elec-tor group is applicable to.

Configurable by the user


Perform a lookup/filtering for a specific electorgroup.

Any Role

Create New Create a new elector group object. AdministrativeEdit Open for editing an existing elector group object. AdministrativeSort Advanced sorting of elector group records based on

associated attributes.Any Role

Delete Delete one or more of the selected elector group ob-jects.

Administrative

Print Pre-view

Allow users to preview and print a list of electorgroups.

Operator

Contests As-sociation

Associate one or more contests to a given electorgroup.

Administrative

ContestsDisassocia-tion

Disassociate one or more contests to a given electorgroup.

Administrative

ElectorCountsAssociations

Associate one or more precinct to a given electorgroup.

Administrative

ElectorCounts Dis-association

Disassociate one or more precinct to a given electorgroup.

Administrative

Table 3.10: The Elector Groups Entity Attributes and Activities.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 42

3.4.4.6 Ballot group

Electors can be gathered in one or more groups, based on different criteria. An elector can be a memberof multiple elector groups, but a member of only one ballot group. Within this activity, elector groupsare created based on the previously defined elector types. The system automatically combines all definedelector groups.

Each ballot group is characterized by the following attributes:

• ID

• Name

• External ID

• Global Order

• Ignore Rotation check box

• Consolidate checkbox

• Electoral Group Associations

• Omitted Counting Groups association

• Background Color on Ballot

This activity includes the following sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”, “Delete”,“Sort”, “Print Preview”, “Recreate”. (see Table 3.11 for more details).

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 43

Ballot GroupAttributesName Description Visibility/ConfigurabilityID Unique elector group ID. GUID (Globally Unique


Group Name Unique name of the ballot group. Configurable by the user.External ID Used for import and export data from external sys-

tems.Configurable by the user.

Global Order Used for setting the order of the divisions. Configurable by the user.Consolidatecheckbox

Indicates that ballots produced for this Ballot Groupshould always be consolidated.


OmittedCountingGroupsAssociations

Indicates the list of counting groups for which thisballot group will be omitted when producing electionfiles for associated tabulators.


BackgroundColor onBallot

Indicates the background color used for ballots inthis ballot group.



Perform a lookup/filtering for a specific ballot group Any Role

Recreate Recreate new set of ballot group objects. AdministrativeEdit Open for editing an existing elector group combina-

tion object.Administrative

Recreate Create again (recreates) ballot group objects AdministrativeSort Advanced sorting of ballot group records based on

associated attributes.Any Role

Delete Delete one or more of the selected ballot group ob-jects.

Administrative

Print Pre-view

Allow users to preview and print a list of electorgroups.

Operator

ElectoralGroup Asso-ciations

Associate one or more electoral counts to a givenballot group.

Administrative

ElectoralGroup Dis-association

Disassociate one or more elector count to a givenelector group.

Administrative

OmittedCountingGroupsAssociation

Associate one or more counting groups to a givenballot group.

Administrative

OmittedCountingGroups Dis-association

Associate one or more counting groups to a givenballot group.

Administrative

Table 3.11: The Ballot Group Entity Attributes and Activities.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 44

3.4.4.7 Offices

VVSG 2005 vol I§2.1.7.2

Office is an administrative position (i.e. “City Mayor”). In our domain, an office is a template from whicheach particular contest is created. It contains common attributes and business logic for the belongingcontests (i.e. if there is a region with five cities, there will be five contests for mayor, sharing the samedefinition).

Each office is characterized by the following attributes:

• ID

• Name

• Office Type

• Description

• Subdivision Type

• Number of Write-ins

• Vote For

• Term Length

• Ballot Markers per Position

• Paper Index

• Acclamation Type

• Major Office Flag

• Cannot be duplicated

• Straight party override by rank

• External ID

• Global Order

• Settings (applicable only to certain ballot styles)

• Ranked Choice Voting (applicable only to certain ballot styles)

• Rotation (applicable only to certain ballot styles)

The creation of offices includes the following sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”,“Delete”, “Reorder”, “Sort”, “Elector Group Types Association/Disassociation”, “Print Preview” and“Batch Contest Creation” (see Table 3.12 for more details).

OfficesAttributesName Description Visibility/ConfigurabilityID Unique office ID. GUID (Globally Unique ID). Not directly configurable

by the user.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 45

Name Unique name of the office. Configurable by the user.Office Type Type of office. For example, Candidacy, Nomination,

Measure, etc.Configurable by the user.

Description Free-text description of the office record. Configurable by the user.SubdivisionType

Type of subdivision associated with the given office. Configurable by the user.

Number ofWrite-ins

Number of write-ins for a given office. Configurable by the user.

Vote For Number of positions to be elected for a given office. Configurable by the user.Term Length Defines the number of years a candidate(s) will hold

the office position.Configurable by the user.

Ballot Mark-ers per Posi-tion

Number of ballot markers defines width of the con-test (NYS ballot style) or height needed for choicename (portrait ballot styles)


AcclamationType

Three options are available: None (acclaimed con-tests or contests without choices for a given officewill be presented on a ballot); Remove Empty (con-tests without any candidates will not be presented ona ballot).Remove Acclaimed (acclaimed contests andcontests without candidates will not be presented ona ballot)


Major Office Results of error conditions during scanning can beconfigured differently for major offices.


Cannot beduplicated

Indicates that results for this office cannot be dupli-cated when using the conditional vote resolution.


Straightparty over-ride byrank

Indicates that straight party override behaviorshould use ranks.


Paper Index Defines where the given office will be positioned onmulti-page ballots.




Global Order Used for setting the order of the divisions. Configurable by the user.Column Po-sition

Defines office column position on a ballot. Configurable by the user.

RotationType

Detailed information for the selected rotation type(if any).


Rotation De-tails

Type of rotation for a given office. Configurable by the user.

Write-inFlag

Write-in option allowed or not for a given office. Configurable by the user.

Number ofPositions

Number of positions to be elected for a given office. Configurable by the user.

Column Po-sition

Defines office column position on a ballot. Configurable by the user.

ColumnSpan

Office can be spanned in a multiple columns on aballot depending on the ballot style.


Paper Index Defines where the given office will be positioned onmulti-page ballots.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 46


Perform a lookup/filtering for a specific office. Operator

Create New Create a new office object. Any RoleEdit Open to edit an existing office object. OperatorDelete Delete one or more of the selected office objects. OperatorReorder Reorder one or more offices in desired order. The

order of offices reflects on contest order on a ballot.Operator

Sort Advanced sorting and ordering of subdivision recordsbased on associated attributes.

Operator

ElectorGroup TypesAssociation

Associate one or more elector group types to a givenoffice.

Operator

ElectorGroupTypes Disas-sociation

Disassociate one or more elector group types to agiven office.

Operator

Print Pre-view

Allows users to preview and print a list of offices. Operator

Batch Con-test Creation

Allows users to create all contest instances for one ormore offices.

Administrative

Table 3.12: The Offices Entity Attributes and Activities

3.4.4.8 District Rotations

District Rotations- activity for defining the rotation relationship where the district associated with aVVSG 2005 vol I§2.1.7.2contest has its rotation calculated based on a rotation area. Each rotation area is assigned a rotation

index which starts with 0. When district rotation is applied the actual rotation value is calculated basedon the number of candidates and the rotation index of the rotation area.

Each office is characterized by the following attributes:

• ID

• Contest Area ID

• Rotation Area ID

• Rotation Index

The creation of offices includes the following sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”,“Delete”, “Sort”, “Print Preview”, “Set Item Count” and “Import”. (see Table 3.13 for more details).

District RotationsAttributesName Description Visibility/Configurability

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 47

ID Unique office ID. GUID (Globally Unique ID). Not directly configurableby the user.

Contest AreaID

External ID of Contest District Configurable by the user.

RotationArea ID

External ID of Rotation District Configurable by the user.

Rotation In-dex

Index used to calculate rotation value (starts at 0) Configurable by the user.

ActivityName Description Role RequiredName Description Role RequiredLookup andFiltering


Set ItemCount

Sets the number of items (rows) to be presented inthe screen

Any Role

Create New Create a new District Rotation object. Any RoleEdit Open to edit an existing District Rotation object. OperatorDelete Delete one or more of the selected District Rotation

objects.Operator

Sort Advanced sorting and ordering of District Rotationrecords based on associated attributes.

Operator

Print Pre-view

Allows users to preview and print a list of DistrictRotations.

Operator

Import Allows for importing of District Rotation records. OperatorTable 3.13: The District Rotations Entity Attributes and Activi-ties.

3.4.4.9 Line

This activity allows users to define the line on which candidates of a particular party will appear.

Each line is characterized by the following attributes:

• ID

• Name

• Number

• Letter

• General

• Override

• Political Parties

• Choices

The creation of line includes the following sub-activities: “Save”, “Save and Close”, “Add”, “Remove”.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 48

LineAttributesName Description Visibility/ConfigurabilityID Unique line ID. GUID (Globally Unique ID). Not directly configurable

by the user.Name Unique name of the line. Configurable by the user.Number Specify line number (required). Configurable by the user.Letter Candidate reference (for example: A, B, C, D) Configurable by the user.Override RTF should be defined and attached to desired ballot

cards.Configurable by the user.

PloliticalPartiesAssociation

Associate political party with a line Configurable by the user.



Set ItemCount

Set the number of items (rows) to be presented inthe screen

Any Role

Create New Create a new District Rotation object. Any RoleEdit Open to edit an existing District Rotation object. OperatorDelete Delete one or more of the selected District Rotation

objects.Operator

Sort Advanced sorting and ordering of District Rotationrecords based on associated attributes.

Operator

Print Pre-view

Allows users to preview and print a list of DistrictRotations.

Operator

Import Allows for importing of District Rotation records. OperatorTable 3.14: The Line Entity Attributes and Activities.

3.4.5 Election Event

3.4.5.1 Election Event Properties

This activity allows users to define the top-level attributes of the election event defined within the activeelection project. Most election event attributes are defined when a new election project is created (seeSection 3.4.1). However, this activity is used to preview already defined attributes and change them ifneeded. Furthermore, additional election event attributes can be defined within this activity.

Each election event is characterized by the following attributes:

• ID

• Name

• Date

• Election Event Type

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 49

• Description

• Election Project Status

• Signature

• Jurisdiction Name

• Jurisdiction Type

• Election Event ID

• External ID

• Ballot Settings

• Audio Settings

• Audio Language Profile Associations

Currently available ballot styles are:

• Florida General and Primary Elections

• New York State General and Primary Elections

• New Jersey Ballot Style

• Universal Multi Column Ballot Style

This activity only has editing capabilities. See Table 3.15 for more details.

AttributesName Description Visibility/ConfigurabilityID Unique election event ID. GUID (Globally Unique


Name Unique name of the election event. Configurable by the user.ElectionEvent Date

Date of the election event. Configurable by the user.

Type Type of the election event. Configurable by the user.Description Free-text description of the election event record. Configurable by the user.ElectionProject

State of the election project (as defined in Section3.1)


Signature A randomly generated value, which uniquely identi-fies the current EMS project.

Automatically set onproject creation.

JurisdictionName

Name of the jurisdiction organizing the electionevent.


JurisdictionType

Type of the jurisdiction organizing the election event. Configurable by the user.

ElectionEvent ID

Election event ID defined by user. Configurable by the user.



Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 50

Ballot Set-tings

Setting of ballot style. Configurable by the user.

Audio Set-tings

Type of AVS ballot support: none, full audio (used incombination with the ImageCast R© Evolution device)or compressed AVS ballot.



Set of audio language profiles connected to the givenelection event. Used for audio ballot presentation.


ActivityName Description Role RequiredEdit Open for editing an existing election contest object. AdministrativeExportDigitalCertificate

Export digital certificate (X.509) for the electionevent.

Operator


Associate one or more audio language profiles forelection event content presentation. Allows userto translate election event content in multiple lan-guages.

Administrative


Disassociate one or more audio language profiles forelection event content presentation. Allows userto translate election event content in multiple lan-guages.

Administrative


Associate one or more language profiles for electioncontent audio presentation. Allows user to enterand translate election event content in multiple lan-guages.

Languages Operator

LanguageProfiles Dis-association

Disassociate one or more language profiles for elec-tion event content presentation.

Languages Operator

Table 3.15: The Election Event Entity Attributes and Activities.

3.4.5.2 Project Parameters

This activity allows users to define default project parameters that are related to ballot generation,tabulator options, audio, security and rotation settings.

Each project settings-project parameters are characterized by the following attributes:

• Consolidation Type

• Ballot Content Creator

• Create Splits Manually

• Tabulation Options: Tabulator User Password Type, Default Tabulator User Password, UnifyTabulator Security Keys and Set Tabulator Number Automatically

• Straight Party Rule

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 51

• Card Partition Size

• Overvote Type

• Use Raw results

• Write-in Handling Method

• Create WinEDS Mapping Files

• Apply Write-in Precedence Rule

• Audio Configuration Settings and Tabulator Support

• Security Settings

• Audio Settings

• Audio Language Profile Associations

• Rotation

• RTR

AttributesName Description Visibility/ConfigurabilityConsolidationType

Choice of “None”, “Medium” or “Maximum”.10. Configurable by the user.

TabulationOptions

Enable options such as: “Tabulator User PasswordType” and “Default Tabulator User Password”. Ifthe “Default” option is selected, all tabulators willhave default administrative password that has beenentered as the “Default Tabulator User Password”.If the “Random” option is selected, the system willgenerate random a password for each tabulator.


StraightParty Rule

Enable “Exclusive” and “Inclusive” options for astraight party office.


Card Parti-tion Size11

Sets partition size of the memory cards that is neededfor storing the election files. Available options are:256 or 512


OvervoteType

Sets one of two available options:‘ ‘Single” and“Number of Position” overvote types. When select-ing the “Single”option, the overvotes are counted asthe number of times a contest was overvoted. Whenselecting the “Number of Position”, the overvotes arecounted as the number of times a contest was over-voted multiplied with the number of positions (VoteFor) for that contest.


Use Row Re-sults

Information about each scanned ballot within theelection files. The option is selected by default. Ifit is not selected, the system will present only the“Total Results” in enough detail for election night,but not for auditing.


10Please refer to Democracy Suite R© EMS Election Event Designer User Guide11If the election has three or more languages, select the 512 MB size partition rather than the 256MB size partition.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 52

IncludeSplits inProgressReporting

Influences the way the number of polling subdivisions(X/Y) are calculated. The system will calculate thevotes per split polling subdivisions. The numbers arepresented in “Contest Overview Data” reports in theEMS RTR.


CreateWinEDSMappingFiles

Files that allow the WinEDs application to loadresults produced by the ImageCast R© Precinct andImageCast R© Central. The system creates encryptedmapping files (comma separated values files) storedon the EMS NAS.


Ballot Con-tent Creator

Indicates the source of an election definition and af-fects certain processing calculations which are notneeded for the more complete election import.


Audio Con-figurationSettings andTabulatorSupport

View predefined audio synthesis voices path; gener-ate audio ballots; set pause between words in audio,create audio for Write-ins and select if ballot imagesfiles are always created. In addition, select the de-vice(s) to be used (ICE, BMD, BMD Lite, CF 200).


Security Set-tings

Sets type of the crypto alghorithm (Mode 1, 2 or 3)12 Configurable by the user.

RTR Sets Results Tally and Reporting properties. Configurable by the user.Table 3.16: The Project Settings Entity Attributes and Activities.

3.4.5.3 Ballot Style

This activity allows the user to define default ballot parameters. Depending on the ballot style selected,a different set of ballot parameters is provided.

The following attributes are available in this activity:

• Default Candidate Font Size (in points)

• Default Contest Font Size (in points)

• Default Political Party Font Size (in points)

• Default Font Family (type)

• Minimum Ballot Length in inches (allowed values 11, 14, 17, 20 and 22)

• Use Black Polling Box Flag (polling box can be presented in black or red)

• Mark Resized Text

• Starting Ballot ID (integer)

• Voting Box Type (depending on the ballot style, available options are: square, arrow or oval)

• Multi-Process Factor (number of concurrent CPU processes used for ballot production)

12please refer to TDP 2.06 - Democracy Suite R© System Security Specification

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 53

• Color Profile

• State-Specific Settings:

– FL State Specific: Barcode on Ballot Header

– NY State Specific: Voting Instructions Position (bottom or left)

– NY State Specific: Voting Instructions Width (in number of ballot markers, applicable onlywhen voting instructions are on the left side of the ballot)

– NY State Specific: Party Header Column Width (in number of ballot markers)

– NY State Specific: Number of Political Party Lines (not including contest header and write-in rows on the ballot) - depends on the position of the voting instructions. When votinginstructions are located at the bottom of the ballot, the number of party lines can be 6, 8 or10. When voting instructions are located at the left side of the ballot, the number of partylines can be 8, 10 or 12.

– NY State Specific: White Background for Name Flag

– NY State Specific: DVS Style For Primaries Flag

– NY State Specific: Party Font Size within the Candidate Cell on the Ballot (in points)

– NY State Specific: Voting Box Position (left upper, left lower, right upper or right lowercorner of the candidate cell on the ballot)

– NY State Specific: Voting Box Position (left upper, left lower, right upper or right lowercorner of the candidate cell on the ballot)

The list of currently available ballot styles can be found in Section 3.4.5.1.

3.4.5.4 Prototypes

This activity allows the user to define contest and choice prototypes. A “Contest prototype” is a templatefor a contest. Unlike offices, which encapsulate business logic and relations to other entities (electoralgroups, administrative types etc), the contest prototype only relates to choice prototypes. Each contestmade from a prototype has the same number of choices (with same attributes) as its template.

The following case scenario illustrates the importance of this functionality. Assume that an electionevent has N proposition contests (referendum questions). Each of the N proposition questions can haveone of two answers - Yes and No. However, the same election event can require that these answers arepresented on the ballot and during the AVS voting sessions in English and Spanish. Thus, the answerYes becomes Yes/Si, while the negative answer becomes No/Non. Instead of creating N instances ofthese answers within the election for ballot representation purposes, proposition contest prototypes canbe defined with two choice prototypes - Yes/Si and No/Non. This functionality greatly improves systemusability and ease of use.

Each prototype is characterized by:

• Contest Prototype Name

• Description

• Contests List

• Choice Prototype List

• Choice Prototype Name

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 54

• Language Profile Association

• Audio Language Profile Association

This activity includes the following sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”, “Delete”,“Contest Prototypes Association/Disassociation”, “Choice Prototypes Association/Disassociation”, “Lan-guage Profile Association/Disassociation” and “Audio Language Profiles Association/Disassociation”.

PrototypesAttributesName Description Visibility/ConfigurabilityID Unique ballot profile ID. Not directly configurable

by the user.Contest Pro-totype Name

Unique name of the contest prototype. Configurable by the user.

Description Free-text description of the contest prototype record. Configurable by the userContest As-sociations

Associations between the contest prototype and con-tests.


Choices A set of choice prototypes associated with a givencontest.


Choice Pro-totype Name

Number of positions to be elected within the contest. Configurable by the user.


A collection of rich text representations of the choiceprototype name in different languages


Audio Lan-guage Pro-files

A set of audio language profiles for a given choiceprototype.



Perform a lookup/filtering for a specific contest pro-totype.

Any Role

Create New Create a new contest prototype object. OperatorEdit Open for editing an existing contest prototype ob-

ject.Operator

Delete Delete one or more of the selected contest prototypeobjects.

Operator


Associate one or more propositions with a given con-test.

Operator


Disassociate one or more propositions with a givencontest.

Operator

Choice Pro-totypes As-sociation

Associate one or more choice prototypes with a givencontest.

Operator

Choice Pro-totypes Dis-association

Disassociate one or more choice prototypes with agiven contest.

Operator


Associate one or more language profiles for paper andAVS ballot presentation. Allows user to translatechoice prototype content in multiple languages.

Languages Operator

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 55


Disassociate one or more language profiles for paperand AVS ballot presentation.

Languages Operator


Associate one or more audio language profiles forAVS ballot presentation. Allows user to translatecontest content in multiple languages.

Languages Operator



Languages Operator

Table 3.17: The Prototypes Entity Attributes and Activities.

3.4.5.5 Contests

This activity is used to define and associate contests for a given election event.VVSG 2005 vol I§2.2.1.2.d

Contests represent manifestations of defined office entities and are defined by a unique set of choiceswhich run for the same position. For example, an office may be defined as Congressional, while itscontests can be Congress Ward 1, Congress Ward 2, etc.

Each contest is characterized by the following attributes:

• ID

• Administrative Name

• Office

• Parent District

• District

• Disabled Flag

• External ID

• Global Order

• Rendering Type (for measure)

• Vote For

• Number of Ballot Markers per Position

• Number of Write-ins

• Choices

• Elector Group Association


• Textual Units Representation

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 56

• Audio Language Profiles Association

• Layout (applicable only to certain ballot styles)

• Straight Party Voting Contest Association (applicable only to certain ballot styles)

• Rotation (applicable only to certain ballot styles)

• Choices Groups

• Logo Overriding (applicable only on NYS ballot style)

• Contest Column Starting Number (applicable only on NYS Primary Election)

This activity includes the following sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”, “Delete”,“Sort”, “Choices Association/Disassociation”, “Elector Group Association/Disassociation”, “LanguageProfile Association/Disassociation”, “Audio Language Pro-files Association/Disassociation”, “ContestAssociation/Disassociation”, “Print Preview” and “Disable” (see Table 3.18 for more details).

ContestsAttributesName Description Visibility/ConfigurabilityID Unique contest ID. GUID (Globally Unique ID). Not directly configurable

by the user.Name Unique name of the contest. Configurable by the user.Text If the office for the contest falls into the category

of measure or referendum question, the text of themeasure is stored in this field.


Office Association between the contest and office. Configurable by the user.Subdivision Association between the contest and subdivision. Indirectly configurable by

the user.Disable Flag Used to flag disabled contests. Required for ballot

content, ballot or election files generation.Configurable by the user.

ReducedRendering(If Avail-able) Flag

Only the contest header and two choices next to thecontest header will be rendered on a ballot.


External ID Data import and export from external systems. Configurable by the user.Global Order Set the order of divisions. Configurable by the user.Vote For Number of positions to be elected within the contest. Configurable by the user.Numberof BallotMarkers perPosition

Define width of the contest (NYS ballot style)or height needed for choice name (portrait ballotstyles).


Number ofWrite-ins s

Number of write-ins to be defined within the contest. Configurable by the user.

Choices A set of choices associated with a given contest. Configurable by the user.LanguageProfilesAssociations

A collection of rich text representations of the contestname in different languages


TextualUnits Repre-sentation

Representation of the contest name in units of text. Configurable by the user.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 57

AudioLanguageProfilesAssociations

A set of audio language profiles for a given contest. Configurable by the user.

Column In-dex

Defines contest column position on a ballot. Configurable by the user.

ColumnSpan

Contest can be spanned in a multiple columns on aballot depending on the ballot style.



A set of contests associated with a given straightparty contest.


Disable Ro-tation Flag

If office rotation must be excluded for a given contest. Configurable by the user.

Start Rota-tion Index

Zero by default. Configurable by the user.

Logo Over-riding

Override party logo for a given contest. Configurable by the user.

ContestColumnStartingNumber

Defines contest column starting number. Configurable by the user.


Perform a lookup/filtering for a specific contest. Any Role

Create New Create a new contest object. AdministrativeEdit Open for editing an existing contest object. AdministrativeDelete Delete one or more of the selected contest objects. AdministrativeSort Advanced sorting and ordering of contest records

based on associated attributes.Operator

Choice Asso-ciation

Associate a set of choices with a given contest. Operator

Choice Dis-association

Disassociate a set of choices with a given contest. Operator


Associate one or more language profiles for paperand electronic ballot presentation. Allows user totranslate contest content in multiple languages.

Languages Operator


Disassociate one or more language profiles for paperand electron ballot presentation.

Administrative


Associate one or more audio language profiles forAVS ballot presentation. Allows user to translatecontest content into multiple languages.

Languages Operator



Administrative

Print Pre-view

Allows users to preview and print a list of contests. Languages Operator

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 58


Associate one or more contests with a given straightparty contest.

Operator


Disassociate one or more contests with a givenstraight party contest.

Operator

Print Pre-view

Allow users to preview and print a list of contests. Any Role

Disable Allows user to disable a contest. The contest will notbe included in a ballot content, ballots or electionfiles generation.

Any Role

Table 3.18: The Contest Entity Attributes and Activities.

3.4.5.6 Choices

VVSG 2005 vol I§2.1.7.2

This activity is used to define choices, such as candidates, referendum questions, options, etc. Eachchoice entity is characterized by the following attributes:

• ID

• Name

• Contest

• External ID

• Choice Group

• Global Order

• Type

• Disable Flag

• Incumbent Flag

• Has Prototype Flag


• Textual Units Representation

• Political Party Affiliation

• Audio Language Profiles Association

• Contact Personal Info Association

• Text Overrides

• Column Index (applicable for NYS General Elections only)

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 59

This activity includes the following sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”, “Delete”,“Reorder”, “Sort”, “Political Party Association/Disassociation”, “Language Profile Association/Disassociation”,“Audio Language Profiles Association/Disassociation,” “Choice Personal Info Association/Disassociation”,“Print Preview” and “Disable” (see Table 3.19 for more details).

ChoicesAttributesName Description Visibility/ConfigurabilityID Unique choice ID. GUID (Globally Unique ID). Not directly configurable

by the user.Name Unique name of the choice. Configurable by the user.Contest A contest with which the given choice is associated. Indirectly configurable by

the user.External ID Data import and export from external systems. Configurable by the user.Global Order Set the order of divisions. Configurable by the user.Type Choice between “Regular” and “No Candidate” op-

tions. “Regular” is the default option, while “NoCandidate” is used when there is no candidates orless then the Vote For number


Disable Flag Used to flag disabled choices. Required for ballotcontent, ballot or election files generation.


IncumbentFlag

Used to flag incumbent choices. Configurable by the user.

Has Proto-type Flag

Used to flag choices connected to a contest prototype. Indirectly configurable bythe user.

PoliticalParty Asso-ciation

One or more political parties associated with a givenchoice (if any).

Directly configurable bythe user.


A collection of rich text presentations of the choicename in different languages.


TextualUnits Repre-sentation

Collected units of text for the presentation of thechoice name (for example, the first unit may be thecandidate’s first name while the second unit may bethe candidate’s last name).



A collection of audio presentations of the choicename in different languages.


First Name First name of the choice. Configurable by the user.Last Name Last name of the choice. Configurable by the user.Address Address of the choice. Configurable by the user.ContactPhone

Phone of the choice. Configurable by the user.

ContactEmail

Email of the choice. Configurable by the user.

Date of Birth Date of birth of the choice. Configurable by the user.Gender Gender of the choice. Configurable by the user.Column In-dex

Defines choice column index. Configurable by the user.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 60


Perform a lookup/filtering for a specific contest. Operator

Create New Create a new contest object. AdministrativeEdit Open for editing an existing contest object. AdministrativeDelete Delete one or more of the selected contest objects. AdministrativeReorder Ordering of contest records within a contest. OperatorPoliticalParty Affili-ation

Associate a set of Political Parties with a givenchoice.

Administrative

PoliticalParty Disas-sociation

Disassociate a set of Political Parties with a givenchoice.

Operator


Associate one or more language profiles for paperand electronic ballot presentation. Allows users totranslate choice content into multiple languages.

Languages Operator


Disassociate one or more language profiles for paperand electronic ballot presentation

Languages Operator


Associate one or more audio language profiles forAVS ballot presentation. Allows users to translatechoice content into multiple languages.

Languages Operator



Languages Operator

Choice Per-sonal InfoAssociation

Associate a choice personal info with a given choice. Any Role

Choice Per-sonal InfoDisassocia-tions

Disassociate a choice personal info with a givenchoice.

Any Role

Print Pre-view

Allows users to preview and print a list of choices. Operator

Disable Allows user to disable a choice. The choice will notbe included in a ballot content, ballots or electionfiles generation.

Any Role

Table 3.19: The Choice Entity Attributes and Activities.

3.4.5.7 Ballot Types

VVSG 2005 vol I§2.1.7.2

Domain entity which represents an instance of a unique set of contests and rotation sets calculated for

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 61

the election event. This entity is sometimes referred in the industry as a ballot style, especially when norotations are involved in the election event.

Each ballot type entity is characterized by the following attributes:

• Name

• External ID

• Abbreviation

• Ballot group

• Ballot Contest Association

• Polling Subdivision Association

• Ballot Cards Association

This activity includes the following sub-activities: “Edit”, “Sort”, “Print Preview”, “Delete”, “Filter”,“Recreate Ballots”, “Advanced Sorting”, “Set Item Count”, “Print” (see Table 3.20 for more details).

Ballot TypesAttributesName Description Visibility/ConfigurabilityID Unique choice ID. GUID (Globally Unique ID). Not directly configurable

by the user.External ID Data import and export from external systems. Configurable by the user.Abbreviation Abbreviated name of the Ballot Type. For example,

a two-number ballot type identifier.Configurable by the user.

Ballot Con-test Associa-tion

A collection of associated contests. Not directly configurableby the user.

Ballot GroupAssociation

A collection of associated ballot groups. Not directly configurableby the user.

List ofPollingSubdivisions

A collection of associated Polling Subdivisions. Not directly configurableby the user.


A collection of associated Polling Subdivisions. Not directly configurableby the user.

Ballot Cards Single physical piece of paper containing a front andback image. Each ballot card contains a set of con-tests. A set of one or more ballot cards will makeup the entire ballot type which will be provided to aindividual voter.


ActivityName Description Role RequiredEdit Open for editing an existing ballot type object. AdministrativeSort Advanced sorting and ordering of ballot type records

based on the associated attributesAny Role

Lookup andFiltering

Perform a lookup/filtering for a specific contest. Operator

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 62

Print Pre-view

Allows users to preview and print a list of ballottypes.

Operator

Set ItemCount


Any Role

Delete Delete one or more of the selected ballot types ob-jects.

Administrative

RecreateBallots

Allows users to make changes to ballot related prop-erties (e.g. Ballot Index).

Any Role

Ballot Cards Associate Front and Back Ballot Headers to Associ-ated Ballot Cards. In addition, change Paper Indexwithin the Card Contest

Table 3.20: The Ballot Types Entity Attributes and Activities.

3.4.5.8 Activation codes

Domain entity which represents a unique combination of polling district (on the precinct portion level)and ballot group automatically created for the election event. This entity is used to store external codesused in voter registration system to refer to a specific polling district and ballot group in EMS. Thisinformation is later used on the voting location to activate a voter session using the code provided bythe voter registration system. Each activation code entity is characterized by the following attributes:

• Code

• Description

• Polling District association

• Ballot Group association

• Ballot Type association

This activity includes the following sub-activities: Edit, Sort, Print Preview, Export, Import (see Table3.21 for more details).

Language ProfilesAttributesName Description Visibility/ConfigurabilityCode A unique alpha-numerical value typically used by

an external Voter Registration system to refer toa unique combination of polling district and ballotgroup.


Description Free-text description of the activation code record. Configurable by the user.Polling Dis-trict Associ-ation

Indicates which polling district this activation codeis for.


Ballot groupassociation

Indicates which ballot group this activation code isfor.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 63

Ballot Typeassociations

Indicates which ballot types this activation code isfor.


ActivityName Description Role RequiredEdit Open for editing an existing activation code object AdministrativeSort Advanced sorting and ordering of activation code

records based on the associated attributesAdministrative

Print Pre-view

Allows users to preview and print a list of activationcodes.

Administrative

Set ItemCount


Any Role

Export Allows user to export activation codes to CSV for-mat.

Administrative

Import Allows user to import activation codes in CSV for-mat.

Administrative

Table 3.21: The Activation Codes Entity Attributes and Activities.

3.4.5.9 Language Profiles

This activity is used to define the set of language profiles to be used in the election event. The definedlanguage profiles are used in the definition of ballots, both paper and AVS. This activity is not used inthe translation functionality, but rather only to define the set of languages to be supported by the systemfor a given election event.

Each language profile is characterized by the following attributes:

• ID

• Name

• Purpose

• One of the following:

– Language Profile Association (for audio language profile)

– Audio Language Profile Association (for ballot content language profile)

• Audio voices (audio language profile)

• Precincts Association

The following actions are defined for user entities: “Lookup”, “Filter”, “Create New”, “Edit”, “Delete”,“Sort”, “Language Profile Association/Disassociation” or “Audio Language Profile Association/Disassociation”,“Polling Subdivision Association/Disassociation” and “Print Preview” (see Table 3.22 for more details).

Language ProfilesAttributesName Description Visibility/Configurability

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 64

ID Unique language profile ID. GUID (Globally UniqueID).


Name Unique language profile name. Configurable by the user.Purpose Purpose of the language profile - is this language

profile used for paper ballot style definition or forAVS ballots (BMD).



Set of ballot content language profiles associatedwith the given audio language profile.



Set of audio language profiles associated with thegiven ballot content language profile.


TemplateNumber

Unique template number for audio file synthesis formultilingual ballots. Only available if the purpose ofthe language profiles is audio.


Audio Voices Audio voices for audio file synthesis. Only availableif the purpose of the language profiles is audio.


Polling Sub-division As-sociations

Set of polling subdivisions (precincts or electoral dis-tricts) associated with the given language profile.Only available if the purpose of the language pro-files is ballot content.



Perform a lookup/filtering for a specific languageprofile.

Any Role

Create New Create a new language profile object. OperatorEdit Open for editing an existing language profile object. Languages OperatorDelete Delete one or more of the selected language profile

objects.Operator

Sort Advanced sorting and ordering of the language pro-file records based on the associated attributes.

Any Role

LanguageProfile Asso-ciation

Associate one or more language profiles with a givenlanguage profile.

Operator

LanguagePro-file Dis-association

Disassociate one or more language profiles from thegiven language profile.

Operator

Audio Lan-guage ProfileAssociation

Associate one or more audio language profiles witha given language profile.

Operator

Audio Lan-guage ProfileDisassocia-tion

Disassociate one or more audio language profilesfrom the given language profile.

Operator


Associate (connect) one or more Polling Subdivisionswith a given language profile.

Operator


Disassociate (disconnect) one or more Polling Sub-divisions from the given language profile.

Operator

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 65

Print Pre-view

Allows users to preview and print a list of languageprofiles.

Operator

Table 3.22: The Language Profiles Entity Attributes and Activities.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 66

3.4.5.10 Templates

Templates define the characteristics and appearance of paper ballots, including voting instructions, con-test representation and choice representation. Each Ballot Profile entity is characterized by the followingattributes:

• ID

• Name

• Purpose

• Language

• One of the following

– Collection of Contests

– Collection of Ballots

• Template

This activity includes the following sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”, “Delete”and “Contest Association/Disassociation” or “Ballot Association/Disassociation” (see Table 3.23 formore details).

TemplatesAttributesName Description Visibility/ConfigurabilityID Unique ballot profile ID. Not directly configurable

by the user.Name Unique name of the template profile. Configurable by the user.Purpose Purpose of the template: voting instructions, contest

header or choice.Configurable by the user.

Language One of the defined languages for a given electionproject.


Contest As-sociation

If the purpose of the template is contest header tem-plate, a collection of associated contests is assignedto that template. If the purpose of the template ischoice representation, a collection of associated con-tests is assigned to that template.



If the purpose of the template is voting instructions,a collection of associated ballots is assigned to thattemplate. If the purpose of the template is contestheader, a collection of associated contests is assignedto that template. If the purpose of the template ischoice representation, a collection of associated con-tests is assigned to that template.


Ballot Asso-ciation

If the purpose of the template is ballot header tem-plate, a collection of associated ballots is assigned tothat template.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 67

Template A rich text representation of the template includeskeywords. For contest and choice templates, key-words are based on textual units of contest or choicename representation. For voting instruction tem-plates, keywords are based on a variety of electionrelated entities - polling subdivisions, political par-ties, dates, election name, jurisdiction name, etc.



Lookup/filter for a specific template. Any Role

Create New Create a new ballot profile object. OperatorEdit Open to edit an existing ballot profile object. OperatorDelete Delete one or more of the selected ballot profile ob-

jects.Operator


Associate one or more contests with a given contestheader or choice template.

Operator

Contest Dis-association

Disassociate one or more contests from the given con-test header or choice template.

Operator

Ballot Asso-ciation

Associate one or more ballots with a given ballotheader or choice template.

Operator

Ballot Disas-sociation

Disassociate one or more ballots from the given ballotheader template.

Operator

Table 3.23: The Template Entity Attributes and Activities.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 68

3.4.5.11 Contest Headings

This subsection describes how to group contests under the same title. Each contest heading is charac-terized by the following attributes:

• Name

• Rule

• Set of Associated Languages

• General

• Contests

• Audio

This activity includes the following sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”, “Sort”,“Delete” (see Table 3.24 for more details).

ContestHeadingsAttributesName Description Visibility/ConfigurabilityName Unique name of the template profile. Configurable by the user.Rule Rule defines appearance of the contest headings Configurable by the user.LanguageProfile Asso-ciations

Set of ballot content language profiles associatedwith the given audio language profile.



A collection of associated Contests Configurable by the user.


Lookup/filter for a specific template. Any Role

Create New Create a new ballot profile object. OperatorEdit Open to edit an existing ballot profile object. OperatorDelete Delete one or more of the selected ballot profile ob-

jects.Operator

Sort Advanced sorting of polling subdivision recordsbased on associated attributes.

Any Role

Table 3.24: Contest Headings

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 69

3.4.5.12 Ballots

This subsection details the act of previewing ballots with the possibility of altering the ballot style andregenerating ballot manifestations. Each ballot instance is characterized by the following attributes:

• File Name

• Key In ID

• External ID

• Description

• Language Profile

• Header Front

• Header Back

• Set of Contests

• Set of Associated Polling Subdivisions

This activity includes the following sub-activities: “Lookup”, “Filter”, “Edit”, “Delete”, “Sort”, “PrintPreview”, “Assign Values” and “Create Selected Proofing Ballots”. When editing a ballot, style-relatedinformation can be changed, creating additional ballot manifestations. As a result, this activity includesadditional ballot header, contest style and choice style modifications (see Table 3.25 for more details).

BallotsAttributesName Description Visibility/ConfigurabilityFile Name Unique name of the ballot. Configurable by the user.Key In ID Unique ballot ID. GUID (Globally Unique ID). Not directly configurable

by the user.Description Free-text description of the ballot record. Configurable by the user.External ID Data import and export from external systems. Configurable by the user.LanguageProfile

Language profile associated with a given ballot in-stance.

Not directly editable bythe user.

Header Front Associated voting instructions header for the frontside of the ballot.


Header Back Associated voting instructions header for the backside of the ballot.


Set of Con-tests

Set of contests associated with the ballot instance. Indirectly configurable bythe user.

Set of PollingSubdivisions

Set of polling subdivisions associated with the ballotinstance.



Lookup/filter for a specific contest. Any Role

Edit Open to edit an existing ballot object. Any RoleDelete Delete one or more of the selected polling subdivision

objects.Any Role

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 70

Sort Advanced sorting of polling subdivision recordsbased on associated attributes.

Any Role

Print Pre-view

Allow users to preview and print a list of ballot man-ifestations.

Any Role

Assign Val-ues

Allow users to assign ballot numbers, descriptions orfile names for selected ballot manifestations or for allballot manifestations.

Any Role

CreateSelectedProofingBallots

Allow users to create one or more proofing ballots onthe EMS NAS.

Operator

Table 3.25: The Ballot Entity Attributes and Activities.

3.4.5.13 Ballot Production

The ballot production activity produces print-quality ballots for the given election event. After ballotVVSG 2005 vol I§2.2.1.1.c and§2.2.1.1.e

content and styling is defined, the ballot production process will create PDF and compressed PNGversions of all ballots within the system and upload them to the project space on the EMS NAS (NetworkAttached Storage) server. The PDF version of the ballots is used for ballot printing, while the PNGversion of the ballots is used for ImageCast R© AVS voting capabilities. The paper ballots created are inPDF/X-1a:2001 format, optimized for the ballot printing process, and digitally signed using the digitalcertificate (X.509) generated during the creation of the currently active election project.

Ballots produced by the system will contain unique codes and marks that distinguish each ballot for-mat/style.

In addition, EMS can create audio files, XML ballot definition files and PCL ballot printing definitionfiles for ImageCast R© BMD Lite functionality.

3.4.6 Tabulation

VVSG 2005 vol I§2.1.7

For descriptions on the ballot counters used to tabulate scanned ballots and lifecycle usage, please referto the following documents:

• 2.03 - Democracy Suite R© ImageCast R© Precinct Functionality Description

• 2.03 - Democracy Suite R© ImageCast R© Evolution Functionality Description

• 2.03 - Democracy Suite R© ImageCast R© Central Functionality Description

3.4.6.1 Voting Locations

The Voting Location activity is used to define the place where people cast their paper or AVS ballots.Counting center locations, such as a central e-Counting centers, can also be defined. Each Voting Locationentity is characterized by the following attributes:

• ID

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 71

• Name

• Number

• External ID

• Global Order

• Description

• Detailed Info

– Infrastructure (Number of phone lines, internet access type, Number of Toilets, Buildingaccessibility, Internet Access)

– Address (Address, Latitude, Longitude)

• Contact Info Association

• Tabulator Association

This activity includes the following sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”, “Delete”,“Batch Tabulator Creation”, “Sort”, “Contact Info Association/Disassociation”, “Tabulator Associa-tion/Disassociation”, “Print Preview” and “Assign Values” (see Table 3.26 for more details).

Voting LocationAttributesName Description Visibility/ConfigurabilityID Unique voting location ID. GUID (Globally Unique


Name Unique name of the voting location. Configurable by the user.Global Order Set the order of divisions. Configurable by the user.Number Unique number of the voting location. Configurable by the user.Description Free-text description of the voting location record. Configurable by the user.Detailed Info Detailed information about the given voting location

and its characteristics such as: Address (includinggeo-coding information), Contact Information, Ca-pabilities Information (access for people with disabil-ities, communication characteristics, etc.)


Contact InfoAssociation

Set of contacts associated with this voting location. Configurable by the user.


Set of tabulators associated with this voting location. Configurable by the user.


Lookup/filter information for a specific voting loca-tion.

Any Role

Create New Create a new voting location object. AdministrativeEdit Open to edit an existing voting location object. OperatorDelete Delete one or more of the selected voting location

objects.Operator


Allows user to create all tabulator instances for oneor more voting locations.

Any Role

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 72

Sort Advanced sorting and ordering of voting locationrecords based on associated attributes.

Any Role

Contact InfoAssociation

Associate one or more contacts with a given votinglocation.

Operator

Contact InfoDisassocia-tion

Disassociate one or more contacts from the given vot-ing location.

Operator


Associate one or more tabulators with a given votinglocation.

Operator


Disassociate one or more tabulators from the givenvoting location.

Operator

Assign Val-ues

Allow users to assign voting location names or num-bers for selected voting locations or for all votinglocations.

Any Role

Print Pre-view

Allow users to preview and print a list of voting lo-cations.

Any Role

Table 3.26: The Voting Location Entity Attributes and Activities.

3.4.6.2 Tabulators

This activity is used to define instances of ImageCast R© tabulation devices (both Precinct and Central).Each Tabulator device is characterized by the following attributes:

• ID

• Name

• Number

• Type

• Device Configuration

• Voting Location

• Counting Group

• Programming Group

• External ID

• External Type ID

• Global Order

• Polling Subdivision Association

• Users Association

• Ballots Association

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 73

• Precincts Association

• Security Association

• Networking Association

This activity includes the following sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”, “Delete”,“Generate Election Files”, “Sort”, “Program Memory Card”, “Initialize Backup Card”, “Polling Subdi-vision Association/Disassociation”, “Add User”, “Edit User”, “Delete User”, “Program Security Key”,“Prepare Exchange Card”, “Import Public Key”, “Print Preview”, “Batch Tabulator Creation”, “AssignValues” and “Create Labels” (see Table 3.27 for more details).

TabulatorsAttributesName Description Visibility/ConfigurabilityID Unique tabulator ID. GUID (Globally Unique ID). Not directly configurable

by the user.Name Unique name of the tabulator instance. Configurable by the user.Number Unique number of the tabulator instance. Configurable by the user.Type Type of the tabulator device - ImageCast R© Precinct,

ImageCast R© Evolution, ImageCast R© Central.Configurable by the user.

Device Con-figuration

A device specific settings object. Configurable by the user.

Voting Loca-tion

Associated voting location for a given tabulator. Configurable by the user.

CountingGroup

Identifies the level of election results collected usingthe given tabulator instance.


ProgrammingGroup

Associated programming group for a given tabulator. Configurable by the user.

External ID Data import and export from external systems. Configurable by the user.Global Order Used for setting the order of the divisions. Configurable by the user.Polling Sub-division As-sociation

A collection of associated (one or more) polling sub-divisions.


Username Unique username of the tabulator user instance. Configurable by the user.User Type Type of tabulator user. Configurable by the user.First Name First name of the tabulator user. Configurable by the user.Last Name Last name of the tabulator user. Configurable by the user.Ballots Asso-ciation

A collection of associated (one or more) ballots for agiven tabulator.



Lookup/filter for a specific set of tabulators. Any Role

Create New Create a new tabulator object. OperatorEdit Open to edit an existing tabulator object. OperatorDelete Delete one or more of the selected tabulator objects. OperatorGenerateElectionFiles

Generate election files for one or more tabulators. Operator

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 74

Sort Advanced sorting and ordering of tabulator recordsbased on associated attributes.

Operator

ProgramMemoryCard

Initialize and copy election files on CF card for agiven tabulator.

Operator

InitializeBackupCard

Initialize CF card for a given tabulator. Any Role


Associate one or more polling subdivisions with agiven tabulator.

Operator


Disassociate one or more polling subdivision from thegiven tabulator.

Operator

Add User Create a new tabulator user for a given tabulator. OperatorEdit User Open for editing a user object for a given tabulator. OperatorDelete User Delete one or more users from a given tabulator. OperatorProgram Se-curity Key

Program security key for a given tabulator user. Operator

Prepare Ex-change Card

Copy EMS public key, keyGen application and tabu-lator ID for a given tabulator (applicable for securitymode Mode 2 only).

Any Role

Import Pub-lic Key

Import tabulator public key (applicable for securitymode Mode 2 only).

Any Role

Print Pre-view

Allow users to preview and print a list of tabulators. Any Role


Allows user to create all tabulator instances. Operator

Assign Val-ues

Allow users to assign tabulator names or numbersfor selected tabulators or for all tabulators.

Any Role

Table 3.27: The Tabulator Entity Attributes and Activities.

3.4.6.3 Counting Groups

This activity groups tabulator instances, facilitating reporting in EMS RTR. (see section 3.5.4 for moredetails about EMS RTR reports).

Each Counting Group is characterized by the following attributes:

• ID

• Name

• External Id

• Global Order

• Include in X of Y report

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 75


This activity includes the following sub-activities: “Lookup”, “Filter”, “Create New”, “Edit”, “Delete”,“Sort”, “Tabulator Association/Disassociation” and “Print Preview” (see Table 3.28 for more details).

Counting GroupAttributesName Description Visibility/ConfigurabilityID Unique configuration profile ID. GUID (Globally


Name Unique name of the Counting Group. Configurable by the user.External ID Data import and export from external systems. Configurable by the user.TabulatorAssociation

Associate one or more tabulators. Configurable by the user.

ActivityName Description Role RequiredLookup/Filter Perform a lookup/filtering for a specific counting

group.Any Role

Create New Create a new counting group object. Predefinedvalue is “election day”

Administrative

Edit Open an existing counting group object. Technical AdvisorDelete Delete one or more of the selected counting group


Sort Advanced sorting and ordering of counting grouprecords based on associated attributes.

Any Role


Associate one or more tabulators. Administrative


Disassociate one or more tabulators. Administrative

Print Pre-view

Allow users to preview and print a list of countinggroup.

Any Role

Table 3.28: The Counting Groups Entity Attributes and Activities.

3.4.6.4 Programming Groups

This activity groups tabulators in order to split work on multiple EDES (Election Data Exchange Station)applications.

Each Programming Group is characterized by the following attributes:

• ID

• Name

• External ID

• Global Order

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 76



Programming GroupsAttributesName Description Visibility/ConfigurabilityID Unique configuration profile ID. GUID (Globally


Name Unique name of the Programming Group. Configurable by the user.External ID Data export and import from external systems. Configurable by the user.Global Order Used for setting the order of the divisions. Configurable by the user.TabulatorAssociation

Associates one or more tabulators. Configurable by the user.

ActivityName Description Role RequiredLookup/Filter Perform a lookup/filtering for a specific Program-

ming group.Any Role

Create New Create a new Programming group object. AdministrativeEdit Open an existing counting group object. Technical AdvisorDelete Delete one or more of the selected programming

group objects.Administrative

Sort Advanced sorting and ordering of programminggroup records based on associated attributes.

Any Role


Associate one or more tabulators. Administrative


Disassociate one or more tabulators. Administrative

Print Pre-view

Allow users to preview and print a list of program-ming group.

Any Role

Table 3.29: The Programming Groups Entity Attributes and Ac-tivities.

3.4.6.5 Networking

Networking is used to configure modem settings and parameters, such as ISP and File transfer server.

Networking characterized by the following attributes:

• ID

• Name

• Global Order

• Communication Protocol Type

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 77

• Retry Count

• Retry Interval

• Primary ISP Phone

• Backup ISP Phone

• Primary ISP Username

• Primary ISP Password

• Access Point Name

• APN Server

• APN Username

• APN Password

• Server Name

• IP Address

• Port Number

• Server Username

• Server Password

• Server Directory Name

• Tabulators Association

This activity includes the following sub-activities: “Lookup”, “Filter”, “Create New”.

3.4.6.6 Configurations

The configuration activity depends on the created target ImageCast R© device:

• Device Configuration File (DCF) profile for the ImageCast R© Precinct and ImageCast R© Central.

• Device Machine Behavioural Settings (MBS) profiles for the ImageCast R© Evolution.

These files define device level operational characteristics. Each ImageCast R© tabulator requires a singleconfiguration file to operate. The DCF file is in optimized binary format, while MBS file is in XMLformat. Administrative users define the DCF/MBS configuration using the GUI interface. The definedparameters are stored within the EMS Database. Later on, these files are uploaded to the EMS NASserver and to the Compact Flash memory pack. Security configuration settings are stored on the secureiButton key.

Each Device Configuration Profile is characterized by the following attributes:

• ID

• Name

• Etalon

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 78

• Settings

• Device Configuration Data



Configuration ProfilesAttributesName Description Visibility/ConfigurabilityID Unique configuration profile ID. GUID (Globally


Name Unique name of the configuration instance. Configurable by the user.TabulatorType

Type of configuration profile - ImageCast R© Precinct,ImageCast R© Evolution, ImageCast R© Central .


Settings Etalon of the device configuration for a given tabu-lator type.


Device Con-figurationData

Numerous ImageCast R© device settings: Administra-tive options, Security options, Printing options, Userinterface (LCD) options, AVS options



Associated tabulators for a given device configura-tion.


ActivityName Description Role RequiredLookup/Filter Perform a lookup/filtering for a specific set of device

configuration.Any Role

Create New Create a new device configuration object. AdministrativeEdit Open for editing an existing device configuration ob-

ject.Technical Advisor

Delete Delete one or more of the selected device configura-tion objects.

Administrative

Sort Advanced sorting and ordering of device configura-tion records based on associated attributes.

Any Role


Associate one or more tabulators with a given deviceconfiguration.

Administrative


Disassociate one or more tabulators from the givendevice configuration.

Administrative

Print Pre-view

Allow users to preview and print a list of device con-figurations.

Any Role

Table 3.30: The Configuration Profiles Entity Attributes and Ac-tivities.

3.4.6.7 Programming

VVSG vol I 2005§2.2.2

VVSG vol I 2005§2.2.3

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 79

This subsection details the actions that must be followed in order to prepare and program the set ofconfiguration items needed for the ImageCast R© tabulators to operate as expected.

For the ICP platform this set includes:

• Device Configuration Files (DCF) - in binary file format

• Voting Information Files (VIF) - in binary file format

• Static and dynamic audio files (ImageCast R© BMD, DRE or BMDLite)

• AVS ballot images in PNG file format (ImageCast R© BMD)

• XML ballot definition files (ImageCast R© BMD, DRE or BMD Lite)

• PCL ballot print definition files (ImageCast R© BMD Lite)

• iButton Security Keys

For the ICE platform this set includes:

• Machine Behavioral Settings file (MBS) - in XML file format

• Election Database - in SQLite database file format

• Dynamic audio files

• AVS ballot images in PNG file format

• Resource and configuration files

• iButton Security Keys

Table 3.31 shows the characteristics of these configuration items.

Tabulator Configuration ItemsName Description FormatDCF The Device Configuration File defines the ICP device

level operational characteristics.Binary files

MBS The Machine Behavioural Settings File defines be-havioural settings for a given Instance of ICE tabu-lator.

XML files

VIF Voting Information File is an election definition filefor ICP. It defines voting (contest, choice, ballot) pro-cessing characteristics.

Binary files

Election DB Election database (election definition for ICE) SQLiteDynamicAudio Files

Dynamic audio files (RIFX (WAV) for ICP or OGG(SPX) format for ICE devices) are optimized audiorecordings for the election event, political parties,contest and choice entities.

Audio RIFX (WAV) filesfor ICP or audio OGG(SPX) files for ICE de-vices.

Ballot Im-ages

Ballot images (PNG) are used to present electronicballots on the ImageCast R© BMD or ImageCast R©

Evolution LCD screen during an AVS voting session.

PNG image files

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 80

XML BallotDefinition

Ballot image definitions (XML) are used to defineballot layout for electronic ballot presentation on theLCD screen as part of the AVS voting using theImageCast R© BMD, BMD Lite or ICP DRE device.

XML files

PCL BallotPrinting Def-inition

Ballot printing definition (PCL) is used to printpaper ballots after AVS voting session using theImageCast R© BMD Lite integrated ballot printer.

PCL files

iButton Se-curity Keys

Set of security credentials for device administrativefunctions.

Binary information

Table 3.31: The Tabulator Configuration Items.

In the course of this action, all needed configuration items are created based on defined election datafrom the EMS Database, and stored on the NAS storage system. For each instance of the tabulator, apredefined configuration container is created on the NAS. In the next step, items from the configurationcontainer are uploaded to the designated Compact Flash memory packs and iButton security keys.

3.4.7 Reporting

VVSG 2005 vol II§2.2 and §2.4.3

3.4.7.1 Election Project

A top-level Election Project report of the configured system can be generated and previewed. AudioImport reports are created during import of dynamic audio files.

This report group lists the following system attributes:

• Election Status

• Description of the election status

• Election Project Name

• Description of the election event

• Jurisdiction Name

• Jurisdiction Type

• Election Event Date

• Election Event Type

• Ballot Style

• Security Settings

• Audio Ballot Type

• Number of subdivisions

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 81

• Number of polling subdivisions

• Number of political parties

• Number of offices

• Number of contests

• Number of choices

• Number of ballots

• Number of tabulators

• Number of tabulator users

The Election project report group also contains the Audio Import option.

• List of audio files imported

• List of audio files not imported

NOTE: The Audio Import Report cannot be created on demand. It is created automatically after importingthe Audio Library file.

The reports are generated in simple text format and can be exported into PDF, HTML or MS Excelformat. The created reports are stored on the NAS and signed using the election project key. Reportsare created with the assigned date, and multiple reports can be generated.

The Election project report group also contains the Audio Studio File Names report. In order to importaudio files, they have to be named according to a specific convention (Entity Name, Entity Text andEntity Audio file name).

3.4.7.2 Divisioning

The activity is used to generate and preview a report containing Divisioning-related information. Thisreport group lists the following system attributes:

• List of subdivision types hierarchy

• List of defined subdivisions

• List of defined polling subdivisions (i.e. precincts)

• List of defined elector groups

• List of political parties

• List of defined offices

• List of district rotation definition

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 82

The Subdivision Types report shows data which was entered during the definition of subdivision types(“Subdivision Type Name” and “Number of Subdivision” instances).

The Elector Group Types report shows data which was entered during the definition of the Elector GroupTypes (“Elector Group Type Name”). In addition, it shows whether the elector group type is set topartisan or not.

The Subdivisions report shows “Subdivision Name”, “Subdivision Type”, “Parent Subdivision Name”,“Subdivision Abbreviation”, “Description” and a list of assigned polling subdivisions.

The Polling subdivisions report shows the “Polling Subdivision Name”, “Number of Voters” in the pollingsubdivision, “Language Profile”, specifies whether the polling subdivision is split or not, and also providesthe names of assigned polling subdivision instances.

Elector Groups report shows the “Elector Group Name”, “Abbreviation”, “Description”, “Elector GroupType”, whether the force ballot creation option had been chosen, whether the elector group types ispartisan, and whether the description had been entered.

The Political Parties report shows the “Political Party Name”, “Abbreviation”, “Political Party Descrip-tion” and “Logo”.

The Office report shows the “Office Name”, “Office Type”, “Subdivision Type”, the number of positionsthe candidates are running for, “Description” and “Number of Write-Ins”. The Office report also specifieswhether the force ballot creation option had been chosen, how many “Ballot Markers per Position” havebeen entered, as well as the term length and number of “Paper Index”.

District Rotation Definition report includes “Contest Area External Id”, “District Name-Contest AreaName”, “Rotation Area External Id”, “District Name-Rotation Area Name”, “Rotation Index”.


3.4.7.3 Election Event

The activity used for generating and previewing Election Event-related information in the form of areport.

This report lists the following system attributes:

• List of defined contests

• List of defined choices

• Status of ballot production

• List of defined ballots content

• Ballot Overview

• List of defined ballots per polling subdivision

• List of defined ballots per voting location

• List of defined ballots per tabulator

• List of consolidated ballots

• List of ballot types

• List of contest positions on ballot

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 83

• List of contest Precinct Rotation

• List of Contest and Choices List

• List of Ballot Text for Political Parties

• List of Ballot Text for Contests

• List of Ballot text for Contest Heading

• List of Ballot Text for Choice

• List of Ballot Text for Ballot Header and Footer

The contest report shows the following set of attributes for each individual contest: the name, numberof positions, name of the assigned office, subdivision and parent names,. It also specifies whether thecontest is acclaimed or disabled, provides column index number and value, and indicates whether thecolumn index had been rewritten (the values are dependent on ballot style). In addition, this reportshows the language of the audio and ballot content profiles. It lists the choices names and elector groups.

The choices report shows the candidates name, the contest name, the office name and the subdivisionname. In addition, this report shows the language profiles of the ballot, as well as the audio option andthe party support.

The ballot content report shows the initial size, file name, key-in ID, description, language profile andsize. Additionally, this report shows the list of choices (“Choice Name” and “Contest Name”).

The ballot overview report shows includes the key-in ID, ballot file Nname, description, language profile,and a list of precincts.

The consolidated ballots report shows ballot files and a list of contests.

The ballot distribution per polling subdivision report shows polling subdivisions, key-in ID and a de-scription (which includes polling subdivisions).

The ballot distribution per voting location report shows the voting location number, the voting locationname, a list of tabulators, polling subdivisions, key-in ID, a description (including polling subdivisions)and the number of eligible voters.

The ballot distribution per tabulators report shows the tabulator name, key-in ID and a description(including polling subdivisions).

The contest positions on ballot report shows the contest name, number of votes, number of pages andcolumns.

The ballot types report shows the ballot type number, abbreviation, contest name, office name, subdi-vision name and rotation. In addition, this report shows polling districts and the number of ExternalIDs.

The contest precinct rotation report shows the contest name, rotation and assigned precinct splits.

The contest and choices list report includes the contest name, number of positions, write-ins, choices andparty affiliation.

The ballot text for political parties report includes the political party name and language.

The ballot text for contests report includes the language and contest name.

The ballot text for contest heading report includes the contest heading name and language.

The ballot text for choice report includes the choice name, language, choice prototype and language.

The ballot text for ballot header and footer report includes the language, a description and the ballotcontent type.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 84

The reports are generated in simple text format and can be exported into PDF, HTML or MS Excelformat. Only “Ballot Content” and “Ballot Distribution” reports cannot be generated in PDF format.The created reports are stored on the NAS and signed using the election project key. Reports are createdwith the assigned date, and multiple reports can be generated.

3.4.7.4 Tabulation

This activity is used to generate and preview tabulation-related information in the form of a report. Thisreport shows the following system attributes:

• A list of tabulators with their defined parameters, including the assignment information

• A list of tabulator users

• A list of voting locations

The Tabulator report shows the “Tabulator Name”, “Voting Location (Polling Location) Name”, “Tab-ulator Type”, “Counting Group” and “Device Settings” data. In addition, this report represents theassociated polling subdivision data (“Polling Subdivision Name”, “Number of Voters”) as well as alist of Tabulator Users (user name, users first and last name). The Tabulator Users report shows the“Tabulator Name”, “Polling Subdivision Name”, “User Name” and the user’s first and last name. TheVoting Locations report shows main data and infrastructure-related information. Main data informationincludes: “Voting Location Name”, “Number” and “Description”. The infrastructure-related informa-tion includes the number of phone lines, internet access type, number of washroom facilities, buildingaccessibility, address name and number, longitude and latitude.


3.4.7.5 System Report

This activity is used to generate and preview system-related information in the form of a report. Thisreport group lists the following system attributes:

• Application Users

• Application Roles

• Language Profiles

• Database Security Information

The application user report shows the “User name”, “First and Last Name”, “Role”, “Status”, “UserPosition”, “Description”, “Address”, “Phone Number” and “Email”.

The Application Role report shows the “Application User Name”, “Password Type” and whether therole is a System Role. In addition, the set of permissions are listed. The application role related dataare presented for each role in a separate spreadsheet. The Language Profile report shows the “LanguageProfile Name”, its purpose and whether the language option is Default. The Database Security reportshows the “Database Name”, “Date of Creation”, date of modification, the key from the database andthe key from NAS.

The reports are generated in simple text format and can be exported into PDF, HTML or MS Excelformat. Only Ballot Content and Ballot Distribution reports cannot be generated in PDF format. Thecreated reports are stored on the NAS and signed using the election project key. Reports are createdwith the assigned date, and multiple reports can be generated.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 85

3.4.7.6 Audit Log

From the start of the application, every activity performed within the EMS EED system is recordedinto the EMS Database, including who did what and when. The auditing activity displays this auditingreport on the screen of the EMS EED client application.

In addition to recording the activities in the EMS Database, the same set of log entries are also enteredinto the Windows Event Log.

The reports found in the Audit Log Report Group are associated with the usernames that have beencreated within the EMS EED (e.g. Admin and Techadvisor). That is to say, the produced reports willlog each action that a specific user performed at a certain period of time.

These reports show details such as “User Name”, “Report for Time Period”, “Time” and “Action”.

The report is generated in simple text format and can be exported into PDF, HTML or MS Excel format.The created report is stored on the NAS and signed using the election project key. Reports are createdwith the assigned date, and multiple reports can be generated.

The following activities are logged by EMS applications:

• User log on and off (this is actually logged by default by Windows in Windows Logs/Security)

• Application start (this is actually logged once an election project has been opened by the applica-tion)

• Application stop (including user request and confirmation to close the application and the electionproject)

• Printing (Mobile Ballot Production specifically)

• Election event status

• Management of election data (Precincts, Districts, Polling Centers, etc)

• Programming of tabulators with election data

• Loading of results from tabulators

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 86

3.5 Domain Implementation - Results Tally and Reporting

Figure 3.10 illustrates the EMS Results Tally and Reporting main activities structure, whichVVSG 2005 vol I§2.1.6

VVSG 2005 vol I§2.4.2

VVSG 2005 vol I§2.4.3.a-f and§2.4.3.h-k

VVSG 2005 vol I§5.4.4

outlines the top-level main activities available in the system, as well as their sub-activities. This diagramdoes not include the navigation menu structure, but it does group together a variety of activities thatcan be performed within the EMS RTR application.

Figure 3.10: The EMS Results Tally and Reporting Activities Structure.

The main purpose of EMS RTR is processing election results. In doing so, the EMS RTR is responsible forprocessing election results from ImageCast R© Precinct, ImageCast R© Evolution and ImageCast R© Centraloptical ballot scan tabulators. ImageCast R© Precinct and ImageCast R© Central platforms produce electionresults in RIF format (Results Information File), in addition to scanned ballot images and log files.ImageCast R© Evolution produces election results in XML format.

The diagram presented in Figure 3.11 shows the processing paths and state transitions. A detaileddescription of the election results processing steps is provided in the sections that follow.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 87

Figure 3.11: The Election Results Processing State Diagram.

3.5.1 Results Acquisition

This activity is responsible for acquiring election results. Upon successfully starting and logging in, EMSRTR appears in the initial state. In this phase, the main application screen displays a list of knowntabulators that are waiting for results. This list of tabulators expecting election results is known to EMSRTR because it uses the same EMS Database as the EMS EED application used to define tabulatorinstances.

3.5.1.1 Local Import

Local import refers to the acquisition of election result files (RIFs from ICP/ICC or XMLs from ICE)from the Compact Flash memory packs. These results were initially acquired from the PCOS13 tabulationdevices. Before an election result file is declared valid, EMS RTR has to validate the RIF/XML file.Validation is performed by decrypting the RIF/XML file using the AES-128 algorithm and re-calculatingits message authentication code (MAC) using the keyed SHA-256 HMAC algorithm. If the file is valid,its content is parsed and the status of the tabulator transitions into its initial state. This transition isvisually displayed on screen.

13PCOS (Precinct Count Optical Scanner) refers to any ImageCast R© precinct tabulator, that is ImageCast R© Precinctand ImagePrecinct Evolution

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 88

3.5.1.2 Manual Entry

In some cases, there is a need to manually type-in the election results. In this case, EMS RTR providesa manual data entry screen where the user can enter the number of votes (and other significant data,such as the number of overvotes, undervotes, etc.) for each choice and each contest on the ballot.

When the system is configured with this option, manual entry can also be used to enter data from write-in ballots. In this scenario, the tabulators separate ballots with write-ins into a different compartmentof the ballot box. These ballots are analyzed following the election and write-in votes are entered intothe EMS RTR using the manual entry option.

3.5.2 Results Validation

VVSG vol I 2005§2.1.2.

From a logic and accuracy point of view, the process of validating election results can either be triggeredin the initial state of the election result file or after adjudication is performed.

3.5.2.1 View

In the view phase, a user inspects the acquired results file by previewing the number of votes that appearon the ballot and contest levels. In this case, ballot level refers to cumulative results for a specificballot style, while contest level refers to cumulative results for contests for all ballots. These results aredisplayed on the EMS RTR application screen.

3.5.2.2 Analyze

A user will only declare election results files as valid if he/she does not identify any unusual data withinthe file. If the user spots any illogical data (i.e. too many overvotes), the user has the ability to rejectthe file. In this case, the file’s status will reverse to ‘rejected’. However, if results appear normal, theuser will proceed with file validation.

3.5.2.3 Validate

File validation is the action in which a user declares an election file to be valid. This action will in turnchange the state of the election file from ‘initial’ to ‘validated’, and at the same time, update the currentresult totals within the EMS Database. The results can be validated per selected tabulator (Validateoption), all results can be validated at once (Validate All option) or validated and published (Validateand Publish option).

3.5.3 Results Publishing

VVSG 2005 vol I§2.4.4.a-c

Results publishing is used to publish unofficial election results to interested parties. Some examplesinclude notifying the media about the current unofficial results, or using the data for real-time dynamicpublic results presentations. EMS only provides aggregate results and does not provide data for individualballots or allow unofficial electronic reports and files to access the storage devices of official data. Whenbroadcasting unofficial results (as defined in VVSG Vol. 1 Section 2.4.4), the ImageCast R© unofficialresult publishing presentations clearly indicate that the results are unofficial.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 89

3.5.3.1 Transfer Points

Transfer points represent locations that can be reached by some form of network, and in turn, whereresults can be published. The user defines these transfer points. Depending on the type of transfer point,each point is defined by an appropriate set of parameters. The following transfer point types are defined:

• FTP: Defined by the name (or IP address) of the FTP server, TCP port, and set of credentialswith write permissions on the FTP server (not available in the NYS version of EMS).

• Network drive: A shared network location accessible from the system.

3.5.3.2 Publishing

Results reporting depends on the result types defined by the EMS EED client application during theelection event definition phase. The EMS RTR application has the ability to extract and format electionresults. Every report can be produced in Microsoft Excel or HTML format. EMS is designed to preventdata from being altered or destroyed by report generation.

3.5.4 Results Reporting

VVSG 2005 vol I§2.4.3.g

Results reporting depends on the result types defined by the EMS EED client application during theelection event definition phase. The EMS RTR application has the ability to extract and format electionresults. Every report can be produced in Microsoft Excel or Adobe PDF format. EMS is designed toprevent data from being altered or destroyed by report generation.

3.5.4.1 Summary

The summary report is a generic election results report which collects the complete set of election results.In turn, this type of report can be used to produce an initial zero report of the election results, as wellas a cumulative representation of the election results for a given election event.

3.5.4.2 Produce

In addition to the summary report, which is available within the system by default, the user can createother types of reports by selecting the desired report type(s) and triggering the report generation process.Created reports are stored on the NAS device, and the EMS RTR displays a list of all created reports,including their type and date of creation.

3.5.4.3 View

Created reports can be previewed directly from the EMS RTR application using Excel and/or HTMLviewer applications. Sometimes the created reports can become quite large. In that case, the user canutilize filtering options to narrow down the reports size.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 90

3.5.5 Results Auditing

VVSG 2005 vol I§2.1.5

VVSG 2005 vol I§5.4

After processing election results in most cases, there is a need to inspect the system operation in a moredetailed manner. As a result, the EMS RTR client application has the ability to produce a detailed auditreport on how ballots were marked and how they were interpreted by tabulator devices. In addition, EMSRTR collects and copies all relevant ballots scans to be visually inspected. Furthermore, all ImageCast R©

log files are visible through the RTR application.14

For full details on the ImageCast R© system’s audit functions as required by VVSG Vol. 1 Section 2.1.5,please refer to the following user guides:



3.5.5.1 Lookup

VVSG 2005 vol I§2.1.5.1.a.iii and§2.1.5.1.a.vThe first step when performing an audit is to lookup the list of scanned ballot images and log files

based on specific criteria. The generation of audit record entries will not be terminated or altered byprogram control, or by the intervention of any person. The physical security and integrity of the recordare maintained at all times. The user can export audit images for a subset of result files, for a singlecontest or for all contests. For each export a separate subfolder will be created. Inside the subfoldermaximum two subfolders can be created:

• published: Folder containing all images belonging to published results.

• notpublished: Folder containing all images belonging to non-published results.

If no contest was selected the following subfolders will be created inside these folders:

• BlankBallot: No contest was marked on the ballot.

• Blank: At least one contest did not have any votes on the ballot.

• UndervotedNotBlank: At least one contest was undervoted on the ballot.

• Overvoted: At least one contest was overvoted on the ballot.

• Regular: Each contest was fully voted on the ballot.

• Writein: Write-ins were marked on the ballot.

A similar approach is available for log files produced by the ImageCast R© tabulator devices. In this case,filtering can be performed based on tabulator instance.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 91

3.5.5.2 Ballots

VVSG 2005 vol I§2.1.5.1.a.vii

This activity represents the previewing of ballot images. ImageCast R© devices are unique due to theirballot fingerprinting technology, which records how the device interprets ballot markings, and appendsthis information to the bottom of the scanned ballot image. Using this activity, and after lookup isperformed, a user can select and inspect ballot images.

Ballot Image audit records can be printed. As per VVSG Vol. 1, this printing procedure meets thefollowing requirements:

• The generation of audit trail records does not interfere with the production of output reports.

• The entries can be identified to facilitate their recognition, segregation, and retention.

• The audit record entries are kept physically secure.

3.5.5.3 Logs

This activity represents a simple text viewer function for previewing the log files produced by ImageCast R©VVSG 2005 vol I§2.1.5.1.a.viidevices. Audit Log records can be printed. As per VVSG Vol. 1, this printing procedure meets the fol-

lowing requirements:

• The generation of audit trail records does not interfere with the production of output reports.

• The entries can be identified to facilitate their recognition, segregation, and retention.

• The audit record entries are kept physically secure.

3.5.6 Administration

Keeping in mind that the EMS RTR client application is part of the larger Democracy Suite R© EMSsystem, there is always the need to configure some aspects of the application’s behavior. In contrastto the EMS EED application, the EMS RTR application does not have user management capabilities.EED and RTR share the same EMS Database data repository and users, but roles and permissionsare exclusively defined using the EMS EED application. Consequently, EMS RTR has a limited set ofintegrated administrative functions.

3.6 Domain Implementation - Audio Studio

The EMS Audio Studio (AS) module represents a separate application used to record audio files for thegiven election event. Its operation is based on the audio definition library (XML) file exported fromthe EMS EED application and loaded into the EMS AS application. From this point on, the EMS ASapplication allow the user to record audio, attach previously recorded files and play back recorded files.Recorded files can be exported from EMS AS and imported back into the EMS EED application in OGG(SPX) or RIFX (WAV) audio file format. Files are compressed into a ZIP archive for an easier importinto EMS EED.

14Results auditing is not available in NYS version of EMS.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 92

3.7 Domain Implementation - EMS Adjudication

EMS Adjudication (“Adjudication”) is an application used by election officials to review and adjudicateballot images from ImageCast R© tabulators. The application utilizes tabulator results and scanned im-ages to allow stakeholders to make non-destructive adjudications to ballots with auditing and reportingcapabilities.

The application works in two basic modes: election project setup and adjudication. Adjudication projectsetup is limited to adjudication users with administrative privileges. Standard adjudication users onlyhave the ability to adjudicate ballots, while adjudication administrator users have additional capabilitiesof viewing configured project parameters and generating reports.

3.7.1 Adjudication Project Setup

The default state of the application, after installation, is adjudication project setup. While in this state,adjudication administrator users using the client on the machine with the EMS Adjudication Servicesinstalled may choose the election event to adjudicate, configure ballot filtering, configure which ballotcontests will receive highlighting, and configure miscellaneous adjudication options.

3.7.1.1 Outstack Conditions

The adjudication system utilizes a concept called an outstack condition that virtually separates ballotsby pre-determined ballot characteristics. Outstack conditions are used to filter which ballots are servedto users in order to streamline the adjudication workflow. For instance, if a jurisdiction wishes only toadjudicate write-in contests, they may filter out all ballots without write-in contests to reduce the overallnumber of ballots which need to be reviewed. A ballot may have multiple outstack conditions.

3.7.1.2 Common Outstack Conditions

The following outstack conditions are common to most all elections and are always available to be se-leected for adjudication.

Outstack Conditions: None

This condition indicates that no conditions exist for the given ballot.

Out stack conditions: Overvote

This condition indicates that a ballot contains one or more overvoted contests. This condition is appliedat the contest level.

Outstack conditions: Undervote

This condition indicates that a ballot contains one or more undervoted contests. This condition is appliedat the contest level.

Outstack conditions: Write-in

This condition indicates that a ballot contains one or more contests where write-ins are marked. Thiscondition is applied at the contest level.

Outstack conditions: Write-in (Qualified)

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 93

This condition indicates that a ballot contains one or more contests having qualified write-ins, wherewrite-ins are marked. This condition is applied at the contest level.

Outstack conditions: Blank Ballot

This condition indicates that a ballot contains no valid votes. A ballot containing one or more marginalmarks may qualify for this condition. This condition is applied at the ballot level.

Outstack conditions: Blank Contest

This condition indicates that a ballot contains one or more contests where no votes were detected. If acontest contains only marginal marks, this condition will exist. This condition is applied at the contestlevel.

Outstack conditions: Marginal Mark

This condition indicates that a ballot contains one or more choices that were detected as marginal marks.This condition is applied at the contest level.

3.7.1.3 RCV Outstack Conditions

The following outstack conditions may occur when a ranked-choice vote (RCV) contest is defined in theelection project. Each is applied at the contest level.

Outstack condition: Duplicate ranking This condition indicates that a ballot contains an RCVcontest where a candidate is marked in more than one ranking.

Outstack condition: Inconsistent ordering This condition indicates that a ballot contains an RCVcontest where a candidate is ranked both above and below another candidate.

Outstack condition: Overvoted rank This condition indicates that a ballot contains an RCV contestwhere a ranking has been overvoted.

Outstack condition: Skipped ranking This condition indicates that a ballot contains an RCV con-test where a ranking was skipped.

Outstack condition: Unvoted contest This condition indicates that a ballot contains an RCV con-test that is not voted.

Outstack condition: Unused ranking This condition indicates that a ballot contains an RCV contestwith an unused ranking at the end of the contest.

3.7.1.4 Additional Outstack Conditions

Additional outstack conditions may occur depending on the election project configuration and the typesof contests defined in the election:

Outstack condition: Crossover This condition indicates that a cross-over rule violation was detectedon the ballot. This occurs when the voter votes in mutually-exclusive contests, for example, voting in

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 94

different partisan contests on an open primary ballot. This condition is applied at the ballot level.

Outstack condition: ’No Preference’ choice overridden In jurisdictions that include a ’No Pref-erence’ choice this condition indicates that a vote for ’No Prefer- ence’ was overridden because it wouldresult in an overvote. This condition is applied at the contest level.

Outstack condition: Overridden by write-in This condition indicates that a vote for a regularcandidate was overridden by a vote for a write-in candidate to prevent an overvote in jurisdictions wherethis rule applies. This condition is applied at the contest level.

Outstack condition: Party preference This condition indicates that a party preference rule violationwas detected on the ballot. This occurs when the voter votes for one party in a party preference contestand then votes for a candidate in a different party. This condition is applied at the ballot level.

Outstack condition: Removed cross-endorsed mark This condition indicates that a ballot con-tains a contest where the voter voted twice for a candidate affiliated with multiple parties. Only thetop mark is counted. This condition is applied at the contest level.

Outstack condition: Strict Inclusive overvote This condition indicates that a ballot contains acontest where an overvote occurred through the combination of explicit votes and implicit votes froma straight-party contest. This condition is applied at the contest level.

Outstack condition: Strict vote for In jurisdictions with contests where the voter is required tovote for a particular number of candidates, this condition indicates a contest where the voter marked anumber of candidates different than the contest ”vote for”. This condition is applied at the contest level.

3.7.2 Starting Adjudication

When the administrator has finished configuring all adjudication project parameters and is ready to beginadjudicating ballots, a button is pressed which signals to the services that batch and ballot processingcan begin. At this point, all clients will begin receiving non-filtered ballots.

NOTE: Project parameters cannot be changed after this point.

3.7.3 Results Acquisition

Once adjudication is started, the EMS Adjudication Services request results from the Cast Vote Recordservice that have been loaded into RTR. The EMS Adjudication Services iterate through each tabulatorand batch to transfer the data into the adjudication system.

3.7.3.1 Cast Vote Record (CVR) Service

Adjudication communicates with EED and RTR through the EMS Application Server. Specificallyresults that have been loaded into RTR are served through the CVR service according to the filteringrules selected in the Adjudication Election Wizard. Once a ballot in a results file has been adjudicated,that results file will appear as not synchronized in RTR until the batch has been submitted back to RTRin Adjudication.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 95

3.7.3.2 Batches

Batches contain ballots and are the primary groupings used within the application. Although the tabu-lator name is also visible, ballots are not organized hierarchically under tabulators, but under batches.Batches are also the unit under which results may be accumulated, reported on, and submitted back toRTR.

The application will attempt to serve all ballots within a batch before moving on to another batch.

Batches have six states that they move through: In-progress, Review, Pending, Submitted, in error state,or read error. In-progress batches are batches that have been acquired by the system and have ballotsbeing served to clients. Any batches which contain ballots that could not be read will have their statuschanged to Read Error and the administrator will be alerted. When all ballots for a given batch havebeen adjudicated, its status changes to Review. A batch in review is available to be re-opened andadjudicated, and for reporting and submission to RTR. Once a ballot has been submitted to RTR, itsstatus changes temporarily to Pending while it is put into RTR. When the system confirms that a batchhas successfully been sent, its status changes to Submitted. If unsuccessful, the status changes to InError State.

3.7.4 Adjudication

While adjudication is in progress, all clients will receive ballots to adjudicate based on the filtering setup by the administrator in the adjudication project setup steps. Ballots are automatically served toeach client. Adjudication administrator users have a menu available to them that lets them view batchstatistics, selected ballot and contest filters, contest highlighting, configured qualified write-ins, and togenerate reports. Non-admin users may only adjudicate ballots and do not see the administrator menu.

To adjudicate a ballot, a user clicks and drags on a ballot to pan the ballot viewing area. A mouse wheel(or Ctrl-+/Ctrl–) may be used to zoom in an out on the ballot image. The left and right arrow keys ona keyboard may be used to quickly move between highlighted contests. A ballot navigation menu existson the right side of the user interface providing a toggle switch for switching overlays on/off. Thereare buttons to view front and back ballot images as well as a button to view the Audit Mark. Humanmarked ballot faces may be accessed using the keyboard shortcuts: F(ront), B(ack), A(udit Mark).

There is a line of text below the toggle switches that shows information about the ballot, such as thetabulator and batch number as well as which number it is in the sequence for the batch. The user canalso hover over this line with the mouse, in order to display the number of ballots remaining in the batch,plus the total number of unadjudicated ballots.

When all ballots have been adjudicated for a batch, the batch status changes to review and is availablefor reporting and submission to RTR. If a batch is not completing due to a stuck ballot (a user mayhave left with an active ballot on their screen, etc.), an administrator may right-click on that batch andchoose to reset any open ballots and re-serve them to open clients.

3.7.4.1 Ballots

Ballots consist of both a logical structure containing vote results for contests and scanned ballot im-ages from tabulators. Ballot images are presented to users with overlays representing whether or not

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 96

the vote was originally counted by the tabulator and the confidence percentage of each mark. Both thefront and back images (where applicable) as well as the original Audit Mark image are visible to the user.

Digital ballot images, such as those produced from machine marked barcode ballots, consist of humanreadable text indicating the voter’s choices. Adjudicators are presented with a write-in resolution panelcontaining all contests with write-in votes to allow an adjudicator to resolve them.

Ballots have four potential statuses in the application: New, In-progress, Adjudicated, and Filtered.When ballots are first acquired by the system, they are either marked as new or filtered, depending onhow the adjudication project was configured. Once a ballot is served to a client, its status becomesin-progress. When adjudication is complete, it changes to adjudicated. A reopened ballot remains in itsformer status until an administrator saves it, at which point it becomes adjudicated, regardless of itsprevious status.

3.7.4.2 Contests

Contests contain choices with corresponding vote targets. In the application, administrators may setupcontest highlighting that will outline contests that require special attention based on outstack conditions.

Additionally, an informational icon is overlaid in the top right corner of each contest that contains anoutstack condition. The icon provides information about detected outstack conditions for each contestwhen the user hovers over it with their mouse.

Digital ballot contests contain text representing the choices voted for in each contest. No overlaysare drawn on the ballot image; instead, a write-in resolution panel appears allowing an adjudicator toresolve write-in choices. The Show\Hide toggle switch can be used to change the visibility of thewrite-in resolution panel.

3.7.4.3 Choices

A choice is the base ballot artifact in the system. For each choice on a human marked ballot with adetected mark in its target area, the system will overlay a colored highlight on the choice text indicatinghow the tabulator read the mark: yellow for marginal marks, green for counted marks. For countedmarks, the system overlays a green target indicator with a check mark icon in the target area. Overlaysfor both choices and contests may be toggled on and off by the user to allow unobstructed viewing ofthe target area. Finally, choices which are detected as marginal marks (mark confidence between thelower and upper marginal mark thresholds) will display a confidence percentage when the user placestheir mouse over the choices target.

To adjudicate a contest on a human marked ballot, a user clicks on the target area of the ballot totoggle its vote status. If the choice was previously counted as a vote, clicking on it will remove thevote and a red overlay with an “X” icon will appear over the target. If the choice was not previouslycounted (including if it was detected as a marginal mark), clicking the target will add a vote for thatchoice and a green overlay with a check mark icon will appear. For write-in contests, a pop-up dialog isshown that lets the user resolve the write-in to a qualified write-in name or to reject the write-in vote asinvalid with a listed rejection reason. If the write-in is resolved to a qualified write-in name, the over-lay will green with a check mark icon. If the write-in is rejected, it will be displayed red with an “X” icon.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 97

To adjudicate a contest on digital ballots, a user finds the contest in the write-in resolution panel andclicks the Resolve write-in button to show the pop-up dialog. Because the ballot targets are not avail-able as they are in human marked ballots, the candidate names drop-down contains all the candidatesin the contest as well as the qualified write-in names so that an adjudicator can resolve a write-in to aballot candidate had the voter written in a ballot candidate name. From there, write-in resolution isidentical to that of a human marked ballot. When write-in resolution is complete for a given choice, thewrite-in resolution button changes to display either Resolved (resolved to a qualified write-in name oraccepted as-is) or Rejected. These labels may be clicked on again to reveal the pop-up window andallow an adjudicator to change their original resolution.

Qualified write-in names may only be used once per contest. For example, in a vote for two contest,a single qualified write-in name may only be applied to one write-in choice. Once a candidate name isselected and assigned to a choice, it is no longer available for subsequent name resolution within thatballot.

3.7.4.4 User Notifications

User notifications are displayed to users to confirm certain actions or display system information. Alertscan either be green (vote added or other information), yellow (cautionary information), or red (voteremoved or error information). Alerts show up in a bar at the top of the user interface for a configurableamount of time. The duration that an alert is shown can be changed in the applications configurationfile by changing the value of the setting NotificationDurationInSeconds.

3.7.5 Reopening a ballot

Administrator users may double-click on a ballot on the Batch Management screen to reopen a ballot.Only ballots which have already been adjudicated will be available for reopening and will appear undertheir respective batch in either the In-Progress or Review panes. To view ballots, a user must clickon the expander (arrow or plus icon, depending on the Windows theme used) next to a batch withadjudicated ballots. Each ballot listing shows the ballot number along with the date and time it wasadjudicated and by whom.

Once a ballot is double-clicked, the administrator will immediately be taken to the reopened ballot inits original state - not reflecting previous adjudications - with the exception of saved audit marks fromprevious sessions, which will be visible. If another ballot was already open with changes made to it,the administrator will be asked to save the changes, discard changes, or cancel the reopen operation. Ifno changes have been made to the currently open ballot or no ballot was already open, the reopenedballot will simply be displayed. Upon completing the ballot, the administrator will have the option tosave the ballot (overwriting any previous adjudications), or to revert to the adjudications that were donepreviously.

When the reopened ballot has been completed, the administrator will re-enter the normal ballot queueand receive new ballots, if any exist. Reports for the batch containing a reopened ballot that was savedwill be regenerated. If an administrator has already generated a report based on a batch containing thereopened ballot, they will be alerted that the report may be out of date and asked to regenerate it. Ifchanges to a reopened ballot are discarded, reports are not regenerated.

Throughout the reopen process, ballot statuses are never changed. If a reopened ballot is saved, it willtemporarily change the report status of its containing batch in order to regenerate reports.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 98

3.7.6 Spoiling Batches

Spoiling a batch is a last-resort remedy for completely removing an in-progress batch from Adjudicationwhen there is something wrong with the batch. For example, a batch may need to be spoiled when thereare bad ballot images that prevent ballot adjudication. A spoiled batch will no longer be shown in theBatches view nor be available to run reports on. No ballots from that batch will be served to users, andany adjudications made on ballots within the spoiled batch will be ignored. To re-introduce those ballotsto Adjudication they must be validated in RTR.

To spoil a batch, reject its respective result file in RTR. When adjudication polls the Cast Vote Recordservice for updates any rejected batches will be spoiled in Adjudication and any ballots belonging to thatbatch will be recalled from clients.

3.7.7 Reporting

Adjudication administrators may generate four types of report: Summary, Activity, Write-In Resolution,and Statistics. The Summary Report is only available for batches submitted to RTR. The other reportsare available for either completed or submitted batches. The election project name is defaulted into theelection title text box but may be changed by the user. Additionally, a user may enter their own titlefor the report. Reports may be generated as Adobe PDF, Microsoft Excel, or generic CSV files. Exceland CSV formats allow users to import the results into other systems.

If a ballot is reopened and saved, the reports service will automatically regenerate its containing batchsreports and alert the user that any generated reports may be out of date, if applicable. If this messageis received, the user must regenerate the report to clear the message.

3.7.7.1 Summary Report

Summary reports accumulate all adjudicated results by tabulator and batch and show summary totalsby contest. Batches and ballots that were filtered in the adjudication project setup step will have theirtotals reflected here and contribute to overall turnout numbers. Summary reports may be generated forone or more batches.

3.7.7.2 Activity Report

Activity reports show adjudication actions taken against each ballot and are grouped by tabulator andbatch. Each action shows the user name of the logged-in adjudication user along with the date/timeof the action. The following actions are listed: Mark added, mark removed, write-in accepted, write-inrejected (with reason). Ballots which were filtered out of adjudication are labeled appropriately in thereport.

3.7.7.3 Write-In Resolution Report

The Write-In Resolution report shows a breakdown of adjudication actions made specifically to resolvewrite-in choices. The report breaks down the actions into the number of choices accepted as-is, thenumber of choices that were resolved to a qualified write-in candidate and what candidate they wereresolved to, and the number of choices that were rejected and for what reason they were rejected.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 99

3.7.7.4 Statistics Report

The Statistics report gives a numerical breakdown of the total number of ballots adjudicated comparedto the total number of ballots in the selected batch or batches. The report shows Adjudicated Ballots:x of y where x is the number of ballots adjudicated and y is the total number of ballots. Below this is abreakdown of the number of ballots that were adjudicated for each given outstack condition selected inthe project set-up. Because ballots may match more than one outstack condition, the total here may bemore than the total number of ballots in the batch or batches.

The first, bolded section of the report shows the totals for all batches selected for the report. A batch-by-batch breakdown follows with totals for each respective batch.

3.7.8 Stopping Adjudication

After completing all adjudication actions, the administrator will stop adjudication. All open clients willbe notified that adjudication has been stopped and any ballots remaining on client machines will beremoved. Changes made to ballots that remain open on client machines after stopping adjudication willnot be saved. Stopping adjudication is normally the final step in the processing of an adjudication project.However, it is possible to resume processing of a project after it has been stopped, in the case wherea new project has to be set up. Adjudication can only process one project at a time. After stopping,no further actions on the project are allowed, including reporting, unless the project is resumed. Thelocal administrator client will be taken back to the adjudication project setup wizard. At this point, thesystem will be ready to set up and begin processing a new election project, or to resume a project thatwas previously stopped.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 100

Chapter 4

Democracy Suite R© EMS SecurityDescription

VVSG 2005 vol I§2.1.1.a-f

VVSG 2005 vol I§4.1.3.1.a-b


VVSG 2005 vol I§7.2.1





Detailed security specifications for the Democracy Suite R© platform are provided in the separate TDP2.06 Democracy Suite R© System Security Specification document. This section provides a high-level,functional description of the EMS security controls.

The overall Democracy Suite R© platform, and all of its related project and development processes, closelyfollow the relevant security best practices and principles from the ISO 27000 series of recommendations(ISO 27001 and ISO 17799/27002). Therefore, the security mechanisms applied are based on previousrisk analysis and the appropriate risk mitigation decisions. However, it is important to state that forproper system security protection, appropriate processes must be defined and followed by all the businessstakeholders within the system, including election staff members of the jurisdiction and Dominion as thevendor. With this in mind, the Democracy Suite R© EMS provides enabling techniques that allow businessstakeholders to follow the best security practices and processes.

4.1 Access Control

4.1.1 Access Control Policy

The access control policy defines important aspects of the access control mechanism. The two mainaspects are the business requirements for access control, which are defined by the jurisdiction withinthe access policy statement, and the access control rules, which clearly state which rules are mandatory,optional or conditional.

The Democracy Suite R© EMS platform implements role-based user management for the provisioning ofthe access control mechanisms. Each user accessing the system using one of the two client applications(EED or RTR) is a member of one of the pre-defined or custom-made roles. Each role, on the otherhand, has its own set of permissions or actions that users of that role are allowed to perform within thesystem. The management of access control policies is integrated within the User Management activityof the EMS EED client application (see Section 3.4.2.1). This activity is only available to users withadministrative privileges.

Mapping of users to pre-defined system roles, or to custom created roles, is dependent on the defined busi-ness access control policy which is specific to each jurisdiction defining and managing election projects.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 101

Section 3.2 lists pre-defined user roles as defined by the EMS architecture. Users of pre-defined adminis-trative roles can create custom-made roles to satisfy user mapping to specific set of system permissions.Sections 3.4 and 3.5 define a variety of system activities integrated within the EMS platform. The ta-bles that summarize the mapping between the pre-defined roles and the possible system activities arepresented in TDP 2.06 Democracy Suite R© System System Security Specification.

Please be advised that search option is available to all EED and RTR users without any restrictions.However, the election definition cannot be affected by the search function.

In addition to the pre-defined roles, the system allows users to define custom roles with a desired set ofpermissions. This activity can be performed from the EMS EED client application and is only availableto users with administrative rights.

The defined roles and associated users seen above are part of the EMS client applications. This means thatthese users do not have rights to directly access the EMS Application and Database Server components,except by using the EMS EED or EMS RTR client applications. In addition, these roles and users shouldnot be mixed with the operating system or network system roles or users, which are defined separatelyduring the overall system installation and setup.

4.1.2 EMS User Access Management

A user account must be established for each user that requires access to the EMS system. These usersare created by the administrative user and are usually one of the first steps in configuring the systemafter the election project is created. The system does not impose any limits to the number of users thatcan be created within the system. When defining a new user, a set of security credentials is assigned tothe user. These security credentials include a unique user ID and password. The user ID is entered bythe administrative user creating the new user account, while the password is automatically generated bythe system based on the user role and its corresponding, pre-defined password strength policy. Passwordsare established in such a way to ensure they meet a certain level of randomness, and to eliminate anypotential spelling errors the system may recognize. Created password are not stored within the EMSEED (nor RTR) client applications, but rather in the EMS Database in a cryptographically protectedformat (using one-way hash functions).

The system does not allow user accounts to be deleted because of the integrity of the audit logs kept bythe system. Users are assigned an account status (initial, active or void) and only users with an ‘active’account status can use the system. When a user account becomes obsolete, it is not deleted, but insteadits status is changed to void.

After a user account has been created, the system creates a new user account in ‘initial’ status andproduces a printable record statement. In addition to the user information and list of privileges assignedto the user, this record contains a password confidentiality statement to be signed by the user. Uponsigning the statement, the new user account can be activated (the user account status changes from‘initial’ to ‘active’).

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 102

Figure 4.1: The Computer Awareness and Data Security Compliance Confidentiality Statement

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 103

Individual users are not allowed to manipulate (edit or delete) their accounts and they cannot changetheir assigned credential information. Only administrative users can perform these actions. If a userforgets his or her assigned set of user credentials, the administrative user will have to create a new setof credentials.

For management of initial administrative user credentials, see Section 4.5.

4.1.3 Monitoring System Access and Use

From the moment the project is created to the moment the project becomes deactivated (see Section 3.1),the EMS system keeps an activity log within the EMS Database. This activity log stores every actionperformed by any user within the system, and thus functions as a detailed audit log that can be analyzedand printed in the form of an audit report. The audit information cannot be modified or permanentlydeleted from the EMS client applications. However, the report can be exported for archiving purposesas part of the record retention policy. Keeping in mind that audit logs can contain a significant amountof information, it is the responsibility of the administrative user to regularly archive log information.Doing so will clear the log and create more space for new records.

4.1.4 Data Retention

VVSG vol I 2005§2.1.10

VVSG vol I 2005§2.1.4

VVSG vol I 2005§4.1.3.2

VVSG vol I 2005§4.1.6.1

VVSG vol I 2005§4.1.7.1

VVSG vol I 2005§5.3

To preserve system integrity, voting and audit data are kept on nonvolatile data storage mediums. In caseof the Democracy Suite R© EMS, data is kept on hard drives. In case of ImageCast R© set of devices, thevoting and audit data are kept on the compact flesh memory cards. Both hard drives and compact fleshmemory cards can be removed from the system/devices and transported to another location for readoutand report generation. It is required that any storage media used in the system has demonstrated error-free data retention capabilities for a period of at least 22 months as per the manufacturer’s specifications.

4.1.5 ImageCast R© Precinct User Access Management

In addition to EMS user access management, the EMS EED client application is responsible for creatinguser accounts for the PCOS series of optical ballot scan tabulators.1 Multiple user accounts can becreated for each instance of the tabulator, however, all created users are of the same administrative role.This role allows for the following set of permissions:

• Starting the PCOS device.

• Verifying and loading the PCOS device voting application and configuration files.

• Opening and closing the poll.

• Printing reports and administering the PCOS devices.

• Initiating AVS voting sessions on the device.

User accounts for the PCOS devices are managed through the ‘Programming’ sub-activity found withinthe Tabulators activity within the EMS EED client application. All user accounts created within thisactivity are stored within the EMS Database. When creating user accounts, the EMS EED applicationallows iButton security keys to be programmed. Each iButton security key contains a unique identifier(a 64-bit number), and, in turn, can be linked to an individual user account record.

1The Precinct Count Optical Scanners refers to ImageCast R© Precinct and ImageCast R© Evolution devices.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 104

4.1.6 ImageCast R© Central User Access Management

The user accounts for the ImageCast R© Central workstation operators are also created using the EMSEED application. Credentials are in the form of a user name and password. The password is used as thesecret for a keyed HMAC (Hash-based Message Authentication Code) algorithm. The digest value (theresult of a keyed, one-way hash function) is stored on an iButton device.

4.2 Data Integrity and Confidentiality

When designing the data integrity and confidentiality security controls within EMS, the following areasVVSG 2005 vol I§5.3have been considered:

• Completeness of data.

• Data quality.

• Preservation of data for intended use.

• Protection from data tampering.

• Data authenticity.

• Prevention from eavesdropping.

In all these areas, the access control mechanisms described previously have an important role to onlyallow authenticated and authorized access to data. To protect against accidental modification, a varietyof input data validations are implemented using regular expressions such as checking for out-of-rangevalues, invalid characters in data fields, missing or incomplete data, etc. In addition, the internal logicof EMS forces a database commit action to occur after every user action, which ensures data integrity inan internally maintained domain model (within the application) and in a relational data model (withinthe database). Using this approach, accuracy, correctness and validity of data is maintained, whilethe occurrence of some common data integrity errors (such as primary key / foreign key relationshipproblems) are eliminated. Finally, every data operation is based on transactional processing, whichallows for roll-back operations to occur in the case of exceptions.

As described earlier (Chapter 2), the EMS system includes EED and RTR client applications, whichcommunicate with the EMS back-end components over the network. These system components utilizeSSL communication channels to post and retrieve information, which helps prevent tampering and mes-sage forgery (in addition to confidentiality). In this configuration, the EMS Application Server has anSSL digital certificate which is trusted by the EED and RTR client applications. By utilizing public-key cryptography, symmetric ciphers and one-way functions, several data integrity and confidentialityfunctions are provided:

• A digital certificate (X.509) is used to authenticate the back-end system components which preventsman-in-the-middle attacks and back-end server impersonation.

• Public-key encryption is used to exchange the symmetrical encryption key exchange between clientapplications (EED and RTR) and the back-end system.

• Symmetrical key encryption is used to provide data confidentiality.

• One-way hash functions create message authentication codes (MAC) to transport data level in-tegrity.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 105

The described SSL mechanism is designed for point-to-point data confidentiality and integrity whentransferring data from one system component to another. It is, however, necessary to protect data whileit is stored in the system (primarily all output files in the system such as reports, audit logs, electionfiles, etc.). The following table shows a matrix of data to be protected, as well as implemented dataconfidentiality and integrity mechanisms:

File Type Storage Place Confidentiality IntegrityElection files (ICP)and election database(ICE), DCF (ICP) andMBS (ICE), result files(ICP/ICE)

NAS and Compact Flash AES-128/256 HMAC (SHA-256)

Reports and Logs NAS and Compact Flash AES-128/256 HMAC (SHA-256)Ballot Images NAS and Compact Flash - HMAC (SHA-256)Official Ballots NAS X.509 Digital CertificateUser Credentials iButton HMAC (SHA-1) HMAC (SHA-1)

Table 4.1: File Type to Security Algorithm Mapping.

In this process of data protection, when the election project is created, EMS EED creates several cryp-tographic keys or secrets:

• AES key (128 bits): Common for the election project - used to encrypt and decrypt election files,reports and logs.

• X.509 digital certificate: Common for the election project - used to encrypt, decrypt and digitallysign official ballots (PDF)

• HMAC key (for SHA-256): Common for the election project - used to sign election files and allother output files produced by EMS

• In addition, when creating and configuring ImageCast tabulator devices, EMS EED creates addi-tional security elements:

– Device operator credentials (user name and password) - used as an access control mechanismin combination with SHA-1.

– HMAC key (for SHA-256): unique for each tabulator - used to sign ImageCast R© output filessuch as RIF or XML files, ballot images and log files.

4.3 System Level Security

System level security involves processes and technical procedures to follow in order to establish a satis-fying security level for the overall system. These include system installation, startup and configurationrecommendations and mandatory steps to follow.

4.3.1 System Configuration

VVSG vol I 2005§2.1.1

In the most common physical deployment scenario the following high-level components of the system areused:

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 106

• EMS Data Center: EMS Application and Database servers, the NAS storage system and additionalpower protection equipment.

• EMS EED client application workstations: Local and remote installations of EMS EED applica-tions.

• EMS RTR client application workstations: Local and remote installations of EMS RTR applica-tions.

• ImageCast R© Central : ImageCast R© Central scanner and workstation.

Before any of the Democracy Suite R© EMS applications can be installed, the system must be configuredwith all prerequisite software. After installing operating system software (Windows Server 2012 R2 andWindows 8.1 with the latest service pack) on the designated server and client computers, the systemcan be appropriately configured. In addition to OS installation, the system requires that SQL Server2012 R2 database server and additional prerequisite components be installed (anti virus software, AdobeReader, etc.).

Once all the system-level components are installed, a set of configuration procedures must be satisfied.The main system components are interconnected both physically and logically. All Data-center compo-nents are collocated within the rack unit. All server items are interconnected using the gigabit switchif local LAN EMS hardware configuration is used (and allowed). In addition, all client workstations areinterconnected using the gigabit switch if local LAN EMS hardware configuration is used (and allowed).However, from a logical point of view, the EMS Application Server is the main interconnecting pointbetween data center components and client workstations.

When configuring the system components, the following rules apply:

• All system devices (client and server components) have static IP addresses.

• The EMS Application Server is configured with the SSL digital certificate (HTTPS).

• The EMS Application Server is configured to only allow the defined set of static IP addresses toaccess the system according to the IP address assignment of client workstations.

• The EMS Database Server and EMS NAS storage system is configured to only allow access fromthe static IP address assigned to the EMS Application Server.

4.3.2 System Installation

During the system installation step, the EMS Application Server, EMS DMS, EMS AS, EMS EED andEMS RTR client applications are installed on the designated system devices. The installation processfor EMS EED and RTR clients is identical to any Windows application installation and does not requireany special procedures. On the other hand, the installation of EMS Application Server software requiresadditional steps. After the EMS Application Server software is installed, it must be configured to ensureit executes as a long-running process under the supervision of Windows Server IIS 7.5. This step allowsall the benefits of executing EMS Application Server software under a secure environment to be used toconfigure client application access privileges.

4.3.3 System Startup

Before the EMS EED and RTR client applications can be started, the back-end system shall be opera-tional. After successfully logging in to the Windows operating system, the user can start the EMS client

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 107

application. There is no special login procedure for EMS EED, while in the case of EMS RTR, the usermust log in to EMS system before the application can start.

EMS EED does not have a login screen when the application is first started. However, users at startupare only allowed to create a new project or open an existing election project. The system requires that theuser provide login information (user name and password) to proceed with either activity. This approachis used because each election project can have a different set of configured users, and therefore, the loginprocess is applicable on the level of the election project and not on the level of the EMS EED applicationbecause it can manage any of the election projects.

On the other hand, the EMS RTR client application has the traditional user login screen. When a userstarts the EMS RTR application, he/she will be asked to provide his/her user name and password beforethe application main screens will appear. User credentials for EMS RTR (as well as for EMS EED)are stored within the EMS Database. When the EMS RTR application is used, the EMS Database hasalready determined which users are authorized to use the system. The election project to be used isknown and recorded within the EMS RTR XML configuration file.

Immediately after starting the application, both client applications start to collect auditing informationfor each user using the system.

4.4 Error Message Comprehension

VVSG 2005 vol I§2.1.3

VVSG 2005 vol I§2.1.5.1.b.ii

VVSG 2005 vol I§2.1.5.1.b.iii

VVSG 2005 vol I§2.1.5.1.b.iv

VVSG 2005 vol I§2.1.5.1.b.v

VVSG 2005 vol I§2.1.5.1.b.v.i

VVSG 2005 vol I§2.1.5.1.b.v.ii

VVSG 2005 vol I§2.1.5.1.c

4.4.1 Democracy Suite R© EMS EED Error Handling

The Democracy Suite R© EMS EED application logic allows the user to validate input data and trackerror and warning states of objects. EED logs critical (fatal) errors and provides information about theobject’s state. Tracking of changes is performed using the Nlog logging framework to log to a file on theEMS application server, and/or directly to the EMS database userlog table. Client applications receiveinformation through the application GUI immediately, and end-users can access the file system log filefor detailed error or warning messages.

The whole process can be divided into several parts:

• Validating of input data.

• Tracking errors, critical errors, warnings and information of objects status.

• Logging errors, critical errors, warnings and object status information through program execution,

• Notifying client applications through application GUI.

• Recovering from an illegal state.

4.4.1.1 Validating Input Data

The validation of input data and program settings is divided into several levels:

• Critical Error: The client application will receive a message indicating that the process cannotcontinue until all critical errors are corrected.

• Error: The logging developer logs all exceptions for Dominion Voting software and generic operatingsystem exceptions.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 108

• Runtime Critical (Fatal) Error: If the critical (fatal) error of no-recovery exception occurs, theprogram will immediately stop and the client application will be notified. The logging developerwill log all unexpected events leading up to the end of the application. The application will beterminated. Runtime processes will be stopped immediately if one or more critical (fatal) errorsoccur.

• Runtime Error: The error will stop the current operation and the object will rollback to an earlierstate. The client application will receive an error trace and obtain information on the criticaldata/settings.

• Warning: If a non-critical (fatal) error occurs, the process can be executed. However, warnings willbe generated and logged to the log file or database log table (userlog).

• Runtime Warning: All warnings during the runtime process will be collected and the client appli-cation will be notified after the operation. If the application is allowed to move to another state,the client will be notified of all non-critical errors through the warning exceptions.

• Object State and Progress: All important changes of objects and data are logged to the file systemlog file or a database log table (userlog).

4.4.1.2 Tracking Errors, Warnings and Status Information of Objects

The class that allows tracking of errors and warnings is DVS.Framework.MemoryCore.API.ValidationTracker.The IsFatal flag is one method used by this class to track errors. When flag IsFatal is set to false, theclass will track and log warning levels. Otherwise, if the isFatal flag is set to true, a validation er-ror will raise the error exception level. All messages in this class will be logged through NLogLogger(DVS.Utilities.Common.Misc) using the Nlog logging framework and the logging information will besaved to the file system file and userlogtable in the EMS database. The Nlog library is well knownlogging framework and has its roots in log4j and log4net. It can be configured to log messages to manytargets (event log, text file, different database types, email, tcp port, udp port ....) and can be recon-figured at runtime without restarting the application (as a watchdog mechanism for configuration file).The logging system provides all relevant information for a subsequent log audit, including all relevantarguments for method invocation, and any local variables that can give important data in log analysis.

The most important log error levels can be divided to:

1. NLogLogger.Error: Writes the diagnostic message at the error level in the case when an errorexception does not exist.

2. NLogLogger.ErrorException: Writes the diagnostic message at the error level when an error ex-ception exists.

3. NLogLogger.Warn: Writes the diagnostic message at the warning level when a warning error ex-ception exists.

4. NLogLogger.WarnException: Writes the diagnostic message at the warning level when a warningerror exception exists.

4.4.2 Error Recovery

VVSG vol I 2005§2.1.3

VVSG vol I 2005§2.1.4

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 109

4.4.2.1 Memory Object Recovery

All memory objects change with the transaction mechanism. In the case of any error exception, data intransaction will be rollbacked and returned to the previous state. The method for rollback ThrowOr-Rollback(ex) has exception-like input parameters and implements the log strategy. The Transactionclass implements a simple transaction mechanism. Each elementary action is wrapped in transaction.Transactions around each other can be viewed as the single transaction that is nested around all others.The transaction object is one per thread. It has counter that is incremented in StartTransaction anddecremented with CommitTransaction. The StartTransaction method increments the internal counterand the CommitTransaction method decrements it. When it comes to 0, the actual commit is performed.This logic allows recovery of memory data on every failed transaction.

4.4.2.2 Database Redundant Server Recovery

Failover Clustering System

A failover cluster consists of more than one computer hosting a single instance of MSSQL database server.One (primary) computer provides the service in a normal situation. The second, failover computer runsthe service when the primary system fails. The database server will continue running and be availableif the primary computer fails. The secondary computer will recognize the crash of primary computerand restart database services. A failover cluster consists of one or more servers with two or more shareddisks. In the case of MSSQL 2012, a shared disk hosts the database data. The node is the independentserver in the cluster. A combination of shared disks and nodes is the resource group. The virtual server(resource group, server name and IP address) is limited to a single instance of SQL server. To the clientapplications on the network, the SQL server 2012 virtual server appears to be a single computer. If oneof the nodes in a cluster fails, the application automatically fails over to another node in the cluster.From a client point of view, nothing appears to have changed on the network nothing and the databasecontinues to respond. This configuration supports a close to real-time recovery strategy. In the case ofHigh-availability clusters, the system will immediately recognize the crash of the primary node and thesecondary node will restart the database service.

4.4.2.3 Database Recovery

Simple Recovery Mode

In this mode the SQL Server truncates the transaction log on a transaction checkpoint or after eachbackup. The transaction log only contains basic information. The advantage of this mode is a verysmall transaction log. With this recovery model, the user has the ability to do complete (full) backups(an entire copy) or differential backups (any changes since the last complete backup). In the case of thedatabase damage (corrupted data) will be recovered only to the last point at which it was backed up.

Full Recovery Model

The full recovery is the best option to prevent data loss, although the transaction log may become verylarge. This type of recovery can make database data and transaction log backups. The full recoverymode can also provide protection against media failure. The transaction log is hosted on fault tolerantRAID (Redundant Array of Independent Disks) or on SAN (Storage Area Network). RAID or SANallow the disk subsystem to be independent from any single disk drive. An optional SQL Server 2012can back up the transaction log during a normal data or differential backup.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 110

Bulk-Logged Recovery Model

Bulk recovery model is a full recovery mode that cannot create a log in special cases (index creation orbulk imports). The advantage of this mode is better performance and better log space consumption.

4.4.3 ImageCast R© Error Handling

ImageCast R© tabulator are designed so that all error messages requiring operator or precinct officialintervention are displayed or printed clearly in an easily understandable text. Comprehensive errornotifications are provided using both text and visual indicators.

ImageCast R© tabulators meet the VVSG Vol. 1 requirement 2.1.5.1.b.iii, and, as such, when the votingsystem uses numerical error codes for maintenance or repair by a trained technician, the text correspond-ing to the code is self-contained and displayed simultaneously. This is intended to reduce inappropriatereactions to error conditions, and to allow problems to be quickly and effectively corrected. As per VVSGVol. 1, ImageCast R© tabulators have been designed to be compliant with the following requirements:

• All error messages for which corrections will impact the recording and processing of votes, arewritten in a manner that is understandable to an election official who has been trained on thesystem use and operation, but has not undergone technical training with regards to servicing andrepair.

• The message cue for ImageCast R© tabulators clearly state what action needs be performed in theevent that a voter or operator response is required.

• The ImageCast R© tabulator design ensures that erroneous responses will not lead to irreversibleerrors.

• Nested error conditions are corrected in a controlled sequence so that the voting system will berestored to the state it was in before the first error occurred.

• ImageCast R© tabulators display and report critical status messages in English or through clearindicators. The voting system does not need to display non-critical status messages at the timethey occur. Voting systems may display non-critical status messages (i.e., those that do not requireoperator intervention) in the form of numerical codes for subsequent interpretation and reportingas unambiguous text.

4.5 Network Security

The EMS platform uses a private network infrastructure that is not connected to a public network of anytype (i.e. Internet). Therefore, network level security is structured on the level of the individual EMSserver and workstation components as well as on the level of the gigabit switch and private VLANs. Asa result, connectivity between system components is private and based on IP and MAC address filtering.In addition, all EMS system components have their own firewall and anti-virus installations, which helpprotect against offline malicious codes and attacks.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 111

4.6 System Availability and Continuity of Operation

As with any system relying on ICT technology, the system may experience unpredictable system com-VVSG 2005 vol I§2.1.5.1.b.iponent failures. Typical examples are power outages or system component failures, such as hard drive

failures, etc. The EMS system is designed to minimize the impact of such unpredictable situations.

Some of the protection measures designed within the EMS system are:

• Utilization of uninterruptible power supply (UPS) devices.

• Server with dual, redundant power supplies.

• Utilization of RAID disk arrays in each server system.

• Implementation of scheduled automated backups of database files.

• Redundant network interfaces between the EMS Application, EMS Database and EMS NAS storagedevices (not available/applicable in NYS version of EMS hardware configuration).

Note that the EMS system will generate, store, and report all error messages to the user as they occur.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 112

Appendices

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 113

Appendix A

EMS Error Messages List

VVSG 2005 vol I§2.1.3

This section lists error messages that will be displayed to the user should any faults occur while performingtasks in any EMS components. Next to each message is a brief description of the fault and any applicablesteps to rectify the problem.

A.1 EED Client Error Messages

The following list contains a set of error messages associated with potential problems in the EMS EED.

Error message Description Action to overcomeYou have to close the currentelection project to be able to cre-ate new election project

The system does not allow theuser to create a new project,while there is still a currentproject opened.

Close current project before cre-ating new project.

It is not allowed to modifyTemplate Keywords in currentproject status

It is not allowed to modifyTemplate Keywords in currentproject status.

You have to roll the project backto the definition or styling statein order to update template key-words.

System detected that anotherkeyword template is present, andwill be overwritten. Would youlike to continue?

Template keywords are alreadyimported into the system, andthey will be overwritten withnew one that are about to be im-ported.

The user should confirm this ac-tion if appropriate.

Could not open electoral countfile. Make sure the file is not cur-rently opened in Excel.

The import file with the countof electors per polling district(precinct) cannot be open.

If file is currently opened in Ex-cel, close it and re-try the action.

You have to set Election Eventaudio ballot type to: Full AudioBallot to be able to generate Au-dio Studio Definition File.

The type of project has to be setto Full Audio Ballot in order tobe able to generate Audio Studiodefinition file.

Set project to Full Audio Ballotand repeat action.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 114

You do not have permission tocreate the Audio Studio Defini-tion File in this project status.This action is allowed in ElectionProject Styling and Ballot Gen-erated only.

The user does not have permis-sion to create the Audio Stu-dio Definition File in this projectstatus. This action is allowed inElection Project Styling and Bal-lot Generated only.

The user should get the projectin either the Election ProjectStyling or Ballots Generated sta-tus and repeat action.

You do not have permission tocreate the Ballot on DemandDefinition File in this projectstatus. This action is allowed inBallots Generated in this projectstatus. This action is allowed inBallots Generated and Ready forElections status only.

The user does not have permis-sion to create the Ballot on De-mand Definition File in the cur-rent project status. This actionis allowed in the Ballots Gener-ated and Ready for Elections sta-tus only.

The user should get the projectin either the Ballots Generatedor Ready for Election status andrepeat action.

Are you sure you want to leaveElection Event Designer?

The user attempted to closeEED, the system is asking theuser for confirmation.


File file name is not valid reportpackage file

The user attempted to importa report package, but selected afile which is not a valid reportproject package.

The user should verify that theselected file is an actual reportpackage.

You have to close the currentelection project to be able toopen another election project

The system does not allow theuser to open another, while thereis still a current project opened.

Close current project beforeopening another project.

Please, check system parametersin Administration menu or con-tact EMS application adminis-trator

For the election project withname (project name), system pa-rameters are not set or not cor-rect. Check system parametersin Administration menu or con-tact EMS application adminis-trator.

Make sure that all project con-figuration setting are correct. Iffurther assistance is required,contact support staff.

Update process finished with er-rors.

Database structure update wasnot successfully synchronizedwith the latest model definition.

Contact technical support.

The election project structureyou are trying to update is out-dated. However, system is capa-ble of updating the project withsome limitations. If you continuewith this action, existing users,roles and permissions will be re-set to the default values. Are yousure you want to continue withthis action?

The system is asking for confir-mation from the user.


You do not have permission toImport the Audio Studio Defini-tion File in this project status.This action is allowed in ElectionProject Styling and Ballot Gen-erated only.

The user can only import au-dio studio definition files if thecurrent project is in either Elec-tion Project Styling or in BallotsGenerated state.

The user should get the projectin either the Election ProjectStyling or Ballots Generated sta-tus and repeat action.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 115

You don’t have appropriate per-mission to perform this opera-tion. You have to be a memberof EED Technical Advisor role tobe able to perform this action.

You don’t have appropriate per-mission to perform this opera-tion. You have to be a memberof EED Technical Advisor role tobe able to perform this action.

Log in as Techadvisor and repeataction.

Operation cannot be performedif the project is not in consistentstate.

Changing the security key is notallowed if database is not in con-sistent state.

Fix database inconsistenciesbefore initiating security keychange action.

Application start failed, strongname validation failed! Assem-bly name: ‘name’

The EED application failed tostart because assembly namefailed to pass verification of itsstrong name signature.


Application start failed, DLL orassembly is not authentic. As-sembly name: ‘name’

The EED application failed tostart because assembly name isnot authentic.


Application start failed, DLL orassembly not found. Assemblyname: ‘name’

The EED application failed tostart because assembly ‘name’ ismissing.


There is no validation in currentstatus

The current project status doesnot allow for the ‘Ready ForElection’ and ‘Closed’ validationprocess.

No action required.

Ballots will be created based onthe following parameters. PressContinue to continue the pro-cess. ‘list of project parametersincluded in requested action’

Informs the user that currentproject settings will be used inprocess of creating ballots.

Press ‘Continue’ to start ballotgeneration. Press ‘Cancel’ toabort the process.

Election Files will be createdbased on the following parame-ters. Press Continue to continuethe process. ‘list of project pa-rameters included in requestedaction’

Informs the user that currentproject settings will be used inprocess of creating election files.

Press ‘Continue’ to start electionfiles generation. Press ‘Cancel’to abort the process.

Failed archive data of project‘project name’

Informs the user that a backupof the election project could notbe created.


Error archiving of project. Informs the user that a backupof the election project could notbe created.


Are you sure you want to importmachine configuration?

Displayed when import machineconfiguration is started.

Confirm, if appropriate.

Application Server is not set. Informs the user that the appli-cation server configuration is notset correctly.


Configuration File is missing. Informs the user that the importof machine configuration files hasstarted but a configuration file ismissing.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 116

Ambiguous Configuration File. Informs the user that the importof machine configuration files hasstarted but there are multipleconfiguration files in the direc-tory.


Unable to verify file consistency!File is changed, or corrupted.

Informs the user that the im-port of machine configurationfiles failed due to a failure to ver-ify file consistency.


Could not delete static audiofolder on storage

Informs the user that the staticaudio folder could not be deletedon storage.


Definition file not found. Unableto proceed

Informs the user that the staticaudio definition file cannot befound.


Files in folder are not correct.Unable to proceed

Informs the user that the staticaudio files in folder are not cor-rect.


Definition file is not correct. Un-able to proceed

Informs the user that the staticaudio definition file is not cor-rect.


Number of files is not correct.Unable to proceed

Informs the user that the numberof static audio files is not correct.


Static bmd folder on storagecould not be deleted!

Informs the user that the staticbmd folder on storage could notbe deleted.


You need to restart system tomake settings take effect. ClickYes to restart now or No if youplan to manually restart later.

Informs the user that the savedsettings will only be applied oncethe system is restarted.

Confirm this action, if appropri-ate.

Unspecified error occurred.Please see log for details.

General error message Contact technical support.

Login failed. Wrong user nameor password.

Informs the user that the usercredentials were incorrect.

Try again and make sure that theusername and password are en-tered correctly.

Unable to connect to Databaseserver. Check Database ServerName and try again.

Informs the user that the connec-tion to database server failed.


You need to login to DB to getproject list!

The user has tried to access theproject list before logging in toDB.


You need to login to DB to openproject!

The user has tried to open theproject before logging in to DB.


You specified invalid projectname!

An invalid project name has beenentered.


Supplied credentials were in-valid!

The user has supplied invalid cre-dentials.


You need to login to DB to getNAS server name!

Informs the user that login to theDB must be performed before re-searching the NAS server name.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 117

You need to login to Project toget NAS server name!

Informs the user that login to theProject must be performed be-fore researching the NAS servername.


Top area is already created! The system attempted to createmore than one top area.


Cannot delete top subdivisiontype!

The user is not allowed to deletethe top subdivision type.

No action required.

There is no permission to mod-ify the Subdivision Type globalorder value. Reason: Electionproject status does not allow thisaction to be performed.

Re-ordering of subdivision typeis not allowed in the current elec-tion project status.

Change the project status toElection Definition state beforechanging order of subdivisiontypes.

Cannot delete subdivision (sub-division name) because it haschild subdivisions

The parent subdivision cannotbe deleted while it has child sub-divisions associated to it.

Delete all child subdivisions be-fore deleting the parent subdivi-sion.

Subdivision name is not set. The user attempted to createnew subdivision without settingthe name.

Specify the name of the subdivi-sion.

Subdivision name must beunique

The user attempted to createnew subdivision using an alreadyexisting name.

Specify a unique name of thesubdivision.

There is no permission to mod-ify the Subdivision global ordervalue. Reason: Election projectstatus does not allow this actionto be performed.

Re-ordering of subdivisions isnot allowed in the current elec-tion project status.

Change the project status toElection Definition state beforechanging order of subdivisions.

The length of name is too bignumber of characters used char-acters. Maximal length for nameis maximum allowed number ofcharacters characters.

The length of the name is aboveof the limit.

Shorten the length of the name.

There is no permission to mod-ify the Polling Subdivision globalorder value. Reason: Electionproject status does not allow thisaction to be performed.

Re-ordering of polling subdivi-sions is not allowed in the currentelection project status.

Change the project status toElection Definition state beforechanging order of polling subdi-visions.

It is not allowed to modify Keyin Id if the ballot has been cre-ated in one of the previous ballotgeneration cycles

The user is unable to modify thekey-in id of a ballot that has beencreated in a previous ballot gen-eration cycle.

No action required.

It is not allowed to modify Keyin Id in Ready for Election status

Changing the key-in id of a bal-lot is not allowed in the specifiedstatus.

Change the project status to theStyling state before modifyingthe key-in id.

Ballot number must be set A ballot number must be entered Specify a ballot number.Ballot number must be between1 and (max value)

The ballot number is outside ofthe allowed range.

Enter a value from the specifiedrange.

Error in creating ballot name.Check error log for details”

Error during parsing of ballot in-formation.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 118

Only Multiprocess Factor pa-rameter is allowed to modify inBallots Generated status”

The system found that the userdoes not have permission tochange the parameters.

Change the project status to theStyling state before modifyingthe project parameters.

Invalid characters in (field name)field

Invalid characters were enteredfor the field name.

Remove invalid characters fromthe name.

Value for (field name) is too big A value was entered that wasabove the limit.

Lower the value.

It is not allowed to modify Multi-process Factor in current electionproject status

The project is in a status whichdoes not allow for the modifica-tion of the multi-process factor.

Change the project status to anyvalue except Ready for Electionsand modify multi-process factor.

It is not allowed to modify Start-ing Ballot ID parameter in cur-rent election project status

The project is in a status whichdoes not allow for the modifica-tion of the Starting Ballot ID.

Change the project status to theDefinition state before modifyingthe Starting Ballot ID parame-ter.

Value for Starting Ballot ID is in-correct

Informs the user that this valueis incorrect.

Correct the value.

Value for Starting Ballot ID canbe between low value and highvalue

The value for Starting Ballot IDis outside the specified range.

Correct the value.

There are too many candidatesfrom (name) party

There are too many candidateswith the same party affiliationwithin the contest.

Make sure that the party affilia-tion of the candidates is correct.

The name must be set The name of the object has to beset before it can be stored.

Set the name of the object.

Disabled flag cannot be changedin this state

The user attempted to dis-able/enable a contest or choicebut this is not allowed in currentproject state.

Move the project to a state wherethis is allowed and re-try.

Not valid date of birth! The user attempted to enter aninvalid birthdate.

Correct birthdate.

You can’t change Subdivision incurrent status

The user attempted to changethe associated subdivision con-nected to a contest, but this isnot allowed in current projectstate.

Make sure that the project stateis set to Election Definition andre-try.

Only contest without prototypecan have candidates

The user attempted to add can-didates to a contest which has anassociated prototype - this is notallowed.

Either remove association to pro-totype, or do not create candi-dates for contest.

Only contest without candidatescan be linked to prototype object

The user attempted to link a pro-totype to a contest that alreadyhad associated candidates - thisis not allowed.

Either remove existing candi-dates, or do not attach a proto-type.

Administrative title must be set The administrative title of a con-test is a mandatory field.

Fill this field before attemptingto store the contest.

It is not allowed to modify num-ber of (write-ins/positions) inthe current election state

The user attempted to modify ei-ther the number of write-ins orpositions for a contest in a statethat does not allow it.

Make sure the project state isset correctly before attemptingto modify these fields.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 119

There is no permission to mod-ify the contest global order value.Reason: Election project statusdoes not allow this action to beperformed.

Re-ordering of contests is notallowed in the current electionproject status.

Change the project status to theElection Definition state beforechanging the order of contests.

This operation requires a definedSubdivision for this Contest

The system is attempting to per-form an action that requires thata subdivision is assigned to acontest.

Make sure all contests are as-signed to a subdivision.

This operation requires definedElector Groups for this Contest

The system is attempting to per-form an action that requires thatat least one elector group is as-signed to a contest.

Make sure all contests are as-signed to at least one electorgroup.

You must enter the value forContest Area External Id

The user attempted to store adistrict rotation without enteringall mandatory fields.

Make sure all mandatory fieldsare filled before saving an object.

You must enter the value for Ro-tation Area External Id



You must enter the value for Ro-tation Index



Value for Rotation Index is toobig

User has entered a value outsidethe range for the Rotation index

Choose a lower value.

Value for Rotation Index must begreater than 0

The user has entered a negativevalue for the Rotation Index.

Specify a value greater than 0.

It is only allowed to modifyRanked Choice Voting Parame-ters in Election Event Definitionstate

Modifying ranked choice votingparameters in an office is notallowed in the current electionproject status.

Change the project status to theElection Definition state beforemodifying object.

There is no permission to mod-ify the office global order value.Reason: Election project statusdoes not allow this action to beperformed.

Re-ordering offices is not allowedin the current election projectstatus.

Change the project status to theElection Definition state beforechanging order of office.

Changing attribute name is notallowed in current project status.attribute name can be defined inProject Definition state.

The user attempted to modify anattribute of an objec, which canonly be modified in the ProjectDefinition state.

Change the project status to theElection Definition state beforemodifying the attribute.

Office name is not set In process of defining offices, theuser has forgotten to specify anoffice name.

Specify an office name.

Office name must be unique In process of defining offices, theuser has specified a name thathas already been used.

Enter unique office name.

If party doesn’t create votingbox, other party, to which votewill go has to be set.

The user has to indicate at leastone party endorsement that hasa voting box.

The user has to indicate at leastone party endorsement that hasa voting box.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 120

There is no permission to modifythe Political Party global ordervalue. Reason: Election projectstatus does not allow this actionto be performed.

Re-ordering Political Parties isnot allowed in the current elec-tion project status.

Change the project status to theElection Definition state beforechanging the order of politicalparties.

There is no permission to modifyPolitical Party ‘For IndependentCandidates’ attribute. Reason:Election project status does notallow this action to be performed

The user attempted to modify anattribute of an object which canonly be modified in Project Def-inition state.

Change the project status to theElection Definition state beforemodifying attribute.

Project status is changed outsideof this application! Unable tochange state

The project status was changedunexpectedly.

Verify that no other instances ofEED are running.

Value for Election Event ID istoo big

This message is displayed whenprogram detects that the valuefor the Election Event ID is notvalid.

Enter correct value.

You don’t have permission tochange attribute name in projectstatus different than ElectionEvent Definition

The user attempted to modify anattribute of an object which canonly be modified in Project Def-inition state.


You don’t have permission tochange Election Event ID in(project state) project status

The user attempted to modifythe Election Event ID in a statein which it is not allowed.

Change the project status to anystate preceding Ready for Elec-tions and modify Election EventID.

It is allowed to modify Consol-idation Type only in definitionstate

The user attempted to modify anattribute of an object which canonly be modified in the ProjectDefinition state.

Change the project status to tjeElection Definition state beforemodifying the attribute.

It is allowed to modify BallotContent Creator only in defini-tion state

The user attempted to modify anattribute of an object which canonly be modified in the ProjectDefinition state.


It is not allowed to modifySet Tabulator Number Auto-matically property after creatingelection files

The user attempted to modifyan attribute of an object whichcan only be modified before theReady for Elections state.

Change the project status to anearlier state before modifying theattribute.

It is not allowed to modify ‘Re-generate Security elements be-fore generating election files’property after creating electionfiles.

The user attempted to modifyan attribute of an object whichcan only be modified before theReady for Elections state.


It is not allowed to modify (at-tribute name) property in Closedstatus

The user attempted to modifyan attribute of an object whichcan only be modified before theClosed state.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 121

There is no permission to Setproject parameters. Reason:Election project status does notallow this action to be per-formed.

This message is displayed whenthe user wants to change theproperty in a state which doesnot allow this operation.

Change the project status to acorrect state before modifyingthe attribute.

Invalid characters in Pause be-tween words field

This message is displayed whenprogram encounters an error inprocess of parsing the user’s in-put value.

Please correct invalid characters.

Cannot delete top ElectoralGroup

The user has tried to delete thetop electoral group.

No action required.

Abbreviation is mandatory The user attempted to storean object without entering allmandatory fields.


It is allowed to modify Groupname only in definition state

This message is displayed whenuser wants to change the prop-erty in state which doesn’t allowthis operation.

Change the project status to acorrect state before modifyingthe attribute

The (identifier name) is not set The value for this identifier can-not be null or an empty string.

Please set a value for this field.

Input values are not valid An incorrect value was enteredfor a given parameter.

Please set the correct value forthis field.

The (identifier name) must beunique

An incorrect value was enteredfor a given parameter.

Please set the correct value forthis field.

The (identifier name) is not set The value for this identifier can-not be null or an empty string.

Please set a value for this field.

Cannot delete default languageprofile

The user has tried to delete a de-fault language profile.

No action required.

The (attribute name) is not set The user attempted to storean object without entering allmandatory fields.


Attribute (name) cannot bechanged in Election Stylingstate.

The user attempted to modify anattribute of an object which canonly be modified in the correctstate.

Change the project status to thecorrect state before modifyingthe attribute.

Language Profile must be unique The name of each language pro-file has to be unique.

Specify a unique name for thelanguage profile.

It is not allowed to modify ob-ject.

The user has tried to modify anobject that the program does notallow to be changed.

Change the project status to thecorrect state before modifyingthe attribute.

First name must be set The program has detected thatthe first name is not set.

Please set the name.

Last name must be set The program has detected thatthe last name is not set.

Please set the name.

Name of Programming group hasto be set

The name of the programminggroup must be set.

Set the name field.

Value for Tabulator Numbermust be greater than 0

The user has not set the tabula-tor number value.

Set tabulator number value.

Value for Tabulator Number istoo big

The value has exceeded the max-imum.

Lower the tabulator numbervalue.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 122

Tabulator (name) has gener-ated election files, it cannot bechanged

The user has tried to generateelection files for a tabulator thatalready contains election files.

Skip this tabulator in the processof manually generating electionfiles.

You must enter User name The user has tried to create atabulator user without definingthe User Name.

Define a User Name.

User name already in use The user has tried to create atabulator user with a user namethat is already in use.

Enter a unique user name.

You must enter First name The user has tried to create atabulator user without defining aFirst Name.

Enter the First Name.

You must enter Last name The user has tried to create atabulator user without defining aLast Name

Enter the Last Name.

Cannot initialize communication The system is unable to contactthe application server.

Check the application server con-nection parameters.

Synchronize drawing ballots callfailed.

The call to synchronize actionfailed,


Preview ballot call failed. The call to preview ballot func-tion failed.


Rename ballots call failed. The call to rename action on theserver failed.


Archive project call failed. The call to archive action on theserver failed.


Restore project call failed. The call to restore action on theserver failed.


Create xml model call failed. The call to action for creating anXML file with the system modeldata failed.


Creation of transform data callfailed.

The call to transformation func-tion failed.


Setting party affiliation callfailed.

The call to action for settingparty affiliation failed.


Getting of initial configurationdata call failed.

The call to action for preparingconfiguration data failed.


Ballot(s): (list of ballots) are po-tentially used on some tabula-tors. If you proceed, system willnot be able to tabulate results forthem. Do you want to continue?

The user has tried to regenerateballots that are in use.

This error can occur in LastMinute Definition process. Se-lect ‘Yes’ to regenerate ballots.Select ‘No’ to skip those ballotsduring the regeneration process.

There is no permission to assignvalues. Reason: Election projectstatus does not allow this actionto be performed.

The user has tried to assign val-ues to specified object, but theproject status does not allowthat action.

Either do not set the values, orreturn to previous project statusand repeat the action.

Office is not set. Informs the user that an office isnot set for the creating contestaction.

Set an office for this action

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 123

Specified office does not have as-signed subdivision

Define subdivisions for specifiedoffice.

Review the election definitionand make sure that subdivisionshave been defined.

Contest (name) cannot be cre-ated, name is longer than 128characters

The specified contest name is toolong.

Modify election definition pa-rameters so that the generatedcontest name will be shorter.

Subdivision type is not set. The office for which contest cre-ation was initiated did not haveits subdivision type set.

Make sure that offices have theirsubdivision type set.

System detected existing con-tests for the office(s): If you con-tinue all contests and candidatesfor the office will be deleted.

The selected offices already con-tain contests and, if the processcontinues, existing contests willbe deleted.

Select Continue to delete exit-ing contests and create new ones.Select Cancel to abort the action.

No permission to create contest The user role does not allow thisaction.

Log in with a role that allows thecreation of contests.

Language profile is not set! An action was initiated that re-quires that a Language Profile tobe set.

Set a Language Profile and re-peat the action.

Purpose of the template must beset.

The purpose of template filemust be specified before saving.

Select a purpose from list and re-peat the action.

Language of the template mustbe set.

The language for template filemust be specified before saving.

Select a language from list andrepeat the action.

No permission to delete objectsbecause they are placed on al-ready rendered ballots.

The delete action for ballot ob-jects is not allowed because theobjects are in use.

Avoid this action, or return toprevious state of the electionproject and repeat action

You have to go back to ProjectDefinition or Last Minute Defi-nition in order to disable choice.

The current project status doesnot allow disabling choices.

Change project status to Defini-tion or Last Minute Definition

You are about to disable choice(name). This action cannot bereversed, without going back tothe definition state. Are you sureyou want to proceed?

The disable choice action is acti-vated.

Confirm action or choose cancelto abort action.

You have to go back to ProjectDefinition or Last Minute Defini-tion in order to disable contest.

The current project status doesnot allow disabling contests.

Change the project status to Def-inition or Last minute definition

You are about to disable contest(name). This action cannot bereversed, without going back tothe definition state. Are you sureyou want to proceed?

The disable contest action hasstarted.

Confirm action or choose cancelto abort action.

Contest should have at least oneelectoral group assigned!

The newly created contest doesnot have an electoral group as-signed to it.

Define electoral group and repeatthe save action.

Subdivision is not set! An action was initiated that re-quires that a subdivision to beset.

Make sure that a subdivision hasbeen set.

Remove choices or set that con-test doesn’t have prototype.

The user has created a ContestPrototype, but has assigned acandidate to the contest.

Remove candidates or specifythat the contest type is regular.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 124

Setting party is allowed forClosed Primary Elections

The user attempted to automati-cally set party affiliation for can-didates. This only works in aclosed primary.

Review election definition tomake sure that the election typeis set correctly.

Setting party is allowed inProject Definition only

The party cannot be set in thecurrent project status.

Avoid this action, or return toprevious status of the electionproject and repeat the action.

Precinct with this name alreadyexists.

A polling subdivision (Precinct)with the specified name alreadyexists in the project.

Specify a different name and re-peat the action.

It is allowed to import district ro-tations only in Definition state.

The district rotation import ac-tion is not allowed in the currentproject status.

Return the project to the Defini-tion state and repeat the action.

You cannot save the District Ro-tation with same values for Con-test Area Id and Rotation AreaId

Different values for Contest andArea identifier must be enteredbefore creating the rotation.

Enter different values for theArea and Contest identifiers.

You cannot save the District Ro-tation with the given ContestArea Id and Rotation Area Idbecause a District Rotation withthe same values for those IDs al-ready exists in election projectdatabase.

The specified combination of in-put data is already in use.

Change the input values so it isunique.

Default tabulator user passwordvalue is not correct. It has to benumerical, 8 digits.

The entered tabulator user pass-word in not valid.

Enter the specified tabulatoruser password which is 8 digitslong.

Maximum deviation has to be avalue between 0 and 100.

The rotation deviation must bein defined boundaries.

Re-evaluate assigned rotations tocontests and make sure that theeach possible rotation value isdistributed fairly.

Invalid characters in maximumdeviation field.

Entered rotation deviation val-ues contain invalid characters

Only use digits for defining devi-ation value

There were no Elector Groupscreated

The system attempted to createelector groups for each selectedpolitical party. There were noparties selected.

First select at least one politi-cal party before initiating the ac-tion.

It is not allowed to delete the de-fault elector group.

The delete action is not allowedfor default elector group.

No action required.

Static text record for the chosenlanguage profile and static texttype has already been created.

Static text for specified input pa-rameters already exist.

No action required.

You must generate Password The password for newly-createdtabulator user is not generated.

Use the Generate button to cre-ate a password and repeat thesave action.

Etalon object is not valid. Basic objects for creating DCFsettings are not valid.


Data structure is not valid. Basic objects for creating DCFsettings are not valid.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 125

For selected tabulators electionfiles and keys will be regenerated.All previous result files will be in-valid. Do you want to continue?

The regenerate action will deleteexisting tabulator files and createnew files.

Select ‘Yes’ to start the regener-ation action. Select ‘No’ to abortthe action.

This action is only allowed inReady For Election state

The current project status doesnot allow the selected action.

Make sure that the action is per-formed in the correct state.

No permission to perform actionin this project status

The current project status doesnot allow the selected action.

Make sure that the action is per-formed in the correct state.

Tabulator names list have cre-ated election files. Do you wantto continue?

Some of selected tabulators forthe delete action have generatedelection files.

Select ‘Yes’ to execute the deletetabulator action. Select ‘No’ toabort the action.

Please select drive containingCompact Flash card. The cardin the drive will be initialized (alldata will be erased).

The process of creating a backupcard will format the existing cardand that a drive should be se-lected.

Select the drive containing thememory card that should be ini-tialized.

Unable to find CF Card device. The system was unable to find amemory card reader containing acompact flash card.

Check that the card is in the cardreader.

Tabulator adapter for type (typename) could not be loaded.

The necessary data for creatingelection files are missing.


CF Card has been initialized,please remove.

The process of creating an elec-tion card is finished.

Remove card.

Checksum of copied file (filename), does not match checksumof original file.

After copying all election filesto the memory card, the systemverifies that all files were copiedsuccessfully. This message indi-cates that a file was not copiedsuccessfully

Repeat programming of thememory card, if the same prob-lem occurs again replace thememory card with another andmake sure that the old memorycard is not used again.

Election files do not exist for cur-rent tabulator.

Election files are missing for thespecified tabulator and that pro-cess of creating election card isaborted.


Error writing files: (error details) Programming of memory cardfailed.


There are no files to be copiedto CF card. Please remove thecard.

Programming of memory carddid not find any election files forthe tabulator.


Tabulator files successfullycopied to CF card. Pleaseremove the card.

Programming of memory cardwas successful.

Remove card.

More than one inner xml file The file for the import audiocomponent is not correct.

Check the origin of the file orcontact technical support.

More than one inner zip file The file for the import audiocomponent is not correct.

User should check origin of file orcontact technical support

More than one language in file Inform user that file for importaudio component is not correct.


Error accessing target folder. The target folder for storing au-dio import files cannot be ac-cessed.

Check the application server con-nection parameters, or contacttechnical support.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 126

Error extracting file The selected file for import can-not be opened.


Error creating process. The import audio package filecannot start.


Unable to delete (file name) fileon NAS

The import audio package pro-cess was unable to remove thespecified file from Network At-tached Storage disk.


Unable to create objects! The audio editor cannot createthe necessary audio components.


Problem loading file (error de-tails)

Problem loading file. See details and contact technicalsupport.

Input file is not correct. The selected audio file for importis not correct.

Check the origin of the file forimport, or contact technical sup-port.

Problem saving file. The system was unable to storethe selected audio file.


Unsupported file format! The selected audio file for im-porting is not in the proper for-mat.

Check the origin of the file forimport, or contact technical sup-port.

Problem playing file. The system was unable to playthe stored audio file.


It is not allowed to modify pa-rameters displayed in ‘Setting’tab in current election projectstatus.

Ballot settings cannot bechanged in the current electionproject status.

Avoid changing ballot style pa-rameters, or return to electionstatus that allows the operationto be performed.

Link to party will be deleted.Are you sure you want to pro-ceed?

The connection between candi-date and party will be removed.

Select Yes to continue. Select Noto cancel.

Choice is not set! The action for creating choiceadditional info is missing its par-ent choice.

Select choice to create additionalpersonal info.

Personal Info will be deleted.Are you sure you want to pro-ceed?

Choice personal info data will beremoved.

Select Yes to delete choice per-sonal info. Choose No to cancelthe action.

Link to line will be deleted. Areyou sure you want to proceed?

The connection between candi-date and ballot line will be re-moved.

Select Yes to delete the connec-tion between candidate and bal-lot line. Choose No to cancel theaction.

Contest is not set! The action for assigning choicesto a contest is missing a parentcontest.

Select a contest for the assignedaction.

Reordering is only allowed whenall contest headings are listed.Please clear contest headingname field and press Search but-ton.

The reorder process cannot beperformed because search crite-ria is applied on contest list.

Clear all search criteria and re-peat reorder action.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 127

It is not allowed to link Lan-guage Profile to Contest Headingin election status name status.

The requested operation for con-necting a Language Profile andContest Heading is not allowedin the current election status.

Revert the election project to anearlier state or avoid this action.

It is not allowed to unlink Lan-guage Profile and Contest Head-ing in (election status name) sta-tus.

The requested operation for dis-connecting a Language Profileand Contest Heading is not al-lowed in the current election sta-tus.


It is not allowed to link Contestto Contest Heading in (electionstatus name) status.

The requested operation for con-necting a Contest and ContestHeading is not allowed in the cur-rent election status.


It is not allowed to unlink Con-test and Contest Heading in in(election status name) status.

The requested operation for dis-connecting a Contest and Con-test Heading is not allowed in thecurrent election status.


The USB port number must behigher than 0!

The entered USB port numbercan’t be 0.

Enter the correct number of theUSB port on the computer.

The entered number is not validfor port!

The system cannot detect a USPport for the provided number.

Enter the correct number of theUSB port on the computer.

Security key has not been foundon the USB port number.

The system is unable to detect asecurity key on the specified USBport.

Plug the Security Key device inthe specified port or change theport number.

This operation could take a fewminutes. Would you like to con-tinue?

Informs the user that the pro-cess of automatically detectingthe Security Key could take sometime.

Select Yes to start the automaticdetection process. Select No tocancel the action.

Security key has not been foundon any port!

No Security Key was detectedduring the automatic detectionprocess.

Check the Security Key connec-tion or contact technical support.

Prefix is not valid. The prefix value for the new Di-vision name is not valid.

Enter a valid prefix text.

Postfix is not valid. The postfix value for the new Di-vision name is not valid.

Enter valid postfix text.

Range is not valid! The specified number range forcreating Divisions is not valid.

Enter valid values for the range -the start index must be less thanthe end index.

Elector count will be deleted.Are you sure you want to pro-ceed?

The specified elector count valuewill be deleted.

Select Yes to continue, or No tocancel the action.

There are no unlinked ElectorGroups for this Polling Subdivi-sion

There are no available ElectorGroups for the assigned action.

No action required.

Reordering is only allowed whenall offices are listed. Please clearoffice name field and press Searchbutton.

The reorder process cannot beperformed because search crite-ria is applied on contest list.

Clear all search criteria and re-peat the reorder action.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 128

Link to choice will be deleted.Are you sure you want to pro-ceed?

The connection between choiceand party will be deleted.

Select Yes to continue or No tocancel the action.

Link to line will be deleted. Areyou sure you want to proceed?

The connection between ballotline and party will be deleted.


Suffix is not valid. The postfix value for the newPolling Subdivision name is notvalid.

Enter valid suffix text.

Device setting property must bedefined!

Tabulator device settings mustbe defined before the creationprocess can continue.

Select device settings from thelist and repeat the operation.

Counting Group must be de-fined!

The Tabulator Counting Groupmust be defined before the cre-ation process can continue.

Select a Counting Group fromlist and repeat the operation.

Range is not valid! The specified number range forcreating a Polling Subdivision isnot valid.

Enter valid values for this range -the start index must be less thanthe end index.

Prefix contains forbidden text! The prefix value for the newPolling Subdivision name is notvalid.

Enter valid prefix text.

Postfix contains forbidden text! The postfix value for the newPolling Subdivision name is notvalid.

Enter valid postfix text.

Link to Polling Subdivisions willbe deleted. Are you sure youwant to proceed?

The link between a specifiedPolling Subdivision and Lan-guage Profile will be deleted.


Ballot Style must be set. The Ballot Style must be set be-fore closing the Election Proper-ties Dialog.

Select the Ballot Style tab in thedialog and a specified ballot stylefrom the list.

You cannot change the electionproject status to ‘Closed’ sta-tus if the current election projectstatus is different than ‘Readyfor Elections’.

The project cannot be closed inthe current project status.

Do not try to set project statusto ‘Close’.

You cannot manually changethe status of election project to‘Project status name’. Electionproject state will be automati-cally changed to the next levelafter all activities for the currentstate are performed.

The project status cannot man-ually be changed to higher state.

No action required.

You do not have permission tochange election state.

User permission does not permitchanging the project status.

Log in with a role that allows thisoperation.

Are you sure you want to closethe project?

Asks the user to confirm the de-cision to set project status to‘Close’.

Select Yes to close the project.Select No to cancel the action.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 129

By changing the state of the elec-tion project from higher to lowerstate level, some election entitieswill be affected. (List of changes)

The user has decided projectstatus to lower level and someproject entities will be deleted inthe process. The message listsentities that will be deleted andasks for confirmation.

Select ‘Continue’ to change theproject status. Select ‘Cancel’ toabort the action.

This action will close all openeddialogs.

The required action will close allopen dialogs.

Select OK to close all opened di-alogs and continue. Select Can-cel to abort the operation.

Style setting could not be per-formed

The selected ballot style settingscould not be applied.


Selected Election Event Type:(name) is not supported. Pleasechange settings

The selected election event typeis not allowed for this ballotstyle.

Select a different election eventtype.

Are you sure you want to regen-erate all security values in appli-cation?

User confirmation is requestedbefore the system resets all secu-rity elements in project.

Select OK to close the dialog andcontinue. Select Cancel to abortthe action.

System detected that ProjectProperties are changed. PleaseApply changes before starting re-generation process.

All changes must be saved beforestarting the regeneration pro-cess.

Save all changes.

System has detected that a cryp-tographic key exchange card hasalready been created for the ac-tive election project. If you se-lect Yes, system will re-generatecryptographic keys and initiatea creation of new cryptographickey exchange card. If you selectNo, this operation will be can-celled.

The current project alreadycontain cryptographic exchangekeys.

Select Yes to re-generate crypto-graphic keys and initiate the cre-ation of a new cryptographic keyexchange card. Select No to can-cel the operation.

Please insert memory card to beprogrammed as a cryptographickey exchange card. The mem-ory card will be initialized andprogrammed with the new set ofcryptographic keys.

The system is asking the user toinsert the memory card that willbe programmed.

Insert the memory card andpress the OK button.

Cryptographic keys will becopied now.

The process of saving Crypto-graphic keys will start. Press OKto continue with the operation.Press Cancel to abort the opera-tion..

Press OK.

Cryptographic key exchangecard has been successfully cre-ated. Click the OK and ejectthe card.

The new cryptographic key ex-change card has been success-fully created.

Press OK.

First You must create Exchangecard.

The necessary security elementsare missing and the process ofcreating a copy of the exchangecard cannot continue.

Create the initial exchange cardbefore continuing with the copyprocess.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 130

Please insert the previously pro-grammed cryptographic key ex-change card you want to copy.Insert the card and click the OKbutton to proceed.

Prompts the user to insert theinitial exchange card.

Insert the initial exchange card.

Provided card is not created inthis project.

The inserted exchange cast is notcreated in current process andthe operation cannot continue.

Provide the proper exchangecard.

A copy of the original crypto-graphic key exchange card hasbeen successfully created. Pleaseeject the card. You can cre-ate multiple copies of the cryp-tographic key exchange card.If you select Yes, you will beprompted to create another copyof the original cryptographic keyexchange card. If you select No,this dialog will be closed.

Informs user about the proce-dure for creating a copy of theexchange card.

Follow the instructions in themessage.

Please insert a memory card tobe programmed as a copy ofthe cryptographic key exchangecard. The memory card will beinitialized and programmed withthe original set of cryptographickeys.

The data from the original ex-change card will be saved on anew memory card.

Insert a memory card.

Necessary files missing The system has detected thatnecessary exchange files are miss-ing on provided exchange mem-ory card.

Provide the proper exchangecard.

Invalid ICP private key The provided exchange card con-tains an invalid cryptographykey.

Provide the proper exchangecard or contact technical sup-port.

Invalid EMS public key The provided exchange card con-tains an invalid cryptographykey.

Provide the proper exchangecard or contact technical sup-port.

Please insert the previously cre-ated cryptographic key exchangecard. Insert the card and clickthe OK button to proceed.

Prompts the user to insert theinitial exchange card


Could not find tabulator withkey exchange id: (number)

The tabulator with specifiedidentifier does not exist inproject.

Check the exchange card originor contact technical support.

Key file not found for tabulator(name)

The data tabulator with thespecified name does not exist inthe project.


Error during processing tabula-tor: (name)

Informs the user that errors oc-curred during the process of im-porting cryptography keys formexchange card.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 131

Please insert memory card to beprogrammed as a cryptographickey exchange card. The mem-ory card will be initialized andexchange data will be saved.

Prompts the user to provide anempty memory card for pro-gramming.


Card will be prepared now. Informs the user that the systemhas detected the memory cardand that the process of savingfiles will start

Select OK to close the dialog andcontinue. Select Cancel to abortthe action.

Suffix is not valid. The postfix value for the newtabulator name is not valid.

Enter valid suffix text.

Voting location Name or ID mustbe part of name!

The composed tabulator namemust contain voting locationnames or IDs.

Specify the correct element forthe name.

Device setting property must bedefined!

The device setting name must beprovided.

Select one device from the list.

Counting Group must be de-fined!

The counting group must be pro-vided.

Select one counting group fromthe list.

Cannot create new Voting Loca-tion

The process of creating a newvoting location failed.


Invalid characters entered.Please try again.

Some of characters in the votinglocation name are not allowed

Delete invalid characters.

Insert Security Key device. Prompts the user to insert the se-curity key into the security keyreader.

Presses OK to continue with pro-gramming the security key ac-tion. Press Cancel to abort theoperation.

This action is not allowed in cur-rent security mode.

Programming the exchange cardis not allowed in current cryptog-raphy mode.

Set security mode to Mode 2, orskip this action.

Process of creation of tabulatormust be finished to proceed withthis action.

The prerequisites for this actionare missing.

Enter the tabulator name andsave the object before repeatingthis action.

Please insert the previously cre-ated cryptographic key exchangecard. Insert the card and clickthe OK button to proceed.

Prompts the user to insert theoriginal exchange card beforecreating a copy.

Provide the original exchangecard and press OK. Press Can-cel to abort the action.

Card does not contain key forthis tabulator

The provided memory card is nota valid exchange card.

Provide a valid exchange card orcontact technical support.

Please insert the exchange card.Insert the card and click the OKbutton to proceed.

Prompts the user to insert theinitial exchange card.

Insert the memory card andpress OK.

Error occurred during creation ofinformation file!

Informs the user that an error oc-curred during the creation of theTabulator User information file.


Unable to verify file consistency!File is maybe changed, or cor-rupt.

Informs the user that the pro-vided exchange card contain in-valid files.

Provide a valid exchange card orcontact technical support.

Generation of preview is alreadyrequested.

Informs the user that a ballotpreview file has already been re-quested.

No action required.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 132

File was not created on server Informs the user that generationof the ballot preview file failed.


Error generating drawing ballotpreview

The generation of the ballot pre-view file failed.


File name must be set Informs the user that the importor export file name must be spec-ified before starting the exportprocess.

Enter the import or export filename.

Separators must be different The defined separator of the im-port/export file is not correct.

Define a different separator valuefor the pair separator value.

Password must be 6-12 charac-ters long and must contain let-ters and numbers!

Informs the user of the requiredpassword format.

Enter a proper password accord-ing to message’s system.

Password must be 6-12 charac-ters long!

Informs the user of the requiredpassword format.

Enter a proper password accord-ing to message’s system.

This role can’t be deleted. The selected role cannot bedeleted because it is a systemrole (protected role).

No action required.

There are users that own thisrole. Please reconnect thoseusers before deleting role

The selected role cannot bedeleted because it is in use.

No action required.

Missing source file The template file for the user ar-gument is missing.


There is no permission to printconfirmation file

User permission does not allowthe specified action.

Log in with the proper role andrepeat the action.

Error creating role. An error occurred while the sys-tem was trying to create a role.


Cannot modify system role. The system role cannot bechanged.

No action required.

You must enter role name. The role name must be provided. Fill in all mandatory fields.This role already exists. Informs the user that a role with

the specified name already exists.A unique role name should befilled in.

Invalid password format. The provided password does notfulfill security requirements.

Change the password to fulfillthe requirements.

Please enter username. A username must be provided. Enter a username.This username already exists. The specified username is al-

ready in use.Enter a different username.

Problem loading file. File istoo big (limit depends on sys-tem properties, such as availablememory).

The provided import file is toobig.


Problem loading file. (error de-tails)

The provided audio file is notcorrect. The message depends onthe Windows error mechanism.


Import of Audio Files is alreadyrequested.

The import audio files process isalready active.

No action required.

Saving File Error : (error details) The audio file storing processfailed.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 133

Project with the same name al-ready exists. Please choose an-other project name!

The specified project name is inuse.

Enter a different project nameand repeat the operation.

Project (name) has been incor-rectly defined. Please fill in thecorrect project information andtry again.

The new project data are notvalid.

Provide proper project parame-ters and repeat the action.

You did not fill in all requiredfields: (list)

Informs the user of missing datain project definition.

Provide all values requested forthe creation of a new project.

Content for header has modifieddimensions

The ballot rendering module wasnot able to fit all header contentin the specified dimensions.

Review size of header and in-crease if possible, or re-organizethe content to fit better.

Contest (name) has invalid span,larger than number of columns

Indicates that the specified con-test has a span larger than thenumber of existing columns.

Reduce the column span for in-dicated contest.

Contest X has invalid span. Indicates that the contest X hasan invalid span.

Modify the column span for indi-cated contest.

No Drawing Workbench filefound

Indicates that the workbench filefor drawing cannot be located.


No required paper dimensions Message indicating that the re-quired paper dimensions are notpresent.

Ensure all dimensions have beenentered.

Referendum question ‘name’could not be rendered

The ballot rendering module wasnot able to render the specifiedreferendum question.

Review styling parameters andre-try.

Referendum question (name)could not be rendered becausethere is no space on ballot

The ballot rendering module wasnot able to render the specifiedreferendum question because oflack of space on the ballot.

Review styling parameters andre-try.

Referendum question (name)could not be rendered becausethe number of units is too low

The ballot rendering module wasnot able to render the spec-ified referendum question, be-cause the number of markers istoo low.

Increase the number of markersfor this contest and re-try.

Unable to find font (name) in anystyle

Indicates that the specified fontcannot be found in any font style.

Make sure that this font is in-stalled on the system.

Failed to draw text: ‘text’. ‘errormessage’

The rendering module failed torender the specified text becauseof an exception specified in theerror message.


There is already object with suchname

This message indicates that therendering module encounteredproblems with the layout the var-ious objects.


This template does not containGridInfo object

This message indicates an inter-nal error during rendering.


Header for ballot is too wide This message will be displayedwhen the ballot header is toowide.

Make the ballot header less wide.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 134

There is no support for landscapeballot styles with rank choicevoting

Ranked choice voting ballotstyles do no support landscapeorientation.

No action required.

Invalid signature for file (errordetails)

The rendering module attemptedto load a DWF file and found itto have an invalid signature.


Progress Information This message is displayed on theproject restore form while theproject is restoring.

Restoring the database file... The project is being restored. Contact technical support.Restore database error: (errormessage)

Updating EMS Applicationserver configuration.


Election project (name) has beensuccessfully restored. To con-tinue, click the OK button below.Extract project package error...(error message) Error deletingremote folder: (error message)(folder name)

The remote folder could not bedeleted.


Empty project name is invalid Shown during project restora-tion.

Set non-empty for the existingproject copy.

Error remote saving file: (errormessage)

Shown during project restora-tion. Caused by a lack of priv-ileges.


Copy project package error...(error message)

The project file cannot be copied. Contact technical support.

Extract project package error...(error message)

The project could not be ex-tracted. The file corrupted orthere are insufficient privileges towrite it.


Create process error... The process for extractingproject data could not becreated.


Remote object is null. The connection to the applica-tion server cannot be established.

Check if the application server isoperational.

Connection to server failed.Please check your settings.

The connection to the applica-tion server cannot be established.

Check if the application server isoperational.

Error loading PackageInfo file. The selected file was not a pack-age file created by EMS.

Select the proper package file.

No permission to perform thisaction.

The EED user does not have per-mission to perform the requiredaction.

Log in with the required pass-word and retry the operation.

Action Failed: (failure reason) Informs the EED user that therequired action has failed.


Error connecting: error message The ftp connection could not beestablished.


Operation failed. Informs the EED user that re-quired operation failed to com-plete.

Check the log file for the detailsand contact technical support.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 135

Failed to archive project name ofproject.

Informs the EED user thatarchiving of the project failed.


Invalid arguments. Informs the EED user that theinput for the ballot preview is in-valid.


Rename ballot command failed. An attempt to rename the ballothas failed.


Ballots renaming failed. An attempt to rename ballotshas failed.


Access to file is denied: (filename)

The system could not access thefile with the given name.

Check if file exists or if it is open.

Restoring of database failed. Informs the EED user thatdatabase restoration failed.

Check the log file for the detailsand contact technical support.

Crypto Algorithm Key could notbe created

Encryption key could not be cre-ated.


Invalid Public key for import. Public key could not be im-ported.



Informs the EED user that thecryptography key could not becreated.



Informs the EED user that thecryptography key could not becreated.


Signing of the XML file failed. Informs EED user that the sign-ing of a particular file failed.


Unable to sign file. Informs the EED user that thesigning of a particular file failed.


Crypto Algorithm could not becreated, file system error.

Informs the EED user that thecrypto file could not be created.


Crypto Algorithm could not becreated, chain error.

Informs the EED user that thecrypto file could not be created.


Connection to database failed.Please check parameters.

Informs the EED user that thedatabase credentials are incor-rect.

Check whether the databaseserver is up and running, startApplication Server Manager ap-plication and set the correct cre-dentials.

Empty Election project databasecreation has failed: (error mes-sage).

Informs the EED user thatproject creation failed due to thegiven reason.


EMS database user assignmenthas failed: (failure reason)

Informs the EED user that userassignment failed due to thegiven reason.


Data tables and custom viewscreation has failed: (failure rea-son)

Informs the EED user that cus-tom views have not been created.


Storing of default data to EMSdatabase has failed: (failure rea-son)

Informs the EED user about thefailure of default EMS data.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 136

Project creation finalization hasfailed: (failure reason)

Informs the EED user that the fi-nalization of the election projecthas failed.


All tasks have not been com-pleted successfully.

Informs the EED user that thereare some problems in project cre-ation.

Check the log file and contacttechnical support.

Failed to backup project (projectname) Error: (failure reason)

Informs the EED user that thebackup of the project failed.

Check if the database server is upand running.

Failed to archive project (projectname)

Informs the EED user thatproject archiving has failed.


Failed to copy project (projectname) to location (target path)

Informs the EED user thatproject copying has failed.


Failed to backup (project name)project.

Informs the EED user thatproject backup creation failed.


Error: (reason) Target: projectproject name

Informs the EED user of an er-ror that appeared during projectcompressing.


Failed to delete project (projectname)

Informs the EED user that aproject could not be deleted.


Unzip file (file name) failed. Informs the EED user about afailure in unzipping the project.


Error restore database (projectname).

Informs the EED user about afailure during database restora-tion.


Login Failed. Reason : ¡loginfailure reason¿

Informs the EED user of adatabase login failure.


Creation of new project failed. Informs the EED user of aproject creation failure.


No data for binary serialization. Informs the EED user of prob-lems in cloning DCF data struc-tures.


Invalid path for binary files. Informs the EED user of prob-lems in cloning DCF data struc-tures.


Invalid input. Informs the EED user of prob-lems in updating DCF datastructures.


Upgrading can only be applied toroot nodes.

Informs the EED user of prob-lems in updating DCF datastructures.


Endianness must be set to bothnodes and equal.

Informs the EED user of prob-lems in updating DCF datastructures.


Port is not set. Informs the EED user of a prob-lem programming iButtons.


There are nothing to write. Informs the EED user about of aproblem programming iButtons.


Error writing data to SecurityKey.

Informs the EED user of an errorin writing data to security key.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 137

Could not detect security key. Informs the EED user of a prob-lem detecting security key.


Error verification of data on Se-curity Key

Informs that EED user thatproblems occurred in verifyingthe security key.


Line (line number) contained Ro-tation Index that was an invalidinteger: (invalid integer)

Informs the EED user about in-consistent rotation data.


Line (line number) contained(list of columns), while (list ofcolumns) were expected.

A column list mismatch has oc-curred during district rotationfile importing.

Check the import file format.

Line (line number). Values forContest Area Id and RotationArea External Id cannot be thesame.

Contest Area Id and RotationExternal Id cannot be the samein the single record.

Check the import file.

Line (line number) contains thecombination of Contest Area Idand Rotation Area External Idwhich is not unique in the se-lected import file.

Import data is not valid. Check the import file.

Error receiving Security Keydata.

Occurs during the creation of theXML file used for programmingCF cards.


Some links are not created dueto an error. Check log file for de-tails.

Occurs when database batchcommand is executed.


Invalid input type. Internal error during batch com-mand execution.


Batch creation failed. Occurs on unsuccessful batchcommand execution.


Batch creation failed: Tabulatorname must be unique.

Notifies the user of an unsuccess-ful tabulator creation.

Set a unique tabulator name.

Failed to delete directory for(tabulator number) tabulator.Error Message: (error details)

Occurs on unsuccessful batchdeletion of tabulators.

Check whether the files in thedirectory are already used orlocked.

Tabulator folder deletion failedfor (tabulator count) tabula-tor(s). For more details checkthe error log.

Occurs on unsuccessful batchdeletion of tabulators.

Check whether the files in thedirectory are already used orlocked.

Import failed. (error details) Displayed in case of error aftermass data change process.


Exporting data Displayed in progress bar duringmass data change.

Missing replacement data for(item) line line number

Displayed in case of error aftermass data change process.

Check import file.

Duplicated item (item id) Displayed in case of error aftermass data change process.

Check import file.

Input file problem: (error de-tails) Please check import set-tings (separators).


Check import file.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 138

Unable to get connection in-stance.


Check import file.

This field does not exist. Displayed in case of error dur-ing data validation in mass datachange process.

Check import file.

Value must be integer. Displayed in case of error dur-ing data validation in mass datachange process.

Check import file.

Value must be in proper DateTime format

Displayed in case of error dur-ing data validation in mass datachange process.

Check import file.

Value must be boolean Displayed in case of error dur-ing data validation in mass datachange process.

Check import file.

Error during export action! Occurs on unsuccessful export ofproject data to XML.


XML file is not valid! Selected file does not have a validxml format.

Select the correct file.

Error creating role. An error occurred during cre-ation of custom role.


Error creating info file Occurs on printing user’s creden-tials.


Problems with NAS disk. Pleasecall technical support.

Indicates a problem accessingNAS server.


File not found Occurs when trying to renamefile on NAS.

Check log file and contact tech-nical support.

Unable to create command Occurs when trying to create re-port on server.


Unable to create server Occurs when trying to create re-port on server.


Error coping file Occurs when copying large fileson NAS.


Unable to create directory (path)Please check folder path andmake sure you have permissionto write to it.

Occurs when copying files onNAS.


Unable to save file: (file path)Please check file path and makesure you have permission to writeto folder.

Occurs when copying files onNAS.


Remote error. Occurs when trying to accessserver’s file manager.


Import Failure Displayed on unsuccessful im-port.


Problem with creating report.Please check NAS parametersand status.

Occurs when report is created. Please wait for previous requestto complete and try again.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 139

There is no permission to Createselected report. Reason: Userrole does not allow this action tobe performed.

Occurs when a report is re-quested by a user who does nothave permission to create it.

Log on the project with a rolewhich has elevated permissions.

Problem with creating report.Please check NAS parametersand status.

Occurs when report is created. Please contact Support for morehelp on this issue.

Problem creating report. Pleasecontact support

Occurs when creation of a reportis requested.


Cannot initialize communication Occurs when there is no responsefrom the server side.

Check whether applicationserver is operational.

Create report failed for report(report name)

Creation of report failed due tointernal reasons.


Unable to get connection in-stance.



Input xml error Creation of report failed due tointernal reasons.


No data path node Creation of report failed due tointernal reasons.


No data source nodes Creation of report failed due tointernal reasons.


Error connecting node with re-sults



Can’t create node for data Creation of report failed due tointernal reasons.


Can’t create query for data Creation of report failed due tointernal reasons.


Query type is not specified Creation of report failed due tointernal reasons.


Failed to append new data nodeto parent



Error adding attribute (key) :(value)



Reader is null Creation of report failed due tointernal reasons.


Error creating xml report: (errordetails)



No report created Occurs on unsuccessful reportcreation.


Invalid transformation Occurs when the user tries to ap-ply an invalid XSLT transforma-tion during report creation.


Transformation manager is notset

Occurs when the user tries to ap-ply an XSLT transformation dur-ing report creation.


Problem with applying transfor-mation

Occurs when the user tries to ap-ply an XSLT transformation dur-ing report creation.


Error occurred during deletingfile(s)

Occurs on unsuccessful reportdeletion.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 140

Unable to render PDF file. Errorcode: (error code)

Occurs on unsuccessful reporttransformation to PDF.


Error occurred during importingpackage. (error details)

Occurs on unsuccessful import ofreport.


Report (report id) not created Occurs on unsuccessful import ofreport.


Invalid input parameters. Occurs on unsuccessful upload-ing of file on FTP.

Check connection parameters.

File upload failed for file: (filename)

Occurs on unsuccessful upload-ing of file on FTP.

Check if FTP server is opera-tional.

Audio file generator does not ex-ist on defined location: (loca-tion)

Occurs when audio file generatordoes not exist or is installed ondifferent location.

Set correct location of Cepstralapplication in Application ServerManager settings.

Invalid ballot manifestationidentifier.

Internal error during ballot gen-eration.


PDF file of ballot manifestationdoesn’t exist on server.

Occurs when ballot with given idwas not found on the server.

File was deleted from the server.

Preview couldn’t be created! Occurs when preview creationfailed.


Could not load validator. Internal error during ballot ren-dering.


Unexpected error occurred.Please contact technical sup-port.

Internal error during generationof ballot preview.


Input ballot type is not set. Occurs when ballot type is notset.


Merging failed Internal error during ballot ren-dering.


Drawing ballot card for manifes-tation: (ballot id) failed to ren-der.

Internal error during ballot ren-dering.


Unable to get drawing ballotcard for manifestation: (ballotid).



Merging failed for image: (filepath). Check log file for details.



PDF file (file name) is not digi-tally signed. Please contact ap-plication support.



Paper dimensions for ballot (doc-ument name) are missing. Checkerror log for details

Contact technical support. Contact technical support.

Move files failed, check log file fordetails.

Occurs when moving renderedballots from temp directory todestination.

Check if destination directory islocked or drive is full.

Ballot (ballot id) - some of con-tests are not rendered

Some contests could not beplaced on the ballot.

Check project configuration.

Png file (file name) failed to con-vert.

Failed to convert .pdf file to .png. Contact technical support.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 141

Error in (png” to (pcl” conver-sion. Error message: graphicsunit in given image is not sup-ported. Please, contact adminis-trator!

Occurs when converting filesfrom .png to .pcl.


Creation RIFF file (file name)failed because process was un-able to finish

Creation of audio file failed. Contact technical support.

Problematic text: (text from file) Message will appear when theCepstral application cannot con-vert text of specific file to audiobecause that file contains somecharacters which Cepstral can-not recognize.

Change input text.

Conversion RIFF file (file name)failed.

Message will appear when theSpeex convertor cannot convertfile from RIFF to speex or MP3format.


Error message: (error message)Could not create audio file for(file path).

Audio file could not be created. Contact technical support.

Connecting audio failed: (errormessage)

Failed to attach audio file. Contact technical support.

Could not find a matching draw-ing ballot card for ballot mani-festation (ballot id)



Process failed. For details checklog file and contact technical sup-port.

This message appears in case ofballot content creation has failed.


Election files generation for tab-ulator (tabulator name) failed.

Occurs on unsuccessful genera-tion of election files.


Preparing security elementsfor tabulator (tabulator name)failed.



Tabulator (tabulator name) doesnot have polling district at-tached. Election files are not cre-ated.


Attach a polling district to thespecified tabulator.

Election files for tabulator (tabu-lator name) could not be created.(error details)



Validation failed: (error details) Occurs on unsuccessful genera-tion of election files.

Check error details and followthe instructions.

Validate Tabulation Files Displayed on progress bar duringelection files creation.

Copy election files failed! (errordetails)


Check if target directory on NASserver is locked or if the disk isfull.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 142

Temporary folder missing Occurs on unsuccessful genera-tion of election files - internal er-ror.

Run Application Server Managerand follow the instructions.

Line (line number) contained anelector count that was an invalidinteger: (CSV value).

Occurs during import of electoralcounts.

Check import file.

Import process failed. Displayed when error occurs dur-ing import of DCF file.


DCFManager Import from filefailed.

Displayed when error occurs dur-ing import of DCF file.


Configuration import failed. Displayed when an error occursduring import machine settings.


RTR File name of result file hasbeen altered, cannot load resultfile.

The result file has been alteredoutside of the voting machine.

Could not unpack result file(file name), because decryptionfailed.

The result file could not be en-crypted.


Could not unpack writein resultsfile for result file (file name), be-cause decryption failed.

The decryption of the result filefailed therefore write-in resultscould not be read.


Unhandled Tabulator Type The given tabulator is of an un-known type.


To be able to produce the au-dit report/images you first haveto copy images for result file (filename).

Prior to creation of audit report,images need to be copied from re-sult file.

Copy images from result files.

Raw results file (file name) wasnot present on NAS.

The result file with the givenname is not present on NAS.

Perform the copy images actionin RTR on the memory card con-taining the referenced result file.

Could not unpack result file (filename), because decryption failed

The result file could not be un-packed since decryption prob-lems appeared.


Database server parameters arenot correct: Connection todatabase failed. Please check pa-rameters.

The provided application serverparameters are not correct.

Check entered parameters orcontact technical support

There was an error occurredwhen saving data to the file.

The application parameters sav-ing process was not successful.

Check entered parameters orcontact technical support.

Could not load content creator. Indicates that a component ofEMS is not installed property.


Could not load ballot style dis-criminator.

Indicates that a component ofEMS is not installed property.


You must select folder for resultfile

A folder must be specified inwhich to save the Audio StudioDefinition file.


File (0) is not valid TemplateKeyword file

The selected file for upload is nota valid template keyword file.


You must check one file for im-porting!

One file must be selected for toexecute the import action.

Select one file in list of availablefiles.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 143

Select Report package. One file must be selected for toexecute the import action.

Select one file in list of availablefiles.

Root data for report missing. The specified report package fileis not correct.


Definition file name for reportmissing.

The specified report package fileis not correct.


Report code is missing The specified report package fileis not correct.


Are you sure you want to deleteselected write-ins?

Prompts for confirmation beforedeleting write-in candidate.

Select Yes to continue or No tocancel.

Are you sure you want to deletethe selected results?

Prompts for confirmation beforedeleting result file.

Select Yes to continue or No tocancel.

Polling district was incorrectlyselected for following: (error de-tails)

The specified Polling Districtcannot be selected for the Man-ual Result Entry owner.

Select the correct Polling Dis-trict.

Failed to get automatic resultloading status.

The system cannot get informa-tion from the results loading pro-cess.


Result loader service cannot bestarted.

The system cannot start the au-tomatic results loading process.


Result loader service cannot bestopped.

The system cannot stop the au-tomatic results loading process.


Some of the selected result fileswere rejected. Are you sureyou want to (action) these resultfiles?

Some of the selected files for theValidate and/or Publish actionare in the ‘Rejected’ status.

Confirm Validate and/or Publishaction on those files or cancel theprocess.

Choice Prototype Name must beset!

The choice prototype name ismandatory and must be speci-fied.

Define a name for the choice pro-totype.

Contest Prototype Name mustbe set!

The contest prototype name ismandatory and must be speci-fied.

Define a name for the contestprototype.

All selected ballots renamed suc-cessfully.

The renaming action on the bal-lots is finished.

No action required.

You must select one or more bal-lots for processing.

Ballots must be selected in orderto be renamed.

Select on or more ballots beforestarting the action.

You select (number) ballots forprocessing. Limit for this actionis (number).

The number of ballots selected torename is over the limit.

Reduce the number of selectedballots.

Contest that has prototypescan’t have separate choices!

The specified contest uses theprototype mechanism to createcandidates.

Delete existing candidates, ordisconnect contest from proto-type

Subdivision type is not selected! A subdivision type must be spec-ified for the newly-created Subdi-vision.

Specify Subdivision type fromavailable list of types.

Parent Subdivision is not se-lected!

A parent subdivision must bespecified for the newly-createdsubdivision.

Specify a parent subdivision typefrom the available list of subdivi-sions.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 144

You have to select the PollingSubdivisions.

One or more polling subdivisionsmust be specified before creatingtabulators.

Select one or more polling sub-divisions before creating Tabula-tors.

This will create default ElectoralGroup for selected parties. Con-tinue?

Prompts for confirmation of thecreation of Electoral Groups forselected Political Parties.

Accept or deny the action.

You have to select the PoliticalParties.

One or more political partiesmust be selected before creatingElectoral Groups.

Select one or more political par-ties before creating ElectoralGroups

Invalid Election Status. The Printing Label action is notallowed in current status.

Revert to an earlier state of theproject, or avoid this action.

There is no permission to CreateLabels.

The Printing Label action is notallowed for current user role.

Log in with the required creden-tials, or avoid this action.

You have to select the Voting Lo-cations.

Parent Voting Locations must bespecified before of creating tabu-lators.

Select one or more Voting Loca-tion before staring the creationprocess.

It is not allowed to Restore De-faults in (status name) status.

Restore Defaults drawing infor-mation is not allowed in the cur-rent election status.

Abort restoration action.

Operation failed for some of se-lected contests.

The setting party action for someof the specified contests failed.


Subdivision Batch Creation:Prefix is not valid.

The specified prefix is not validfor the Subdivision Batch Cre-ation action.

Specify a valid prefix and tryagain.

Subdivision Batch Creation:Postfix is not valid.

The specified Postfix is not validfor the Subdivision Batch Cre-ation action.

Specify a valid postfix and tryagain.

Please select subdivision type. The subdivision type must bespecified before subdivisions arecreated.

Specify the subdivision type be-fore subdivisions are created.

Please select Parent Subdivision. The parent subdivision must bespecified before subdivisions arecreated.

Specify parent subdivision beforesubdivisions are created.

Subdivision Batch Creation: In-valid Range.

The specified creation range isnot valid.

Change the range and repeat theoperation.

Batch Creation: Suffix is notvalid.

The specified suffix is not validfor the Polling Subdivision BatchCreation action.

Specify a valid suffix and tryagain.

Batch Creation: Range is notvalid.

The specified range is not validfor the Polling Subdivision BatchCreation action.

Specify a valid range and tryagain.

Batch Creation: Prefix is notvalid.

The specified prefix is not validfor the Polling Subdivision BatchCreation action.

Specify valid prefix and tryagain.

Batch Creation: Postfix is notvalid.

The specified postfix is not validfor the Polling Subdivision BatchCreation action.

Specify valid postfix and tryagain.

You have not selected the desiredcell properly

The specified postfix is not validfor the Polling Subdivision BatchCreation action.

Specify a valid postfix and tryagain.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 145

Invalid characters entered(/,, :, *, ?,) The object name contains char-

acters that are not allowed.Specify a valid name.

Tabulator is not set! The tabulator is not updated andusers cannot be created.

Save tabulator before addingusers.

Project name is not valid. The specified project name is notvalid.

Type in a valid project name.

Jurisdiction name is not valid. The specified jurisdiction nameis not valid.

Type in a valid jurisdictionname.

Description is not valid, invalidcharacters entered (/,, :, *, ?,) The object description contains

characters that are not allowed.Specify a valid description.

The newly created copy of theproject will have different secu-rity settings than the original.

The newly-created copy will bedifferent than the original interms of the security specifica-tion.

Any result file from original willnot be usable in a copy.

Value ¡value¿ can’t be importedin selected field.(reason)

The import action failed becauseof specified reason.


There is no permission to Createselected report.

The current user role does not al-low creation of reports.

Log in with credentials that al-low this action or avoid this ac-tion.

Could not get Result loader ser-vice status.

The result loader status cannotbe resolved.


Operation is not allowed. General message indicating thatthe selected action is not allowed.

Loading result files failed. The result loading action failed. Contact technical support.Failed to delete directory: Win-dows error

The folder could not be deleted.The message details indicate thereason.


Service already started. The Automatic Loading Serviceis already started.

No action is required.

Folder doesn’t exist: (foldername)

The result folder does not exist. Contact technical support.

Given interval:(value) is less thanminimal allowed interval of time:(value) or greater than max al-lowed interval of time: (value)

The results loading parametersare not correct.

Specify valid parameters.

Given chunk size: (value) isgreater than max allowed chunksize: (value)

The number of parallel processoperating while results are load-ing is too large.

Decrease the number of parallelprocesses.

Creating of this report can beperformed in status (name) orlater.

The selected report cannot becreated in current Election EventStatus.

Transition the project to a statuswhich allows this action or avoidthis action.

Ballot (name) is not updated The content of specified ballot isnot valid.

Start the synchronization pro-cess for listed ballots.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 146

Ballot (name) does not have anyvoting contest

The specified ballot does nothave any usable contests.

Inspect the specified ballot anddecide whether the generationprocess should continue.

Template selection failed. Template processing failed. Contact technical support.Audio Text: (text) Contains apause argument that does notdefine the unit of time (s, ms...)

The specified text contains an in-valid time unit.

Inspect the text and fix the timeunit or contact technical sup-port.

Creation RIFF file (name) failed.Error message: (error messagetext).

The system did not create theaudio file because of the listed er-ror.


Contest (name) use prototype. The specified contest use pro-totype mechanism. Manuallyadding candidates is not allowed.

Remove manually added candi-dates or detach the contest fromthe prototype.

Selected ballot creator type doesnot allow manually adding of theobjects. This (might/will) causethat system fails. Please re-move/delete all objects that wereadded after data was imported.

The system detected objectsthat were added after importingproject data.

All objects that are added afterimporting data will not be con-sistent. Remove them.

Tabulator (name) contains moreconnected modem settings thanit is allowed

The specify tabulator has morethan the maximum allowedtransfer points connected to it.

Remove some of the transferpoints.

There is not enough space ondisk to create election files.

The system detected a lack ofdisk space for creating electionfiles.

Clear space on NAS disk.

Info: Result file (file name) hasnot been closed and it’s notloaded.

The selected result file comesfrom a tabulator that is notclosed. It has not been loaded.

Either change project settingsfor this situation or return thecard into the tabulator and closeit.

Contest (0) placed improperlyregarding its order.

The specified contest cannot beplaced on the requested spot onthe ballot.

Check contest settings and/orcontact technical support.

Contest (0) could not be ren-dered. Check Page and Columnsettings for this contest.

The specified contest cannot beplaced on the requested spot onthe ballot.

Check Page and Column settingsfor specified contest and changethem.

Cannot allocate candidate: con-test = (name), candidate =(name), line = (value).

The candidate cannot be placedon the requested spot on the bal-lot.

Check contest settings and/orcontact technical support.

Header (ballot or contest) orstatic text dimension has beenmodified.

The system has reduced the sizeof the header.

Inspect the specified header andchange its settings.

Pdf reader could not be createdfor file (name).

The system was unable to createa pdf document for specified file.


Drawing Workbench file notfound.

Informs the user that systemcomponents are missing.


Table A.1: EED Client Error Messages

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 147

A.2 Adjudication Client Application Error Messages

The following list contains a set of error messages associated with potential problems in the Adjudication.

Message Description ActionAdjudication could not bestarted. Check that the ElectionFile Manager Service is runningproperly and refer to errordetails for more information.

Shown in the Election Wizardwhen the user requests to startadjudication but an error occurs.

Contact an administrator to ver-ify what the message specifiesand then try starting adjudica-tion again. Otherwise, check theerror details in the log and/orcontact technical support.

Adjudication Started Adjudication has been started byan administrator.

No action required.

The administrator has stoppedadjudication. No ballots willbe available until adjudication isstarted again.

Adjudication has been stoppedby an administrator.

Accept the notification and closethe client. In certain casesthe administrator may need tostop adjudication only to start itagain, in that case, wait for a newballot to appear.

The administrator has stoppedadjudication. No ballots willbe available until adjudication isstarted again. The current ballotwill be ignored.

Adjudication was stopped by anadministrator, but a ballot wasbeing adjudicated.


Ballot was ignored Adjudication was stopped by anadministrator, but the user wasin the process of confirming sub-mission of an adjudicated ballot.


Batch [ID], Tabulator [ID] [total]- of [total] ballots processed. [to-tal] in progress.

Shown when the user clicks on abatch in the Batch Managementscreen.

No action required.

”[Description of a failed opera-tion] It’s most likely that the ap-plication key is not installed, oris installed incorrectly.Contact an administrator to ver-ify that this machine has the ap-plication key and you have per-mission to use it.”

Shown when an operation failsdue to a problem with the appli-cation key that secures commu-nication.

Contact an administrator to ver-ify that the machine has the ap-plication certificate and key in-stalled and that the Windowsuser running the application haspermission to use the key. Oth-erwise, check the error details inthe log and/or contact technicalsupport.

”Changes have been saved butthe screen could not be refreshed.Please ensure the EMS Adjudi-cation Services are running andthen reopen this screen.”

Shown in the Write-In Manage-ment screen when an error occursafter changes to a write-in havebeen saved.

Contact an administrator to ver-ify communication with the EMSAdjudication Services and thentry entering the screen again.Otherwise, check the error de-tails in the log and/or contacttechnical support.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 148

Could not save changes. Pleaseensure the EMS AdjudicationServices are running and then tryagain.

Shown in the Write-In Manage-ment screen when an error pre-vents changes to a write-in frombeing saved.

Contact an administrator to ver-ify communication with the EMSAdjudication Services and thentry editing the write-in again.Otherwise, check the error de-tails in the log and/or contacttechnical support.

Could not retrieve write-in con-tests. Please ensure the EMSAdjudication Services are run-ning and then try again.

Shown in the Write-In Manage-ment and Ballot Viewer screenswhen an error prevents loadingwrite-in data.

Contact an administrator to ver-ify communication with the EMSAdjudication Services and thentry entering the screen again. Inthe Ballot Viewer screen, youmay need to move to a differ-ent contest, or reopen the appli-cation, in order to retry. Oth-erwise, check the error details inthe log and/or contact technicalsupport.

Could not obtain statistics.Please ensure the AdjudicationData Service is running.

Shown in the Batch Managementscreen when the user clicks on abatch but batch information can-not be obtained.

Contact an administrator to ver-ify communication with the EMSAdjudication Services and thentry selecting a batch again. Oth-erwise, check the error details inthe log and/or contact technicalsupport.

Once the ballot is saved, changeswill be permanent and you willnot be able to modify adjudi-cated contests. Are you sure youwant to mark this ballot as ad-judicated and move to the nextballot?

Shown in the Ballot Viewerscreen when the user requests tosave the current ballot and go thenext.

Select OK to save adjudicationsto the ballot, or Cancel to con-tinue adjudicating it.

Click OK to reset all in-progressballots for this batch. The safestway to do this is to first have allclients close their applications torelease any currently in-progressballots. Ballots that are cur-rently open may lose their workif the ballot is sent to anotherclient before the original is saved.

Shown in the Batch Managementscreen when the user requests toreset any in-progress ballots fora batch.

Select OK to reset all in-progressballots for this batch; Cancelotherwise.

Click OK to resubmit Tabulator[ID] - Batch [ID].

Shown in the Batch Managementscreen when the user requests toresubmit a pending batch.

Select OK to resubmit the batch;Cancel otherwise.

After starting the election youwill no longer be able to changeyour selected outstack filters (ifany) or edit qualified write-ins.Are you sure you want to startthe election?

Shown at the end of the ElectionWizard when the user requests tostart adjudication.

Select OK to start adjudication;Cancel otherwise.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 149

[Description of a failed opera-tion] Please ensure the EMS Ad-judication Services are runningand then try again.

Shown when an operation failsdue to a problem communicatingwith EMS Adjudication Services.

Contact an administrator to ver-ify communication with the EMSAdjudication Services and thentry the operation again. Other-wise, check the error details inthe log and/or contact technicalsupport.

Choice “[name]” is disabled, andcannot be adjudicated.

Shown in the Ballot Viewerscreen when the user selects achoice that has been disabled inthe current election.

No action required.

Duplicate write-in name. Shown in the Write-In Manage-ment screen when the user at-tempts to add a write-in namethat has already been added.

Edit the name being added so itdoesn’t conflict with a previousone.

Clicking OK will set the electionproject. You will not be able tochange the election project againuntil adjudication is started andthen stopped.

Shown when the user selects anelection project in the ElectionWizard and requests to move tothe next step in the wizard.

Select OK to set the electionproject that will be adjudicated;Cancel to change your selection.

Could not load election status. Shown when the application isstarting but the election statuscannot be obtained due to an er-ror.

This message will usually beshown with details specific to thesituation. Please follow any trou-bleshooting instructions shown,otherwise contact an administra-tor to check the error details inthe log and/or contact technicalsupport.

”[Description of a failed opera-tion] An invalid application keyis installed.Contact an administrator tohave an up-to-date key installedwith the proper permissions.”

Shown when an operation failsdue to having an incorrect appli-cation key installed.

Contact an administrator to ver-ify that the machine has the cor-rect application certificate andkey installed (e.g., maybe an oldkey is installed). Otherwise,check the error details in thelog and/or contact technical sup-port.

There was an error loading theballot image. Please alert anadministrator. Select “Yes” ifyou choose to continue; however,other ballot images may also notload. Do you want to continueadjudication?

Shown in the Ballot Viewerscreen when an error preventsdisplaying a ballot for adjudica-tion.

Contact an administrator asspecified, and select Yes to tryto load the next available ballot;No otherwise.

Vote [action] for choice “[name]” Shown in the Ballot Viewerscreen when the user changes thevoter mark for a choice.

No action required.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 150

”[Description of a failed opera-tion] There was a problem com-municating securely with ser-vices. Please ensure that:

• The time on this computermatches the Adjudicationserver’s time, including thetime zone.

• This version of the appli-cation is compatible withthe EMS AdjudicationServices you’re connectingto.”

Shown when an operation failsdue to a problem establishingsecure communication with theservices.

Contact an administrator to ver-ify the items specified in the mes-sage and then try the operationagain. Otherwise, check the er-ror details in the log and/or con-tact technical support.

Election contains no write-incontests. Qualified write-in en-try is not applicable.

Shown upon entering the Write-In Management screen if nowrite-in contests are available forthe selected election.

No action required.

Qualified write-ins have been up-dated.

Shown in the Write-In Man-agement screen when updates(add/edit/remove) to qualifiedwrite-ins have been saved.

No action required.

Failed to reset ballots for batch. Shown in the Batch Managementscreen when the user’s request toreset in-progress ballots fails.


Failed to resubmit batch [Tabu-lator ID] - [Batch ID].

Shown in the Batch Managementscreen when the user’s request toresubmit a batch fails.


You must select an electionproject name to continue.

Shown in the “Setup electionproject” step of the ElectionWizard if the user requests to goto the next step without select-ing an election first.

Select an election project namebefore continuing to the nextstep.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 151

”[Description of a failed oper-ation] Please ensure the EMSAdjudication Services are run-ning and then try again. Note:the services take a few minutesto start after the Adjudicationserver starts. If the server hasjust been restarted, please waitbefore trying again, or ask an ad-ministrator to start the servicesmanually.”

Shown during applicationstartup if one of the operationsthat contact the services fails.

Contact an administrator to ver-ify whether the server has beenrecently restarted, and if so, fol-low the instructions in the mes-sage before trying again. Oth-erwise, an administrator shouldverify that the services are run-ning, check error details in thelog and/or contact technical sup-port.

”You are about to end adjudi-cation. Once you do this, youwill no longer be able to submitbatches to tally, adjudicate bal-lots, or create adjudication re-ports. Click OK to confirm thatyou would like to end adjudica-tion for this election project.”

in the Reporting screen when theuser requests to end adjudica-tion.

Select OK to acknowledge themessage’s warnings and end ad-judication. Select Cancel to con-tinue adjudicating.

Submitting batch(es). Shown in the Batch Managementscreen when the user requests tosubmit one or more batches fortallying.

No action required.

A completed batch must be se-lected. It is possible that thestatus of the selected batch haschanged.

Shown in the Reporting screenwhen the user requests a reportwithout selecting a batch first.

Select a batch from the list be-fore requesting a report. If thereare no batches available, wait forthem to appear, as the systemmay still be processing them.

You are not authorized to carryout adjudication tasks. Contactan administrator to authorize ac-cess.

Shown during applicationstartup if the Windows userrunning the application hasbeen granted permission to theapplication key but has not beenadded to (or has been removedfrom) one of the groups thatdefine the user’s role in thesystem.

Contact an administrator to en-sure the exact user’s name ispresent in one of the Adjudica-tion groups on the server (or onthe current machine, if this is asingle-machine install).

Updating Batches. Shown in the Batch Managementor Reporting screens when theapplication is about to updatethe list(s) of batches.

No action required.

Could not determine user autho-rization.

Shown when the application isstarting but an error prevents de-termining whether the user run-ning the application is autho-rized to do so.

This message will usually beshown with details specific to thesituation. Please follow any trou-bleshooting instructions shown,otherwise contact an administra-tor to check the error details inthe log and/or contact technicalsupport.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 152

Waiting For Batches Shown periodically on the BatchManagement screen if the ap-plication has not received anybatches to display from the ser-vices.

Wait for batches to arrive; de-pending on server resources, thesize of the election, outstack con-ditions selected for adjudication,and conditions actually presentin the batches, this may takefrom seconds to minutes. It maybe necessary for an administra-tor to check the services’ logs forprocessing errors and/or contacttechnical support.

An unexpected error occurred;please notify technical support.The application will now close.

Shown when an unexpected erroroccurs and the application can-not continue running.

Contact an administrator tocheck the error details in thelog and/or contact technical sup-port.

An unexpected error occurred;please notify technical support.

Shown when an unexpected erroroccurs but the application cancontinue running.

Contact an administrator tocheck the error details in thelog and/or contact technical sup-port.

The selected batch for the activ-ity report was null or could notbe found

Messsage shown when selectedbatch is null when trying to gen-erate reports

Updates are available Shown when updates to batchare available on the Batch Man-agement screen.

Click refresh to refresh batches.

An error occurred retrieving theballot.

Shown if there was a problem re-trieving a double-clicked ballot inthe Batch Management screen


Reopening a ballot closes yourcurrent ballot. Click Yes to savechanges to the current ballot, Noto discard changes, or Cancel tokeep the current ballot and can-cel the re-open.

Shown if a ballot with changeswas already open when an ad-ministrator reopens a ballot.

Select the appropriate button tocomplete the desired action.

Click Yes to save this ballot. Noto close this ballot without sav-ing. Cancel to return to the bal-lot

Shown when saving a reopenedballot.

Select the appropriate button tocomplete the desired action.

Failed to submit one or morebatches. Please try refreshingthe screen and resubmit if nec-essary.

Shown when batch submissionfails, typically when batch statusis out of date due to reopening aballot.

Refresh the batch managementscreen and try resubmitting thebatch, if it is completed. Oth-erwise, contact an administratorto verify communication with theEMS Adjudication Services andthen try the operation again.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 153

This report may be out of date.Regenerate the report to get thelatest data.

Shown on the Reports screenwhen a generated report hasbeen rendered out of date by aballot reopening operation.

Regenerate required reports.

Table A.2: Adjudication Client Application Error Messages

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 154

A.3 DCM

The following list contains a set of error messages associated with potential problems with Data CenterManager.

Error message Description Action to overcomeInvalid operating system. Con-figuration cannot continue.

Displayed during installationfrom command line if operatingsystem is invalid.

Start installation on correct OS.

IIS service is not installed or theservice is not running. Installa-tion cannot be completed!

Displayed when server settingsare changed.

Please contact technical supportfor more help on this issue.

SQL is not installed, the serviceis not running or the number ofthe SQL instances is more thanone. Installation cannot be com-pleted!

Tests if SQL is running and oneinstance is available.


Application will exit now! Pleasecontact our technical support!

Displayed when necessary filesare missing.


Not all of the EMS DataCentersecurity settings have been ap-plied successfully. (Error codes:error details). Please look in theevent log for more details. PressOk button to continue.

Displayed when some of the se-curity settings have not been ap-plied successfully.


You need to restart system tomake settings take effect. ClickYes to restart now or No if youplan to manually restart later.

Displayed when settings aresaved and system has to berestarted.

Confirm this action if appropri-ate.

There was an error occurred dur-ing EMS DCM removing! Pleaselook in the event log for more de-tails.

Displayed if an error occurredduring removal of the DCM util-ity.


User name cannot be blank!Please try again.

Displayed when no user namehas been entered into the log-inform.

Please enter a user name.

Invalid characters found: (mes-sage details)! Please enter newuser name!

Displayed when invalid charac-ters have been entered in the username field on the log-in form.

Ensure that no invalid charac-ters are entered in the user namefield.

Password cannot be blank!Please try again.

Displayed when no password hasbeen entered into the log-in form.

Please enter a password.

Entered passwords do no match!Please try again.

The values entered in the pass-word field and its correspondingconfirmation field do not match.

Re-enter the password and con-firmation field to make sure thevalues match.

Entered password is too short(password details characters)!Please enter new password (atleast 6 characters long)!

Displayed when password is tooshort.

Pick a password with at least 6characters.

Invalid characters found:(matchdetails)! Please enter new pass-word!

Displayed when invalid charac-ters have been entered in thepassword field on the log-in form.

Please enter the correct pass-word.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 155

SQL is not installed or the ser-vice is not running.

Displayed when SQL is not in-stalled or the service is not run-ning.


The number of running SQL in-stances is (message details)

Displays the number of SQL in-stances running


SQL ‘sa’ account disabled: (mes-sage details)

Displayed if the SQL ‘sa’ accountis disabled.


Common directory already ex-ists. Do you want to replace allexisting static files in the NASCommon directory?

Displayed when the check for ex-isting instances of the commonfolder is performed and the folderalready exists.


(description details)(identity de-tails) already exists. Do youwant to reset the account pass-word? If you click Yes, you willbe prompted for the new pass-word. If you click on No, nochanges to your account will hap-pen.

Displayed if the user account al-ready exists, and asks the userif they wish to change the pass-word.

Follow the instructions in themessage.

Please enter a password for the(user description details)(useridentity details):

Displayed when the user needs toenter a password

Enter the password.

Please enter the new passwordfor the (user description de-tails)(user identity details):

Displayed when the user needs toenter a new password.

Enter a new password.

Please enter password for the ac-count (user identity details):

Displayed when the user needs toenter a password

Enter the password.

There was an error creating (userdescription details). Error: (er-ror details) Do you want to tryagain?

Displayed when creating user orsetting flags failed. Try again.If problem re-appears, contacttechnical support.

There was an error resetting(user description details) pass-word. Do you want to try again?

Displayed if an error occurs whileresetting user’s password.

Try again. If problem re-appears, contact technical sup-port.

Firewall is on: (error details) The DCM application is inform-ing the user that the firewall ison.

Turn off firewall.

Table A.3: DCM Error Messages

A.4 Framework

The following list contains a set of error messages associated with potential problems in the EMS frame-work.

Error message Description Action

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 156

No Instance to link with The system failed to create a newobject and link to an existing ob-ject, because the reference to theexisting object was empty.


No Link Hook to Hook the Link The system attempted to link to-gether two objects, but was un-able to do so.


No Class for Instantiation The system was unable to re-trieve information about a cer-tain class of objects.


No association end for requiredassociation

The system attempted to link to-gether two objects, but was un-able to do so.


No class for path (class path) The system was unable to createa new instance of a certain classspecified in (class path).


Link cannot be null The system was unable to deletea link between two objects


Inconsistent link state. The system was unable to deletea link between two objects.


Object(s) will be deleted. Doyou want to continue?

The user chose to delete an ob-ject or set of objects and the sys-tem is asking for confirmation.

Confirm this action if appropri-ate.

Both Source and Target instanceIDs must not be null

The system attempted to relinkone object to another object, butthe identifiers provided were null.


No link hook required on sourceinstance

The system attempted to relinkone object to another object, butthere was a problem with the ex-isting relationship.


No association end for link hook The system attempted to relinkone object to another object, butthere was a problem with the ex-isting relationship.


Moving up/down of items is al-lowed only if the default sort or-der is applied to the grid.

The user attempted to changethe order of an item in a list thatis currently sorted according tosome custom sort order. This isnot allowed.

Remove the custom order beforere-ordering elements in the list.

Image is too big! It shouldbe maximum (width) width and(height) height.

The user added an image insidean image control that exceedsthe maximum dimensions speci-fied in (width) and (height).

Adjust the image to the appro-priate size.

Object is not saved and allchanges will be lost. Do youwant to continue?

The user attempted to close adialog without first saving anychanges made; the system is ask-ing the user for confirmation.

Confirm action if appropriate.

User must have a password Message indicating that a pass-word is required.

Enter the password

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 157

Password confirmation failed Message indicating that pass-word confirmation failed.

The password confirmation fieldhas to match the password field.

Invalid number (probably toobig)

The user attempted to adjust thenumber of visible rows in a grid,but entered an invalid number.

Review and correct entered data.

Could not create link if metamodel is wrong.

The system attempted to createa link between two objects, butfailed.


Could not create link if one ofends is null.



Could not delete link when oneof ends is null

The system attempted to deletea link between two objects, butfailed.


At least one link hook is null. The system attempted to createa link between two objects, butfailed.


At least one link hook does nothave its association end.



Link hooks do not belong to thesame association.

The system attempted to loador create a link between two ob-jects, but failed.


No Class for Object creation. The system attempted to createor modify an object, but failed.


No Instance for deletion. The system attempted to deletean object, but failed.


No Instance for discarding. The system attempted to re-move an object from memory,but failed.


No instance to persist. The system attempted to persistan object, but failed.


No LinkHook to load. The system attempted to load arelationship, but failed.


No LinkHook to load. The system attempted to load arelationship, but failed.


At least one link hook does nothave its association end.

The system attempted to load arelationship, but failed.


No reference to attribute The system was unable to modifyan object.


Invalid link hook behavior The system was unable to modifyan object.


No attribute name The system was unable to mod-ify an attribute in an existing ob-ject.


Cannot reload null. The system was unable to reloadan object.


Null link cannot be reordered The system was unable to re-order the relationship betweentwo objects.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 158

Reorder can be done for linkswith the same hook.

The system was unable to re-order the relationship betweentwo objects.


Side of link must not be null. The system was unable to re-order the relationship betweentwo objects.


Delete directory (path), failed The system was unable to deletethe folder at the specified loca-tion (path).


Create directory failed: (path) The system was unable to createa folder, due to the reason spec-ified in message (path).


Move directory failed: (errormessage)

The system was unable to move afolder, due to the reason specified(error message).


Source folder (path) missing The system was unable to movethe folder (path), because thefolder does not exist.


Move directory failed: (errormessage)

The system was unable to move afolder, due to the reason specifiedin (error message).


Validation failed! String validation failed for textentered in a user control. Thiscan indicate an attempt at SQLinsertion.


Unable to create link The system attempted to createa link between two objects, butfailed.


Null instance cannot be pro-cessed

The system encountered a refer-ence to an object that was empty.This is not allowed.


M0Instance must have class The system encountered an ob-ject which does not have a validclass. This is not allowed.


Null in class hierarchy The system encountered a refer-ence to a class that was empty.This is not allowed.


Command cannot be null The system encountered a ref-erence to a command that wasempty. This is not allowed.


DataType is null The system encountered a ref-erence to a data type that wasempty. This is not allowed.


Recordset is null The system encountered a ref-erence to a record set that wasempty. This is not allowed.


Recordset is Empty The system encountered a ref-erence to a record set that wasempty. This is not allowed.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 159

Link is null The system encountered a refer-ence to a link that was empty.This is not allowed.


Side A instance is null The system encountered a refer-ence to a link that was empty.This is not allowed.


Side B instance is null The system encountered a refer-ence to a link that was empty.This is not allowed.


Link’s association is null The system encountered a refer-ence to a link that was empty.This is not allowed.


Link Hook is null The system encountered a refer-ence to a link that was empty.This is not allowed.


Association end is null The system encountered a refer-ence to a link that was empty.This is not allowed.


Association end owner is null The system encountered a refer-ence to a relationship that wasempty. This is not allowed.


Object is deleted The system attempted to per-form an action on a object, butthe object was deleted previ-ously.


‘algorithm’ and ‘keyfile’ haveto be specified for Encryption-ClientSinkProvider

A problem occurred during en-cryption with remote servicecommunications.


Specified keyfile does not exist A problem occurred during en-cryption with remote servicecommunications.


Not supported for now An unsupported database actionwas executed.


The method or operation is notimplemented.

An unsupported database actionwas executed.


Not used by framework An unsupported database actionwas executed.


Not supported An unsupported database actionwas executed.


Not supported property An unsupported database actionwas executed.


Could not initialize control, be-cause there is no connection toapplication server.

A problem with the connectionhas occurred.


Number of rows or columns can-not be 0.

A table was inserted into anRTF editor where the number ofcolumns = 0 or the number ofrows = 0.

Change the number of columnsand the number of rows.

Check document properties set-tings in order to open document!

A document was created with il-legal margins.

Check document properties set-tings (margins, height, width).

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 160

Failed to apply settings! A document was created with il-legal margins.

Check document properties set-tings (margins, height, width).

Not authorized to perform thisaction.

An unauthorized database actionwas executed.


Could not get project list An error occurred while retriev-ing the project list.


Missing localization manifest inthe assembly

Missing localized text has beendetected.


FileLoadException loading man-ifest in the assembly

A problem has occurred whiletranslating resources.


Missing localization manifest inthe assembly

A problem has occurred whiletranslating resources.


Table A.4: Framework Error Messages

A.5 Utilities

The following list contains a set of error messages likely to occur across a set of components which canbe used by any EMS application.

Error message Description ActionFile Copy error: (file name path) An error has occurred during file

creation.Check user permissions. Pleasecontact technical support formore help on this issue.

Delete file error: (error display) An error has occurred during filedeletion.

Check user permissions. Pleasecontact technical support formore help on this issue.

Delete folder error : (display er-ror)

An error has occurred duringfolder deletion.


Object(s) will be deleted. Doyou want to continue?”

The user has attempted to deleteobject(s).


Open File error : (error details) An error has occurred duringwhile opening a file.


If target folder containsfiles/subfolders with the samename(s) as the files you want tocopy, they will be overwritten.Continue?

Warning message that appearsbefore copying files.


Create archive error: (file namepath)

Archive creation has failed. Check user permissions. Pleasecontact technical support formore help on this issue.

Create archive error: (error de-tails)

An error has occurred while afolder was being created.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 161

The method or operation is notallowed.

This message appears to indicatethat the selected operation is notallowed.


Uploading on FTP is not allowed An error has occurred while up-loading a file via FTP.


Delete File on FTP is not allowed An error has occurred whiledeleting a file via FTP.


FTP provider has not been set An FTP provider has not beenset.

Set the FTP provider.

Error while connecting (error de-tails)

An FTP connection error has oc-curred.

Check the FTP settings.

Error while receiving list of fold-ers (error details)

An FTP error has occurred whilereceiving a list of folders.


Error while receiving list of files(error details)

An FTP error has occurred whilereceiving list of files.


Error while deleting folder (errordetails)

An FTP error has occurred dur-ing folder deletion.


Error while getting workingfolder action (error details)

An FTP error has occurred whilegetting the working folder.


Error while deleting file (errordetails)

An FTP error has occurred dur-ing while the file was beingdeleted.


Error during upload of file An FTP file error has occurredwhile the file was being up-loaded.


Error while receiving list of files(error details)

An FTP error has occurred whilea list of files was being received.


Delete Folder Action not sup-ported

Folder deletion is not supported Check the FTP settings.

Timed out waiting on server torespond.

The server is not responding. Check the FTP settings.

Failed to connect for data trans-fer: (error details)

An error has occurred while con-necting for data transfer.


Failed to parse the local address:(local address)

The local FTP address is incor-rect.


No server has been set. The IP address or hostname forthe FTP location is not set.


No username has been set. The FTP username has not beenset.


No password has been set. The FTP password has not beenset.


Input Value for ConvertFTP-DateToDateTime method wastoo short

An error has occurred during ftpdata conversion.


Table A.5: Utilities Error Messages

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 162

A.6 File System Service

Error message Description ActionInvalid drive name specified:(driveName)

The drive name is invalid. Please contact technical supportfor more help on this issue.

Failed to open device An error has occurred whileopening the device


Failed to open device: (errormessage)

An error has occurred whileopening the device


Invalid arguments for initializingCF

The arguments for initializingthe CF card are invalid.


Invalid drive name specified:(drive)

The drive name is invalid. Please contact technical supportfor more help on this issue.

Could not open removablemedium: ( drive)

An error has occurred whileopening the Removable Medium


Could not find images on Remov-able Medium

An error has occurred while look-ing for images on the RemovableMedium


Could not find RemovableMedium

An error has occurred while look-ing for the Removable Medium


Error copying images An error has occurred while im-ages were being copied.


Could not find image source file(source name)

An error has occurred while look-ing for image source files


Source image is too large for disk The size of the source image istoo large for the available spaceon the disk


Error writing image. An error has occurred while writ-ing the image to disk.


Unable to find CF Card device. An error has occurred while look-ing for the CF Card device


Invalid argument - drive root isnull or empty

The file system service for mem-ory cards was called with incor-rect parameters.

Please contact technical supportfor more help on this issue

CF Card has been initialized,please remove and reinsert theCF card and press OK

The CF card has been initialized. Remove the card, re-insert it,and press ‘OK’.

Invalid drive selection. An error has occurred while look-ing for the removable drive.

Select a drive that contains amemory card.

Invalid argument - source imagepath is null or empty

Source image path is invalid. Please contact technical supportfor more help on this issue.

Table A.6: File System Service Error Messages

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 163

A.7 USB File System

The following list contains a set of error messages likely to occur during file operations with CompactFlash Cards associated with the USB interface.

Error message Description ActionUnable create folder: (folder-name) Please check folder pathand make sure you have permis-sion to write to this path.

The system was unable to createa folder with the path indicatedby the error message on the com-pact flash.

Check whether the system haspermission to write to the folderpath specified.

Unable to copy file: (source-FilePath) to: (destination-FilePath) Please check sourceand destinantion file path andmake sure you have permissionto write to destination folder.

The system was unable to copy afile from specified source path tospecified destination path.

Check whether the system haspermission to write to the folderpath specified.

Could not read entire length The system could not process thescanned image data successfullyfrom the compact flash card.

Extract image data from thebackup memory card.

FAT16 does not support parti-tions larger then 2GB

The system attempted to for-mat a compact flash card us-ing FAT16 partition type and thedisk size is larger than 2GB.

Use card sizes smaller than 2GBfor tabulator types that requirethis partition type (e.g. CF200).

Could not load entire block After copying election files to thecard, the system verifies each fileto make sure that they are cor-rectly copied. This error mes-sage can indicate that the com-pact flash card is corrupted.

Replace the compact flash cardand repeat the action.

Could not load remainder After copying election files to thecard, the system verifies each fileto make sure that they are cor-rectly copied. This error mes-sage can indicate that the com-pact flash card is corrupted.


Error Initializing First Partition The system attempted to formata compact flash card and was un-successful.


Setting the Drive Layout Failed The system attempted to formata compact flash card and was un-successful.


Retrieving the Drive LayoutFailed

The system attempted to readfrom or write to the compactflash card but was unsuccessful.

If this error message occurs dur-ing reading, use the backupmemory card. If this error mes-sage occurs during formatting,replace the compact flash cardand repeat the action.

Error reading file The system could not process thescanned image data successfullyfrom the compact flash card.


Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 164

Error writing file The system attempted to formata compact flash card and was un-successful.


Invalid Handle Value The system attempted to readfrom or write to the compactflash card but was unsuccessful.


Retrieving the Storage DeviceNumber Failed



Ejecting media failed The system attempted toeject/unmount the compactflash card, but was unsuccessful.

If this error message occurs dur-ing election card programming,then repeat the action after re-placing the compact flash card.Otherwise, no further action isrequired.

Disk update properties failed The system attempted to formata compact flash card and was un-successful.


Dismounting volume failed The system attempted to formata compact flash card and was un-successful.


Unlocking volume failed The system attempted to formata compact flash card and was un-successful.


Locking volume failed. The system attempted to formata compact flash card and was un-successful.


Partition Number has to be 1..4 The system attempted to formata compact flash card and was un-successful.


Retrieving Geometry Failed The system attempted to readfrom or write to the compactflash card but was unsuccessful.


The DVS Signature is corrupt,this memory card may have beentampered with.

The system could not process thescanned image data successfullyfrom the compact flash card.


Drive X should be ignored The system attempted to formata drive that should not be usedfor election card programming.

Repeat the action but select adrive that contains a compactflash card.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 165

Could not open RemovableMedium.



Could not set drive layout of thedisk.

The system attempted to formata compact flash card and was un-successful.


Could not write the FAT32 par-tition header to disk.



Could not write the DVS parti-tion header to disk.



Table A.7: USB File System Error Messages

A.8 Permission Exceptions within the EED Client

Please refer to List of Permission Errors within EMS EED and RTR.

A.9 Permission Exceptions within the RTR Client

Please refer to List of Permission Errors within EMS EED and RTR.

Date: 2017-02-16 14:52:45ZRev: 5.2-CO::319 166

2.03 - Democracy Suite R EMS Functional Description...308 2017-01-26 tijana.todorovic Added minor...

Documents

Transcript of 2.03 - Democracy Suite R EMS Functional Description...308 2017-01-26 tijana.todorovic Added minor...