    Elections: Action Plans Needed to Fully Address Challenges in
    Electronic Absentee Voting Initiatives for Military and Overseas
    Citizens (14-JUN-07, GAO-07-774).

    The Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA)
    protects the rights of military personnel, their dependents, and
    overseas citizens to vote by absentee ballot. The Department of
    Defense (DOD) and others have reported that absentee voting,
    which relies primarily on mail, can be slow and may, in certain
    circumstances, serve to disenfranchise these voters. In 2004,
    Congress required DOD to develop an Internet-based absentee
    voting demonstration project and required the Election Assistance
    Commission--which reviews election procedures--to develop
    guidelines for DOD's project. In 2006, Congress required DOD to
    report, by May 15, 2007, on plans for expanding its use of
    electronic voting technologies and required GAO to assess efforts
    by (1) DOD to facilitate electronic absentee voting and (2) the
    Commission to develop Internet voting guidelines and DOD to
    develop an Internet-based demonstration project. GAO also
    assessed DOD's efforts to develop plans to expand its use of
    electronic voting technologies. GAO interviewed officials and
    reviewed and analyzed documents related to these efforts.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-07-774
        ACCNO:   A70748
      TITLE:     Elections: Action Plans Needed to Fully Address
    Challenges in Electronic Absentee Voting Initiatives for Military
    and Overseas Citizens
         DATE:   06/14/2007
      SUBJECT:   Absentee voting
    	     Americans abroad
    	     Data transmission
    	     E-mail
    	     Elections
    	     Information security
    	     Internet
    	     Internet privacy
    	     Program evaluation
    	     Voting
    	     DOD Federal Voting Assistance Program

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-07-774

         * [1]Results in Brief
         * [2]Background
         * [3]DOD Initiatives Assist UOCAVA Voters, but Certain Weaknesses

              * [4]Electronic Transmission Service's E-mail to Fax Conversion C
              * [5]DOD's Electronic Ballot Request and Receipt Initiatives Had
              * [6]Online Voting Guidance Is Useful but Some Inconsistencies Ex
              * [7]Online Voting Forms

         * [8]Absence of Internet Absentee Voting Guidelines Has Hindered

              * [9]The Commission Has Not Developed Internet Absentee Voting Gu
              * [10]The Election Assistance Commission Has Started a Study as a
              * [11]The Commission Does Not Have a Plan for Assessing Security I
              * [12]DOD Has Not Developed a Secure, Internet-based, Absentee Vot

         * [13]DOD Was Developing Plans to Expand the Use of Electronic Vot
         * [14]Conclusions
         * [15]Recommendations for DOD
         * [16]Recommendations for the Election Assistance Commission
         * [17]Agency Comments and Our Evaluation
         * [18]GAO Contact
         * [19]Acknowledgments
         * [20]GAO's Mission
         * [21]Obtaining Copies of GAO Reports and Testimony

              * [22]Order by Mail or Phone

         * [23]To Report Fraud, Waste, and Abuse in Federal Programs
         * [24]Congressional Relations
         * [25]Public Affairs

    Report to Congressional Committees

    United States Government Accountability Office

    GAO

    June 2007

    ELECTIONS

    Action Plans Needed to Fully Address Challenges in Electronic Absentee
    Voting Initiatives for Military and Overseas Citizens

    GAO-07-774

    Contents

    Letter 1

    Results in Brief 3
    Background 6
    DOD Initiatives Assist UOCAVA Voters, but Certain Weaknesses May Limit
    Their Effectiveness 12
    Absence of Internet Absentee Voting Guidelines Has Hindered Development of
    the Mandated Internet-Based Absentee Voting Demonstration Project 23
    DOD Was Developing Plans to Expand the Use of Electronic Voting Technology
    in the Future, but Sound Management Practices Are Key 28
    Conclusions 30
    Recommendations for DOD 31
    Recommendations for the Election Assistance Commission 32
    Agency Comments and Our Evaluation 32
    Appendix I Scope and Methodology 34
    Appendix II Examples of the Inconsistent Voting Assistance Guidance on
    DOD's Web Site 37
    Appendix III Comments from the Department of Defense 44
    Appendix IV Comments from the Election Assistance Commission 47
    Appendix V GAO Contact and Staff Acknowledgments 49
    Related GAO Products 50

    Tables

    Table 1: Electronic Transmission Service E-mail to Fax Conversions for
    2004 and 2006 13
    Table 2: Comparison of Integrated Voting Alternative Site Tools 1 and 2
    for Election Year 2006 18
    Table 3: State Offices Contacted and Programs Where the States Were
    Participants 35
    Table 4: Inconsistencies Identified in Guidance on Electronic Alternatives
    to Mail 37

    Figures

    Figure 1: Laws and Some DOD Programs Promoting Electronic Alternatives to
    Mail for UOCAVA Voters, 2000 through 2007 9
    Figure 2: DOD's 2006-2007 Voting Assistance Guide 20

    This is a work of the U.S. government and is not subject to copyright
    protection in the United States. It may be reproduced and distributed in
    its entirety without further permission from GAO. However, because this
    work may contain copyrighted images or other material, permission from the
    copyright holder may be necessary if you wish to reproduce this material
    separately.

    Abbreviations

    DOD Department of Defense
    FVAP Federal Voting Assistance Program
    HTML Hypertext Markup Language
    IVAS Interim Voting Assistance System
    IVAS Integrated Voting Alternative Site
    NDAA National Defense Authorization Act
    OMB Office of Management and Budget
    PDF Portable Document Format
    SERVE Secure Electronic Registration and Voting Experiment
    UOCAVA Uniformed and Overseas Citizens Absentee Voting Act
    VAG Voting Assistance Guide

    United States Government Accountability Office
    Washington, DC 20548

    June 14, 2007

    The Honorable Carl Levin
    Chairman
    The Honorable John McCain
    Ranking Member
    Committee on Armed Services
    United States Senate

    The Honorable Ike Skelton
    Chairman
    The Honorable Duncan Hunter
    Ranking Member
    Committee on Armed Services
    House of Representatives

    A citizen's right to vote is one of the hallmarks of a democratic society;
    yet exercising this right can be a challenge for millions of military
    personnel and their dependents of voting age who live away from their
    legal residences (in or outside the United States) and for overseas
    citizens. These individuals are eligible to vote by absentee ballots in
    federal elections. This eligibility is established by the Uniformed and
    Overseas Citizens Absentee Voting Act (UOCAVA),1 which is administered by
    the Department of Defense's (DOD) Federal Voting Assistance Program
    (FVAP). Through this program, DOD provides assistance to UOCAVA voters to
    facilitate opportunities for them to exercise their right to vote. The
    absentee voting process requires the potential voter to register to vote,
    request an absentee ballot, receive the ballot, correctly complete the
    ballot, and return it to the appropriate local election official. However,
    DOD and groups that represent voters covered under the act have reported
    that, because the multistep process of absentee voting relies primarily on
    mail, in some instances it can take so long to complete that these voters
    may, in effect, be disenfranchised.

    1Pub. L. No. 99-410 (1986), 42 U.S.C. SS 1973ff et seq.

    To address concerns about mail-based absentee voting, Congress has enacted
    several laws to promote electronic means for voters to register, request
    and receive ballots, and transmit voted ballots to local election
    officials. These laws include (1) the Help America Vote Act of 2002, which
    established the Election Assistance Commission to serve as a national
    clearinghouse for election information and to review election procedures;
    develop voluntary voting system guidelines;2 and study, among other
    things, electronic voting--particularly Internet voting technology; (2)
    section 1604 of the National Defense Authorization Act (NDAA) for Fiscal
    Year 2002, which required DOD to carry out a secure3 Internet-based
    electronic demonstration project4 in the general election for federal
    office in 2002 or 2004; and (3) section 567 of the Ronald W. Reagan NDAA
    for Fiscal Year 2005, which amended Congress's mandate for DOD to develop
    a secure, Internet-based, absentee voting demonstration project--by
    requiring DOD to implement the project during the first general election
    for federal office that occurs after the Election Assistance Commission
    establishes Internet voting guidelines for the absentee voting process.5
    Section 596 of the John Warner NDAA for Fiscal Year 2007 required DOD to
    submit, not later than May 15, 2007, a detailed plan to expand the use of
    electronic voting technology.

    Section 596 of the John Warner NDAA for Fiscal Year 2007 also required GAO
    to review DOD's electronic and Internet-based voting initiatives. This
    report assesses (1) DOD's efforts to facilitate registration, ballot
    transmittal, and voting by electronic means, such as e-mail and fax, for
    UOCAVA voters and (2) the Election Assistance Commission's efforts to
    develop Internet absentee voting guidelines and DOD's efforts to develop a
    secure, Internet-based, absentee voting demonstration project. The report
    also discusses DOD's efforts to develop plans to expand the use of
    electronic voting technology in the future.

    2Voluntary voting system guidelines are to provide a set of specifications
    and requirements to be used in the certification of computer-assisted
    voting systems, both paper-based and fully electronic; states are free to
    adopt these guidelines in whole or in part or reject them entirely.

    3In 1998, DOD had voluntarily initiated a proof of concept called "Voting
    Over the Internet," which was a small-scale Internet-based project used in
    the 2000 elections. DOD's report on this proof of concept acknowledged
    that a larger-scale pilot would result in more visibility and potentially
    attract those with malicious intent to harm the system, but suggested ways
    to mitigate such future attacks. To address these security concerns and
    other issues, Congress asked DOD, in 2002, to develop a large-scale,
    Internet-based demonstration project to ensure a methodical progression
    from the current mail-based process to a secure, easy-to-use Internet
    registration and voting system.

    4One of the primary objectives of the electronic demonstration project was
    to assess the use of such technologies to improve UOCAVA participation in
    elections.

    5The conference report for the bill noted that DOD's prototype for
    electronic voting was important and should not be abandoned and encouraged
    the Secretary of Defense to provide funding to the Commission to advance
    electronic absentee voting by UOCAVA voters. H.R. Rep. No. 108-767, at 680
    (2004) (Conf. Rep.).

    To address our objectives, we reviewed and analyzed laws, directives,
    reports, and plans related to DOD's efforts to provide electronic voting
    capabilities for UOCAVA voters. We also examined the Election Assistance
    Commission's efforts to develop Internet absentee voting guidelines. We
    reviewed and analyzed information regarding any benefits and challenges
    that we, DOD, and others had identified related to DOD's Internet-based
    electronic demonstration project and new electronic voting initiatives,
    along with the steps DOD had taken to mitigate those challenges.
    Additionally, we interviewed and obtained documentation from officials in
    several offices within DOD, the Election Assistance Commission, selected
    state and local election jurisdictions, and some independent groups
    concerned with the interests of UOCAVA voters. We performed our work in
    accordance with generally accepted government auditing standards, from
    August 2006 through April 2007. Appendix I provides detailed information
    about our scope and methodology.

    Results in Brief

    Since the 2000 federal election, DOD has developed several initiatives to
    facilitate voting by electronic means such as fax or e-mail; however, some
    of these initiatives exhibited weaknesses or garnered low participation
    rates that could limit their effectiveness. DOD introduced the first of
    three initiatives, an e-mail to fax conversion enhancement to its
    Electronic Transmission Service, in 2003. This feature allows UOCAVA
    voters who do not have access to a facsimile machine to send ballot
    requests, via e-mail, to DOD's Electronic Transmission Service, which
    converts e-mail messages to faxes and sends them to local election
    officials.6 In return, local election officials can send ballots to the
    Electronic Transmission Service conversion feature by fax; the conversion
    feature then converts the fax to an e-mail and sends it to the voter. DOD
    officials told us, however, that this feature is not in compliance with
    certain DOD information security requirements,7 which include performing
    and documenting risk assessments and security certification testing.
    Without such compliance, DOD cannot certify that it has employed the basic
    practices necessary to apply security measures. DOD officials said that
    they plan to award a contract to meet the requirements. Also, DOD
    voluntarily launched a second initiative--the Interim Voting Assistance
    System (IVAS)--in September 2004, to enable, as DOD reported, absentee
    voters to request and receive state or territory ballots securely for use
    in the November 2004 election. DOD spent $576,000 on this project, but
    only 17 citizens received ballots through this system--in part, because it
    was implemented just 2 months before the election. Further, in September
    2006, DOD developed, in response to a legislative mandate,8 a third
    initiative--the Integrated Voting Alternative Site (also called IVAS).
    This site included (1) a ballot request only tool--called Tool 1--that
    enabled voters to request their state or territory ballots from election
    officials by fax, regular mail, or unsecured e-mail and (2) a ballot
    request and receipt tool--called Tool 2--that enabled voters to request
    and receive their state or territory ballots through a secured server.
    Officials within Congress, and others, expressed concerns that using the
    Tool 1 with unsecured e-mail could expose voters to the risk of identity
    theft. DOD displayed a warning on the site--which voters had to read to
    continue processing their request--that explained the risks associated
    with e-mailing ballot requests. While the warning addressed the risks of
    transmitting personal identification information by e-mail, it did not
    inform voters of the risks involved in leaving such personal information
    on the computers they used--especially public computers or those shared by
    others. DOD officials said they would incorporate lessons learned, such as
    adding a cautionary statement to future systems to warn UOCAVA voters to
    remove personal information from the computers they use. DOD spent about
    $1.1 million on the 2006 IVAS, but local election officials could link
    only eight ballots to IVAS Tool 2.9 In addition to these initiatives, DOD
    has established a Web site with links to guidance that provides UOCAVA
    voters with, among other things, information on electronic alternatives to
    mail for each of the 55 states and territories. These links lead to DOD's
    2006 IVAS, the Voting Assistance Guide, news releases, and guidance
    updates. Our analysis of information on DOD's Web site, however, showed
    that for 14 of the 55 states and territories, some of the information
    about the alternatives was inconsistent and could be misleading. For
    example, for one state, information on three links correctly stated that
    only overseas military and overseas civilian voters were eligible to
    receive or return a ballot by fax; however, a fourth link did not include
    this restriction. As a result, military personnel stationed in the United
    States, but away from their state of residence, may have incorrectly
    concluded that they were eligible to vote by fax. While these
    inconsistencies were not widespread, their mere existence could lead
    UOCAVA voters to rely on incorrect information and therefore adversely
    affect the citizens' ability to vote. Agency officials acknowledged these
    discrepancies and addressed them during the course of our review. We are
    recommending that DOD improve the security and accuracy of its systems by
    (1) complying with information security requirements, (2) incorporating
    lessons learned, such as adding a cautionary statement to future systems
    to warn UOCAVA voters to remove personal information from the computers
    they use, and (3) institutionalizing a review process for its online
    guidance to ensure that information for absentee voters is accurate and
    consistent. DOD concurred with these recommendations.

    6The Federal Voting Assistance Program reported that some states, by law,
    allow voting materials to be sent by fax but not by e-mail.

    7DOD, Interim Department of Defense (DOD) Certification and Accreditation
    (C&A) Process Guidance, July 6, 2006.

    8Emergency Supplemental Appropriations Act for Defense, the Global War on
    Terror, and Hurricane Recovery, 2006. Pub. L. No. 109-234 (2006).

    9FVAP reported that, since ballot requests could be printed and returned
    through the mail or by fax instead of the secured server, an accurate
    reporting could not be obtained through Tool 2. FVAP also reported that
    ballot requests submitted using Tool 1 could not be tracked and reported
    because voters sent the requests directly to local election officials
    using their personal e-mail accounts, mail, or fax.

    The Election Assistance Commission has not yet developed guidelines for
    Internet absentee voting for DOD's use, and, thus, DOD has not proceeded
    with developing its secure, Internet-based, absentee voting demonstration
    project. Specifically, Commission officials stated that they had not yet
    developed the guidelines because they had been devoting constrained
    resources to meeting the challenges associated with current electronic
    voting machines. Furthermore, the Commission has not yet established--in
    conjunction with major stakeholders, like DOD--tasks, including addressing
    security and privacy risks; time frames; or milestones for completing the
    guidelines. Similarly, DOD has not developed the secure, Internet-based,
    absentee voting demonstration project because, DOD officials said, by law,
    the Commission must develop Internet absentee voting guidelines for DOD to
    follow before it can proceed. To support the Commission in developing
    these guidelines, DOD officials said they gave the Commission a report and
    an internal DOD document that provides the framework for a system, along
    with challenges DOD found in its earlier Internet voting projects. These
    challenges included security threats such as computer viruses, malicious
    insider attacks, and inadvertent errors that could disrupt system
    performance. DOD officials stated that, even if the Internet absentee
    voting guidelines had been available at the time of our review, the time
    remaining before the 2008 federal election would be inadequate for
    developing the secure, Internet-based, demonstration project. We are
    recommending that the Election Assistance Commission, in conjunction with
    major stakeholders such as DOD, create an action plan with tasks including
    actions to address the security and privacy risks associated with Internet
    voting processes and time frames for developing the Internet absentee
    voting guidelines. The Election Assistance Commission concurred with our
    recommendation.

    We observed that DOD was developing, but had not yet completed, plans for
    expanding the use of electronic voting technology for military personnel
    and overseas citizens, as required by the John Warner NDAA for Fiscal Year
    2007. The act requires DOD to submit these plans to Congress, not later
    than May 15, 2007. Our analysis of existing DOD and Commission documents
    and our interviews with agency officials show that DOD has not
    sufficiently involved stakeholders in recent electronic voting
    efforts--such as its 2006 IVAS. In addition, it has not established
    interim tasks that address issues such as security and privacy,
    milestones, time frames, or contingency plans, following the sound
    management practices used by leading organizations. Implementation of new
    electronic voting initiatives requires careful planning, particularly in
    light of the large number of stakeholders, the application of new
    technology, the remote location of troops, and the lead time required for
    implementation. Without an integrated, results-oriented plan that involves
    all stakeholders and identifies, among other things, goals, tasks, time
    frames, and contingency plans, DOD is not in a position to address
    congressional expectations to establish secure and private electronic and
    Internet-based voting initiatives. We are recommending that DOD, in
    conjunction with major stakeholders such as the Election Assistance
    Commission and local election officials, develop a comprehensive,
    results-oriented plan for future efforts that specifies, among other
    things, tasks including identifying safeguards for security and privacy of
    all DOD's voting systems--both electronic and Internet-based. DOD
    concurred with this recommendation.

    DOD's and the Commission's written comments are contained in appendixes
    III and IV, respectively. DOD also provided technical comments, which we
    incorporated in the final report, as appropriate.

    Background

    The U.S. election system is highly decentralized and relies on a complex
    interaction of people, processes, and technology. Voters, local election
    jurisdictions (which number over 10,000), states and territories, and the
    federal government all play important roles in the election process. The
    process, however, is primarily the responsibility of the individual states
    and territories and their election jurisdictions. As we reported in our
    2006 testimony,10 states and territories have considerable discretion in
    how they organize the elections process; this is reflected in the
    diversity of procedures and deadlines that states and jurisdictions
    establish for voter registration and absentee voting. Furthermore, these
    states and jurisdictions use a variety of voting techniques, from paper
    ballots to faxes and e-mails. We also reported that the voter is
    ultimately responsible for being aware of and understanding the absentee
    voting process and taking the actions necessary to participate in it.

    The UOCAVA established that members of the military and their dependents
    of voting age living away from their legal residences (in or outside the
    United States) and American citizens who no longer maintain a permanent
    residence in the United States are eligible to participate by absentee
    ballot in all federal elections. According to DOD, the act covers more
    than 6 million people. Executive Order and DOD guidance related to the act
    include the following:

               o Executive Order 12642, dated June 8, 1988, made the Secretary of
               Defense, or his designee, responsible for carrying out the federal
               functions under UOCAVA, including (1) compiling and distributing
               information on state absentee voting procedures, (2) designing
               absentee registration and voting materials, (3) working with state
               and local election officials, and (4) reporting to Congress and
               the President after each presidential election on the
               effectiveness of the program's activities (including a statistical
               analysis of UOCAVA voters' participation).

               o DOD Directive 1000.4, updated April 14, 2004, assigned the
               Office of the Under Secretary of Defense for Personnel and
               Readiness responsibility for administering and overseeing the
               program, and it established the FVAP to manage the program. In
               2006, FVAP officials told us that they were authorized a full-time
               staff of 13 and had a fiscal year budget of approximately $3.8
               million.

               FVAP facilitates the absentee voting process for UOCAVA voters;
               its mission is to (1) inform and educate U.S. citizens worldwide
               about their right to vote, (2) foster voter participation, and (3)
               enhance and protect the integrity of the electoral process at the
               federal, state, and local levels. FVAP also, among other things,
               provides training opportunities for Voting Assistance Officers
               (service, State Department, and overseas citizen organization
               officials who carry out the implementation of their respective
               voting assistance programs); prescribes, coordinates, and
               distributes voting materials, such as the Federal Post Card
               Application (the registration and absentee ballot request form for
               UOCAVA voters); and provides for alternatives to regular mail,
               including Express Mail and the use of electronic solutions.

    10GAO, Elections: DOD Expands Voting Assistance to Military Absentee
    Voters, but Challenges Remain, GAO-06-1134T (Washington, D.C.: Sept. 28,
    2006).

               The Election Assistance Commission, which was established by the
               Help America Vote Act of 2002, also contributes to the absentee
               voting process. The act specifically established the Commission as
               a national clearinghouse for election information and procedures
               and assigned it responsibility for developing voting system
               guidelines for the entire election process. The act also specifies
               that the development of voluntary voting system guidelines should
               be informed by research and development in remote access voting,
               including voting through the Internet, and the security of
               computers, networks and data storage. In 2005, the Commission
               issued guidelines that, among other things, addressed gaps in the
               security measures of prior standards. However, these guidelines do
               not comprehensively address telecommunications and networking
               services or their related security weaknesses, such as those
               related to the Internet. The act also amended UOCAVA to require
               states to report to the Commission, after each regularly scheduled
               general election for federal office, on the aggregate number of
               (1) absentee ballots transmitted to absentee uniformed services
               voters and overseas voters for the election and (2) ballots
               returned by those voters and cast in the election. The Commission
               collects this information through its biennial state surveys of
               election data.

               DOD, the Commission, and organizations representing UOCAVA voters
               have noted that these voters may effectively become
               disenfranchised because the multistep process for voting by
               absentee ballot--which relies primarily on mail--can take too
               long, especially for mobile servicemembers and overseas citizens
               or those deployed to or living in remote areas. Congress and DOD
               have taken action to facilitate the use of alternatives to mail,
               including electronic means such as fax, e-mail, and the Internet.
               Figure 1 shows (1) the laws designed to facilitate the use of
               electronic capabilities for UOCAVA voters and (2) some of DOD's
               efforts, either voluntary or in response to a statute, to provide
               electronic capabilities to these voters during fiscal years 2000
               through 2007.

    Figure 1: Laws and Some DOD Programs Promoting Electronic Alternatives to
    Mail for UOCAVA Voters, 2000 through 2007

    FVAP stated that it implemented the Voting Over the Internet project in
    2000 as a small-scale pilot project to provide military personnel and
    their dependents and overseas citizens covered under UOCAVA the ability to
    securely register to vote, request and receive ballots from local election
    officials, and vote via the Internet. DOD voluntarily developed the
    project as a small-scale proof-of-concept Internet voting project. This
    project enabled 84 voters to vote over the Internet--the first time that
    binding votes were cast in this manner.11 While the project demonstrated
    that it was possible for a limited number of voters to cast ballots
    online, DOD's report concluded that security concerns needed to be
    addressed before it could expand remote (i.e., Internet) voting to a
    larger population.

    11UOCAVA voters in Florida, South Carolina, Texas, and Utah, who were away
    from their legal residences, cast a total of 84 votes from their homes,
    workplaces, or duty stations on personal computers.

    In 2001, Congress noted that the Voting Over the Internet project had
    demonstrated that the Internet could be used to enhance absentee voting.12
    To continue the examination of a secure, easy-to-use Internet voting
    system as an alternative to the regular mail process, Congress mandated,
    in the NDAA for Fiscal Year 2002, that DOD conduct a large-scale
    Internet-based absentee voting demonstration project to be used for the
    2002 or 2004 federal election. DOD responded to this mandate by creating
    the Secure Electronic Registration and Voting Experiment (SERVE) for
    Internet-based absentee registration and voting; SERVE used a system
    architecture similar to the one used for the Voting Over the Internet
    project. However, as we previously reported,13 a minority report published
    by four members of the Security Peer Review Group--a group of 10 computer
    election security experts that FVAP assembled to evaluate SERVE--publicly
    raised concerns about the security of the system because of its use of the
    Internet.14 The four members suggested that SERVE be terminated because
    potential security problems left the information in the system vulnerable
    to cyber attacks that could disclose votes or personal voter information.
    Furthermore, they cautioned against the development of future electronic
    voting systems until the security of both the Internet and the world's
    home computer infrastructure had been improved. Because DOD did not want
    to call into question the integrity of votes that would have been cast via
    SERVE, the Deputy Secretary of Defense terminated the project in early
    2004, and DOD did not use it in the November 2004 election.

    12The U.S. Senate Committee on Armed Services report on Senate bill 1416
    regarding the NDAA for Fiscal Year 2002 noted that the Voting Over the
    Internet project was an important first step in assessing how to use the
    Internet to enhance absentee voting; reducing traditional barriers to
    participation in elections by absentee voters; and providing insight into
    issues that must be considered for broader use of remote registration and
    voting through the Internet. (S. Rep. No. 107-62, at 307 [2001]).

    13GAO, Elections: Absentee Voting Assistance to Military and Overseas
    Citizens Increased for the 2004 General Election, but Challenges Remain,
    [26]GAO-06-521 (Washington, D.C.: Apr. 7, 2006).

    14Security Peer Review Group, A Security Analysis of the Secure Electronic
    Registration and Voting Experiment (SERVE), January 21, 2004. The Security
    Peer Review Group consisted of 10 experts on computer security and voting
    systems drawn from academia and the private sector. As stated above, the
    report was written by 4 of the 10 experts.

    The points raised in these security reviews are consistent with concerns
    we raised in our 2001 reports.15 We found that broad application of
    Internet voting presented formidable social and technological challenges.
    In particular, we noted that challenges to remote Internet voting16
    involve securing voter identification information and ensuring that voters
    secure the computer on which they vote. We also reported that because
    voting requires more stringent controls than other electronic
    transactions, such as online banking, Internet voting systems face greater
    security challenges than other Internet systems. Furthermore, we found
    that remote Internet voting was recognized as the least protective of
    ballot secrecy17 and voter privacy18 and was most at risk from denial of
    service and malicious software, such as computer viruses. While opinions
    of groups considering the pros and cons of Internet voting were not
    unanimous, we found that they agreed in principle on major issues,
    including considering security to be the primary technical challenge for
    Internet voting.19 Because of serious concerns about protecting the
    security and privacy of the voted ballot, we concluded that Internet-based
    registration and voting would not likely be implemented on a large scale
    in the near future.

    In the Ronald W. Reagan NDAA for Fiscal Year 2005, Congress amended the
    requirement for the Internet-based absentee voting demonstration project
    by permitting DOD to delay its implementation until the first federal
    election after the Election Assistance Commission developed guidelines for
    the project. The conference report for the act20 stated that, although
    Congress recognized the technical challenges of Internet voting, SERVE was
    an important prototype that should not be abandoned.

    15GAO, Elections: Voting Assistance to Military and Overseas Citizens
    Should be Improved, [27]GAO-01-1026 (Washington, D.C.: Sept. 28, 2001) and
    Elections: Perspectives on Activities and Challenges Across the Nation,
    [28]GAO-02-3 (Washington, D.C.: Oct. 15, 2001).

    16Various approaches to Internet voting are possible, ranging from the use
    of Internet connections at traditional polling stations to the ability to
    remotely vote from anywhere (remote Internet voting). An intermediate step
    along this range is an option referred to as "kiosk voting," which uses
    conveniently located voting terminals provided and controlled by election
    officials.

    17Ballot secrecy refers to protecting the content of the vote.

    18Voter privacy refers to protecting the voters' ability to cast votes
    without being observed. In poll-site voting, voter privacy is generally
    ensured by election officials and observers. However, we reported that
    remote Internet voting would not protect voters' physical privacy, leaving
    them open to the risk that they might be coerced (through threats,
    bribery, or other forms of pressure).

    19Other challenges that affect implementation of Internet voting include
    the costs of the voting method versus its benefits and the availability of
    Internet technology to voters.

    20H.R. Rep No. 108-767, at 680 (2004) (Conf. Rep.).

    DOD Initiatives Assist UOCAVA Voters, but Certain Weaknesses May Limit Their
    Effectiveness

    Since the 2000 federal election, DOD has established several initiatives
    as alternatives to the by-mail process to facilitate voter registration
    and ballot request, receipt of a ballot, and submission of a voted ballot
    by electronic means--such as fax and e-mail--for UOCAVA voters. These
    include the Electronic Transmission Service's fax to e-mail and e-mail to
    fax conversion enhancement (hereafter referred to as the e-mail to fax
    conversion feature); the 2004 Interim Voting Assistance System (IVAS); the
    2006 Integrated Voting Alternative Site (also called IVAS); DOD's online
    voting assistance guidance; and online forms to register, request,
    receive, or submit ballots. While these efforts provide valuable guidance,
    services, and information to UOCAVA voters, some of them had limited
    participation rates or exhibited weaknesses in security, consistency, and
    accuracy that might hinder their use and effectiveness. DOD officials have
    acknowledged these weaknesses and they began taking action to address them
    during the course of our review.

    Electronic Transmission Service's E-mail to Fax Conversion Capability
    Facilitates Transmission of Voting Materials but Does Not Fully Comply with
    Information Security Requirements

    The electronic transmission service is a fax forwarding system,
    established by FVAP in 1990, that allows UOCAVA voters and state and local
    election officials, where permitted by law, to fax election materials to
    each other. These voters and election officials can use this service and
    do not have to pay long distance fees for faxing out of state, because DOD
    provides the service through a toll-free line. In 2003, after discussions
    with Mississippi state officials and a Mississippi National Guard unit,
    FVAP added the e-mail to fax conversion capability to its electronic
    transmission service. These officials asked FVAP for help in transmitting
    voting materials because, by state law, Mississippi allowed only faxing as
    an electronic means of transmission--a capability that the Guard unit
    would not have while it was deployed to Iraq.21 The e-mail to fax
    conversion feature allows UOCAVA voters who do not have access to a
    facsimile machine to send ballot requests, via e-mail, to DOD's Electronic
    Transmission Service, which converts e-mail attachments to faxes and sends
    them to local election officials. In return, local election officials can
    send ballots to the Electronic Transmission Service conversion feature by
    fax; the conversion feature then converts the fax to an e-mail attachment
    and sends it to the voter.

    21The FVAP reported that some states, by law, allow voting materials to be
    sent by fax but not by e-mail.

    FVAP stated that it notifies states and territories whenever it converts
    an e-mail containing voting materials to a fax, or vice versa, so that the
    state or territory can decide whether or not to accept it. Table 1 shows
    Electronic Transmission Service activity for the conversion feature for
    2004 and 2006.

    Table 1: Electronic Transmission Service E-mail to Fax Conversions for
    2004 and 2006

                                                                          Years
                                                                        2004 2006
    E-mails converted to fax--sent from citizens to local election
    officials
    Voted ballots                                                      67   53
    Federal post card applications and remaining ballot materials     389  190
    Subtotal                                                          456  243
    E-mails converted to fax--sent from local election officials to
    citizensa
    Federal post card applications and remaining ballot materials    153b  182
    Subtotal                                                         153b  182
    Total                                                             609  425

    Source: DOD.

    aFVAP officials stated that the local election officials who send e-mails
    to the Electronic Transmission Service conversion feature use it to store
    ballots that will be sent to UOCAVA voters, through DOD, at some future
    date.

    bFVAP noted that for the 2004 elections the Electronic Transmission
    Service conversion feature received 61 e-mails from local election
    officials which they converted to 153 faxes to citizens covered under
    UOCAVA. FVAP explained that this allowed one local election official to
    send one e-mail with a PDF attachment to the Electronic Transmission
    Service, which would then get converted to a fax and sent to multiple
    UOCAVA voters per the local election official's instructions. PDF means
    Portable Document Format; it is a file format that is used to view
    electronic copies of paper documents, which allows an exact copy of the
    paper document.

    Although FVAP has made progress in assisting servicemembers to transmit
    voting materials with the e-mail to fax conversion enhancement, FVAP
    officials told us they have not fully complied with certain information
    security requirements in the Interim DOD Information Assurance
    Certification and Accreditation Process.22 This guidance requires DOD
    components, among other things, to implement controls and to certify and
    accredit such e-mail systems.

    22DOD, Interim Department of Defense (DOD) Certification and Accreditation
    (C&A) Process Guidance, July 6, 2006.

    FVAP officials initially stated that the information security guidance did
    not apply to the conversion feature; they saw it as an enhancement to the
    original Electronic Transmission Service's fax system. During the course
    of our review, however, FVAP officials said they consulted with officials
    responsible for DOD's information assurance certification and
    accreditation and concluded that the requirements did, in fact, apply.
    These officials stated that, by the end of fiscal year 2007, they plan to
    award a contract to obtain services to meet the information security
    requirements. The FVAP officials further stated that, while they do not
    have the required documentation--such as risk assessments or certification
    tests and accreditations--they have taken some measures to ensure
    security. We note that the statement of work for FVAP's April 29, 2005,
    contract for the Electronic Transmission Service recognizes the
    sensitivity of the data associated with election materials and includes
    provisions for certain security functions, such as ensuring that adequate
    steps are taken to prevent unauthorized access or manipulation of the
    data. Until FVAP performs and documents the security assessments and
    certifications, however, it has not taken all the necessary measures to
    secure its system and comply with DOD's information security requirements.

    Federal law includes a number of separate statutes that provide privacy
    protections for certain information. The major requirements for the
    protection of personal privacy by federal agencies come from two laws: the
    Privacy Act of 197423 and the privacy provisions of the E-Government Act
    of 2002. Section 208 of the E-Government Act of 200224 requires agencies,
    among other things, to conduct privacy impact assessments before
    developing, upgrading, or procuring information technology that collects,
    maintains, or disseminates personally identifiable information. DOD
    developed departmentwide guidance--the DOD Privacy Impact Assessment
    Guidance--for implementing the privacy impact assessment requirements
    mandated in the E-Government Act of 2002. In this guidance, DOD directs
    the components to adhere to the requirements prescribed by the Office of
    Management and Budget (OMB)--Guidance for Implementing the Privacy
    Provisions of the E-Government Act of 2002.25 FVAP officials stated that
    they had not conducted a privacy impact assessment for the Electronic
    Transmission Service's e-mail to fax conversion enhancement, but they told
    us that a privacy impact assessment will be done as part of the previously
    mentioned contract to meet information security requirements. A privacy
    impact assessment would identify specific privacy risks to help determine
    what controls are needed to mitigate those risks associated with the
    Electronic Transmission Service. Furthermore, building in controls to
    mitigate risks could ensure that personal information that is transmitted
    is only used for a specified purpose. FVAP noted that when information is
    sent by e-mail, the conversion feature retains the following information:
    full name, fax number, city, state, zip code, and e-mail addresses. FVAP's
    Electronic Transmission Service retains this personally identifiable
    information both to provide transmission verification or confirmation to
    users and to comply with election document retention requirements under
    the Civil Rights Act of 1960.26

    235 U.S.C. S 552a.

    24Pub. L. No. 107-347 (2002).

    DOD's Electronic Ballot Request and Receipt Initiatives Had Limitations in
    Participation and Security

    In September 2004, just 2 months prior to the election, DOD voluntarily
    implemented what it reported as a secure electronic system for voters to
    request and receive ballots--the Interim Voting Assistance System
    (IVAS)--as an alternative to the traditional mail process. IVAS was open
    to active duty servicemembers, their voting age dependents, and DOD
    overseas personnel who were registered in a state or territory
    participating in the project27 and enrolled in the Defense Enrollment
    Eligibility Reporting System--a DOD-managed database that includes over 23
    million records pertaining to active duty and reserve military and their
    family members, retired military, DOD civil service personnel, and DOD
    contractors. DOD had limited IVAS participation to UOCAVA voters who were
    affiliated with DOD because their identities could be verified in the
    Defense Enrollment Eligibility Reporting System. Voters obtained their
    state or territory ballots through IVAS by logging on to a special Web
    site and then requesting ballots from their participating local election
    jurisdictions. After the local election officials approved the requests
    and the ballots were finalized, IVAS notified voters via e-mail that the
    ballots were available to download and print. DOD reported that 108
    counties in eight states and one territory agreed to participate in this
    2004 IVAS; however, only 17 citizens downloaded their ballots from the
    site during the 2004 election. FVAP officials noted that participation was
    low, in part because this IVAS was implemented just 2 months before the
    election. FVAP further reported that many states did not participate--for
    a variety of reasons, including state legislative restrictions, workload
    surrounding regular election responsibilities, and lack of Internet
    access. FVAP officials noted that this system, which was maintained
    through the conclusion of the election, cost $576,000.

    25OMB, Guidance for Implementing the Privacy Provisions of the
    E-Government Act of 2002, September 26, 2003. (M-03-22).

    26Every officer of election must retain and preserve all election records
    and papers for certain federal elections for a period of 22 months from
    the date of the election. Civil Rights Act of 1960, S 301, 42 U.S.C. S
    1974.

    27States and territories participating in the 2004 IVAS included Kansas,
    Kentucky, Maryland, Mississippi, Montana, New Mexico, South Carolina, the
    Virgin Islands, and Wisconsin.

    In September 2006--again, just 2 months before the next general
    election--FVAP launched a follow-on Integrated Voting Alternative Site,
    also called IVAS, in response to a June 2006 legislative mandate to
    reestablish the 2004 IVAS. This 2006 IVAS expanded on the 2004 effort, by
    providing information on electronic ballot request and receipt options for
    all UOCAVA citizens in all 55 states and territories. It also provided two
    tools that registered voters could access through the FVAP Web site, using
    DOD or military identification, to request or receive ballots from local
    election officials. As with the 2004 IVAS, local election officials used
    information in these tools to verify the identity of UOCAVA voters who
    used them.28 The first tool--called Tool 1--contained a ballot request
    form only, accessed through DOD's Web site, which voters could fill out
    and download to their computers. Voters could then send the downloaded
    form to the local election officials either by regular mail, fax, or
    unsecured e-mail, per state or territory requirements. FVAP officials
    reported to Congress that no information on the number of users was
    available on the use of Tool 1 because the department was no longer
    involved in the process once the voter downloaded the ballot request and
    they, essentially, had no visibility into what transpired directly between
    the voter and the election officials.

    28Verification was made by the use of WebGuard, which determines the
    status of an individual enrolled in the Defense Manpower Data Center's
    Defense Enrollment Eligibility Reporting System database using that
    individual's name, Social Security number, and date of birth. Ballot
    requests saved and downloaded to the voter's computer for voters who used
    Tool 1 and those requests sent to the election officials using Tool 2 both
    include text indicating the forms were generated via IVAS.

    The second tool--called Tool 2--provided a ballot request and receipt
    capability for voters, similar to the 2004 IVAS, which also allowed voters
    to fill out ballot request forms online, send them to local election
    officials through a secure line, and receive their state or territory
    ballots from the local election officials through a secured server. Again,
    no voted ballots were transmitted through this IVAS system given that it
    was not designed for that purpose. Absentee voters, instead, would return
    voted ballots, outside of IVAS, in accordance with state law. Tool 2 had a
    tracking feature which showed that 63 voters had requested ballots through
    the system. Of these, local election officials approved and made their
    state or territory ballots available to 35 UOCAVA voters. However, of the
    35 sent out, local election officials reported that only 8 voted ballots29
    were traced back to the IVAS Tool 2, in part because this IVAS was
    implemented just 2 months before the election. DOD reported that the total
    cost for the 2006 IVAS was about $1.1 million, and given that the tools
    were used only to request or receive ballots for the November 2006
    elections,30 DOD removed the tools from FVAP's Web site in January 2007.
    Table 2 compares and provides additional details on the two tools.

    29FVAP reported that, since ballot requests could be printed and returned
    through the mail or by fax instead of the secured server, an accurate
    reporting could not be obtained through Tool 2. FVAP also reported that
    ballot requests submitted using Tool 1 could not be tracked and reported
    because voters sent the requests directly to local election officials
    using their personal e-mail accounts, mail, or fax.

    30Congress directed DOD, in June 2006, to reestablish the 2004 IVAS
    program. Congress also directed, in October 2006, that DOD continue IVAS
    for the general election and all elections through December 31, 2006.

    Table 2: Comparison of Integrated Voting Alternative Site Tools 1 and 2
    for Election Year 2006

                    Tool 1                               Tool 2
    Developer/   Defense Manpower Data Center         Merlin International,
    contractor                                        Incorporated's PostX
    User(s)         o Uniformed servicemembers           o Uniformed
                       o Servicemembers' dependents         servicemembers
                       o Overseas DOD employees and         o Servicemembers'
                       contractors                          dependents
                                                            o Overseas DOD
                                                            employees and
                                                            contractors
                                                            o Local election
                                                            officials
    Tracking        o System is not able to track        o System is able to
                       ballot request forms sent to         track ballot request
                       local election officials because     forms sent to local
                       users submitted their Federal        election officials;
                       Post Card Applications directly      local election
                       to local election officials using    officials reported
                       their personal e-mail accounts.      that they received 8
                       o System can provide only how        voted ballots.a
                       many times it was accessed.          o PostX reported 63
                                                            ballot requests were
                                                            submitted to the
                                                            system; 35 were
                                                            approved--29 out of
                                                            35 blank ballots were
                                                            viewed by voters on
                                                            the system.
    Step-by-step    o Registered voters use a unique     o Registered voters
    process         DOD identifier or credential to      use unique DOD
                       log in to the IVAS tool.             identifier or
                       o Voters complete the automated      credential to log in
                       Federal Post Card Applications,      to the IVAS tool.
                       without their signature, to          o Voters complete the
                       request a ballot.                    automated Federal
                       o Voters save the Federal Post       Post Card
                       Card Applications to their           Applications, without
                       computers as PDF files.              their signature, to
                       o Voters e-mail the Federal Post     request a ballot.
                       Card Applications over an            o Voters save the
                       unsecured Internet line to local     Federal Post Card
                       election officials; voters may       Applications to the
                       also fax or mail the Federal Post    secure server and the
                       Card Applications to local           system sends a
                       election officials--depending on     notification to the
                       state or territory procedures.       local election
                                                            officials of
                                                            completed ballot
                                                            requests.
                                                            o Local election
                                                            officials receive
                                                            automated e-mails
                                                            with notification of
                                                            new ballot requests
                                                            and log onto the
                                                            secure server to
                                                            access the Federal
                                                            Post Card
                                                            Applications.
                                                            o Local election
                                                            officials approve
                                                            applications and
                                                            upload blank ballots
                                                            onto the secure
                                                            server.
                                                            o Voters log onto the
                                                            secure server and
                                                            fill out ballots.
                                                            o Voters print
                                                            completed ballots.
                                                            o Voters submit voted
                                                            ballot directly to
                                                            local election
                                                            officials, in
                                                            accordance with state
                                                            law.
                                                            o Local election
                                                            officials confirm
                                                            voted ballot
                                                            receipts.
                                                            o Voters log on to
                                                            check confirmation of
                                                            voted ballot
                                                            receipts.

    Source: DOD information.

    aFVAP reported that, since ballot requests could be printed and returned
    through the mail or by fax instead of the secured server, an accurate
    reporting could not be obtained through Tool 2. FVAP also reported that
    ballot requests submitted using Tool 1 could not be tracked and reported
    because voters sent the requests directly to local election officials
    using their personal e-mail accounts, mail, or fax.

    Officials within Congress, and others, have expressed concerns that voters
    could be exposed to a heightened risk of identity theft if they used Tool
    1 to send voting materials that contain personally identifiable
    information (including Social Security number, date of birth, and
    address), by unsecured e-mail. FVAP officials acknowledged in their
    December 2006 report to Congress31 that Tool 1 was less secure, but said
    (1) DOD was providing access to a capability that states already
    provide,32 (2) most states and territories only required the last four
    digits of the Social Security number on the ballot requests,33 and (3)
    Tool 1 displayed a cautionary statement that voters had to read to go on
    with the request process; this cautionary statement explained the risk
    associated with e-mailing ballot requests and that the government assumed
    no liability if voters did so. While we confirmed a cautionary statement
    related to the transmission of personal data did exist for Tool 1, it did
    not advise voters, after submitting their ballot request, to remove voting
    materials that they have stored on their computers. For example, voters
    using Internet cafes overseas could have been subject to identity theft if
    they did not delete their personal information from the computer and a
    subsequent user gained access to the stored file. FVAP officials
    acknowledged that users were not advised of the risks of storing personal
    voting information on their computers, and these officials stated that
    they will incorporate lessons learned, such as adding a cautionary
    statement in any future ballot request system.

    Online Voting Guidance Is Useful but Some Inconsistencies Exist in the Links

    In addition to these initiatives, DOD also has established the FVAP Web
    site,34 which contains information on FVAP programs and links to assist
    UOCAVA voters in the voting process. Specifically, these links access
    FVAP's online guidance, including several versions of FVAP's biennial
    Voting Assistance Guide, shown in figure 2.

    31DOD, Report on IVAS 2006, As Required by Section 596 of the National
    Defense Authorization Act for Fiscal Year 2007, December 2006.

    32FVAP reported that states and territories allowing e-mail of the ballot
    request include Alaska, Colorado, Illinois, Indiana, Iowa (2006 only),
    Minnesota, Mississippi, Montana, North Carolina, North Dakota, Oregon,
    Puerto Rico, South Dakota, Virginia, Washington, and Wisconsin.

    33As reported by FVAP, 7 states require the full Social Security number,
    41 require the last 4 digits or driver's license, and 7 do not require the
    Social Security number.

    34DOD established this Web site in 1995.

    Figure 2: DOD's 2006-2007 Voting Assistance Guide

    This guide tells the UOCAVA voter how to register, request a ballot,
    receive a ballot, and vote the ballot electronically--including by e-mail
    or fax--where state or territory law allows this. One link on FVAP's Web
    site had a full-text version of the guide, so that a Voting Action
    Officer35 or other user could download and print the entire guide and use
    it to provide assistance to absentee voters from various states and
    jurisdictions. Another link goes to a Web page containing "State-by-State
    Instructions," where two additional links--one a PDF guide, the other an
    HTML version36--are provided for each state or territory. This allows
    voters to read or print off only their own state's or territory's
    instructions and to have a choice of formats.37 Another link goes to the
    Integrated Voting Alternative Site--this site provides information for the
    55 states and territories regarding the electronic ballot request and
    receipt options available to UOCAVA voters. FVAP's Web site also has
    another link to News Releases, which contains updates on changes to the
    guidance, including changes to state laws that affect UOCAVA voters.
    Finally, a link goes to FVAP's Voting Assistance Guide Errata Sheets--this
    contains changes that have been made to the archived Voting Assistance
    Guide since its last printing.

    35Service Voting Action Officers, for example, are responsible for voting
    assistance operations within their service.

    36PDF means Portable Document Format; it is a file that is used to view
    electronic copies of paper documents, which allow an exact copy of the
    paper document. HTML means Hypertext Markup Language and is used to
    structure and format documents to be displayed on the World Wide Web.

    Our review of the FVAP Web site, however, revealed inconsistencies in some
    of the information about electronic transmission options that the voters
    could access through different links on the site. Our analysis
    specifically showed that, while not widespread, for 14 of the 55 states or
    territories, some of the guidance regarding requirements for electronic
    transmission was inconsistent and could be misleading, as the following
    examples illustrate:

               o For the state of California, we found that three of the FVAP
               links correctly stated that only overseas military and overseas
               civilian voters were eligible to receive or return a ballot by
               fax; a fourth link, however, did not include this restriction. As
               a result, military personnel stationed in the United States, but
               away from their state of residence, might
               conclude--incorrectly--that they were eligible to vote by fax.
               FVAP officials acknowledged this discrepancy and updated the
               information reached from the fourth link on January 25, 2007, to
               reflect the fact that uniformed servicemembers must be residing or
               deployed overseas to be able to receive and send ballots by fax.

               o For the state of Colorado, we identified a news release that was
               issued on October 18, 2006, announcing a new initiative to allow
               uniformed servicemembers deployed outside the United States to
               request, receive, and return absentee ballots via e-mail. One
               other FVAP link reflected this change; however, four other links
               did not capture this change. FVAP officials acknowledged this
               discrepancy, updated two of the links, and issued an errata sheet
               on January 22, 2007. FVAP officials did not update the third
               link--the 2006-2007 Voting Assistance Guide accessed through the
               publications link on their Web site--stating that it was
               considered an archive document and was not intended for update.
               However, DOD did not clearly identify this link as an archived
               document; as a result, this link could mislead voters who relied
               on it. FVAP officials later acknowledged that the archived version
               of the 2006-2007 Voting Assistance Guide could have been labeled
               better, and eventually deleted this version from their Web site.

    37The Executive Branch's "Access Board," which consists of cabinet-level
    officials from twelve federal agencies, among others, developed standards
    to implement section 508 of the Rehabilitation Act, which required federal
    agencies to have electronic information that is accessible to people with
    disabilities on government Web sites. FVAP stated that they provide access
    to an HTML version of their Voting Assistance Guide on their Web site to
    comply with this act. They also provide a PDF format of the Voting
    Assistance Guide for UOCAVA voters.

               Appendix II provides details on the inconsistencies we found on
               FVAP's Web sites for 14 states and identifies the links, along
               with DOD's responses regarding each. Under internal control
               guidance, organizations are to apply policies and procedures
               consistently.38 As noted previously, while the inconsistencies
               were not widespread, the fact that inconsistencies exist at all
               could lead UOCAVA voters-- especially busy voters residing or
               deployed in remote locations--to rely on incorrect information and
               therefore adversely affect their ability to vote. Agency officials
               acknowledged these discrepancies and addressed them during the
               course of our review.

    			  Online Voting Forms

               In addition, FVAP administers two online forms, (1) the Federal
               Post Card Application, which allows absentee voters to register to
               vote or request ballots; and (2) the Federal Write-in Absentee
               Ballot, which allows absentee voters to vote even if they have not
               yet received the absentee ballot they requested from their state
               or territory. The Federal Post Card Application has been online
               since 1999, in PDF format, and is postage-free within the U.S.
               mail system when appropriate markings, provided on FVAP's web
               site, are used. The online Federal Post Card Application allows
               voters to download a PDF version to their computers to complete,
               e-mail, print, sign, and send to their local election official via
               mail. Some state and local election officials we spoke with
               indicated that the online version of the Federal Post Card
               Application has many benefits because it is easy to fill out and
               read, and it provides sufficient space for the voter to write in.

    38GAO, Assessing Internal Controls in Performance Audits, [30]GAO/OP-4.1.4
    (Washington, D.C.: September 1990) and Standards for Internal Control in
    the Federal Government (Exposure Draft), GAO/AIMD-98-21 .3.1 (Washington,
    D.C.: December 1997).

               A UOCAVA voter can also use the Federal Write-in Absentee Ballot
               as a backup ballot when the state or territory has not sent a
               regular absentee ballot in time for the voter to participate in
               the election. On October 21, 2004, just a few weeks before the
               national election, FVAP issued a news release announcing the
               electronic version of the ballot as an emergency ballot. The
               Ronald W. Reagan NDAA for Fiscal Year 2005 amended the eligibility
               criteria in UOCAVA39 to allow states and territories to accept the
               Federal Write-in Absentee Ballot under a broader range of
               circumstances. Prior to the change, a UOCAVA citizen had to be
               outside of the United States, have applied for a regular absentee
               ballot early enough to meet state election deadlines, and not have
               received it from the state. Under the new criteria, the Federal
               Write-in Absentee Ballot can be used by military servicemembers
               and their dependents stationed in the United States, as well as by
               military personnel, their dependents, and citizens living
               overseas.

    			  Absence of Internet Absentee Voting Guidelines Has Hindered
    			  Development of the Mandated Internet-Based Absentee Voting
    			  Demonstration Project

               The Election Assistance Commission has not yet developed the
               Internet absentee voting guidelines, and because it is required by
               law to develop them for DOD's use in the secure, Internet-based,
               absentee voting demonstration project, DOD has not moved ahead
               with the project. Commission officials told us that they have not
               yet developed the required Internet absentee voting guidelines
               because the Commission has been working on other
               priorities--including standards for electronic voting machines,
               challenges associated with these electronic voting machines, and a
               process for certification and accreditation--and it lacks the
               resources to work on the Internet absentee voting guidelines or
               the mandated study of the issues and challenges for Internet
               technology at the same time. Although the Internet voting study is
               now underway, the Commission has said that it will not be
               completed until September 2007 and thus does not have the results
               it needs to establish time frames or a plan for developing the
               guidelines. Regarding the demonstration project, DOD officials
               stated that they had not taken action to develop this project
               because the Ronald W. Reagan NDAA for Fiscal Year 2005 requires
               the Commission to develop the guidelines first. DOD officials
               stated that, in an effort to assist the Commission in developing
               the Internet absentee voting guidelines, they have provided
               information on prior Internet voting efforts, along with
               challenges associated with these Internet voting efforts and views
               on how to mitigate those challenges.

    39Pub. L. No. 108-375 S 566(c) (2004).

               The Commission Has Not Developed Internet Absentee Voting
    			  Guidelines because of Other Priorities, Constraints on Resources,
    			  and Lack of DOD Information

               Commission officials stated that they have not developed Internet
               absentee voting guidelines because the Commission and the
               organizations that would normally provide assistance to it are
               directing their constrained resources to other priorities. This
               includes addressing challenges associated with electronic voting
               machines and establishing a process for certification and
               accreditation. Additionally, the Help America Vote Act of 2002
               requires the Commission's Technical Guidelines Development
               Committee to assist the Executive Director of the Commission in
               developing voluntary voting system guidelines.40 The act also
               requires the Director of the National Institute of Standards and
               Technology to provide the Development Committee with technical
               support in developing those guidelines, including research and
               development related to computer and network security, voter
               privacy, remote access voting (including voting through the
               Internet), and voting fraud.

               Commission officials told us, however, that the Development
               Committee has not been able to work on Internet absentee voting
               guidelines for UOCAVA voters because it had other priorities and
               constraints on its resources.41 In light of the Development
               Committee's low priority for working on the Internet absentee
               voting guidelines, officials from the Commission asked officials
               from the National Institute of Standards and Technology to assist
               with developing the guidelines. However, officials from the
               National Institute of Standards and Technology said that they
               could not provide support because they also lacked sufficient
               resources at the time. Commission officials told us that, at the
               time of our review, the National Institute of Standards and
               Technology was also using its resources to work with the
               Development Committee on the current voluntary voting guidelines
               and would not have sufficient resources to work on Internet
               absentee voting guidelines until after July 2007.

               Additionally, Commission officials stated that they were waiting
               for DOD to provide information that describes the type of system
               around which the guidelines should be developed. DOD officials,
               however, stated that they gave the Commission reports that
               provided the framework for the Internet-based absentee voting
               system they envisioned. Specifically, these DOD officials told us
               that they provided the Commission, in 2004, with a report on their
               2000 proof of concept for Internet-based voting called "Voting
               Over the Internet,"42 and in March 2006, they provided the
               Commission with an internal DOD document assessing the terminated
               SERVE project. DOD and Commission officials told us that they had
               not communicated in depth on the guidelines and the DOD system
               before our review.

    40These guidelines provide a set of specifications and requirements to be
    used in the certification of computer-assisted voting systems, both
    paper-based and fully electronic, and are voluntary--that is, states are
    free to adopt them in whole or in part or to reject them entirely.

    41For example, Commission officials told us that the Development Committee
    is working on updates to the Voluntary Voting System Guidelines that were
    established in 2005. These guidelines will become effective December 2007.
    The guidelines focus primarily on electronic voting machines and ballot
    counters, but not on Internet voting systems for UOCAVA voters.

               The Election Assistance Commission Has Started a Study as a
    			  Precursor to the Internet Absentee Voting Guidelines

               To gain a better understanding of the Internet voting environment,
               in September 2006, the Commission started an Internet voting study
               as a precursor to developing the Internet absentee voting
               guidelines. The Help America Vote Act of 2002 required the
               Commission to conduct this study to determine the issues and
               challenges presented by incorporating communications and Internet
               technology into elections, including the potential for election
               fraud, and to issue a report no later than June 29, 2004. However,
               the Commission did not meet this reporting date. Commission
               officials told us that they were unable to complete the study
               sooner--or even begin it--because of the resource constraints they
               have worked under since the Commission's inception, and because
               they were working on other priorities. They noted, for example,
               that under the act, the Commission was to be established by
               February 26, 2003, but the Commissioners were not appointed until
               almost a year later, in December, 2003. They also told us that,
               although 23 employees were allocated to the Commission, they had
               to build up staff gradually, starting in January 2004, by hiring
               two employees each month. Accordingly, Commission officials
               testified in June 200443 that, as a result of these constraints,
               the Commission was able to meet only some of its mandates, such as
               developing the 2005 Voluntary Voting System Guidelines. As a
               result, the Commission was not able to conduct the Internet voting
               study in a timely manner.

    42Department of Defense, Federal Voting Assistance Program: Voting Over
    the Internet, June 2001.

    43Statement of U.S. Election Assistance Commission before the U.S. House
    Of Representatives, Committee on House Administration, dated June 17,
    2004.

               Commission officials stated that the Internet voting study, which
               was underway during the course of our review, includes several
               case studies to monitor current Internet voting usage and
               electronic transmission of ballots. The four states participating
               in this part of the study are Florida, Montana, South Carolina,
               and Illinois. The study also includes (1) a survey of UOCAVA
               voters to collect information on their level of interest in
               electronic voting and (2) a conference to gather states'
               experiences on topics such as Internet voting, electronic
               transmission of ballots, security risks for voting systems, and
               verification of voters' identities. Commission officials told us
               that they plan to issue a final report on the Internet voting
               study in September 2007.

    			  The Commission Does Not Have a Plan for Assessing Security Issues
    			  and Developing Internet Absentee Voting Guidelines

               The Ronald W. Reagan NDAA for Fiscal Year 2005 did not establish a
               deadline by which the Commission was to complete the Internet
               absentee voting guidelines, and the Commission has not set time
               frames for itself, primarily because it has been working on
               guidelines for current voting systems. Additionally, as stated
               previously, the Commission has not completed the precursor
               Internet voting study to identify critical issues and challenges
               such as those related to security and privacy. Also, it has not
               established a plan, in conjunction with major stakeholders like
               DOD, to develop appropriate guidelines for Internet voting with
               specific tasks that would address security risks such as those
               identified in its study and other security evaluations and
               reports, as well as time frames and milestones.

               In previous reports, we have noted that leading organizations
               develop long-term results-oriented plans that involve all
               stakeholders and identify specific tasks, milestones, time frames,
               and contingency plans;44 this practice is also embodied in the
               underlying principles of the Government Performance and Results
               Act of 1993.45 Similarly, without a plan for the UOCAVA Internet
               absentee voting guidelines--including specific tasks, time frames,
               milestones, necessary resources, and alternatives--the Commission
               cannot inform Congress, FVAP, and local election officials when it
               will meet the mandate to develop the required guidelines. As we
               previously noted, some technologies may not yet be mature enough
               to support Internet voting. Therefore, the plan for developing
               Internet absentee voting guidelines may require an incremental
               approach that reflects emerging solutions to security and privacy
               challenges, as well as changing views on acceptable levels of risk
               and cost.

    44GAO, Executive Guide: Effectively Implementing the Government
    Performance and Results Act, GAO-GGD-96-118 (Washington, D.C.: June 1996)
    and Military Readiness: Navy's Fleet Response Plan Would Benefit from a
    Comprehensive Management Approach and Rigorous Testing, [31]GAO-06-84
    (Washington, D.C.: Nov. 22, 2005).

    45Pub. L. No. 103-62 (1993).

               DOD Has Not Developed a Secure, Internet-based, Absentee Voting
    			  Demonstration Project

               Similarly, DOD has not developed a secure, Internet-based absentee
               voting demonstration project, as Congress mandated in the Ronald
               W. Reagan NDAA for Fiscal Year 2005. DOD reported that the
               principal objective of the Internet-based electronic demonstration
               project was to assess the use of such technologies to improve
               UOCAVA participation in elections. The department planned to
               conduct the project during the first general election for federal
               office after the Commission has established Internet voting
               guidelines for the project. However, DOD has not moved forward
               with the electronic demonstration project because, by law, the
               Commission must first develop the Internet absentee voting
               guidelines.

               DOD officials stated, as mentioned previously, that they provided
               information to assist the Commission in developing the guidelines,
               and Commission officials acknowledged that DOD had provided them
               with a report on "Voting Over the Internet," DOD's assessment of
               its November 2000 Internet-based voting project, in 2004--the
               first year of the Commission's operation. DOD also provided the
               Commission with an internal document that contained information on
               its SERVE project. However, Commission officials told us that they
               did not receive the SERVE document until June 2006. This document
               discussed challenges DOD identified with Internet voting, which
               included security threats such as computer viruses, malicious
               insider attacks, and inadvertent errors that could disrupt system
               performance.

               In 2001, we also identified several challenges to Internet voting,
               such as privacy and security.46 As previously mentioned, we
               reported that broad application of Internet voting faced
               formidable challenges, including the difficulty of providing
               adequate voter privacy--that is, protecting the voter's ability to
               cast a ballot without being observed. We further reported that,
               although not unanimous on all issues, groups considering the pros
               and cons of Internet voting were in consensus in identifying
               security as the primary technical challenge for Internet voting.
               We also reported that, because of the security risks involved,
               Internet voting would not likely be implemented on a large scale
               in the near future. Moreover, DOD officials told us that even if
               the Commission had developed Internet voting guidelines at the
               time of our review, DOD would not have been able to develop a
               secure, Internet-based, electronic demonstration project in time
               for the 2008 presidential election. DOD officials said
               that--depending on the Internet voting guidelines provided by the
               Commission--the final system design, full development, testing and
               deployment phases would take an estimated 24 to 60 months.
               Furthermore, deployment of any system requires participation of
               the military services, which have many additional, competing
               priorities that may cause delays in deployment. Given that less
               than 17 months remain before the November 2008 election, FVAP
               officials said there is insufficient time to advertise and launch
               the Internet-based electronic demonstration project.

    46 [32]GAO-01-1026 ; [33]GAO-02-3 .

               DOD Was Developing Plans to Expand the Use of Electronic Voting
    			  Technology in the Future, but Sound Management Practices Are Key

               We observed that DOD was developing, but had not yet completed,
               plans to expand the use of electronic voting technology for UOCAVA
               voters use in federal elections through November 2010, as required
               by the John Warner NDAA for Fiscal Year 2007. DOD officials told
               us that they anticipated providing the plans to Congress, in
               accordance with the act, by May 15, 2007. Because electronic
               voting initiatives for the absentee voting process (fax, e-mail,
               and Internet) involve numerous stakeholders at the federal
               level--including DOD and the Commission--as well as the various
               state and local levels, developing a plan is key. Implementation
               of new electronic voting initiatives requires careful planning,
               particularly in light of the remote location of troops, the
               application of new technology, and the lead time required for
               implementation. As DOD develops these plans, employing a
               comprehensive strategic approach that incorporates sound
               management principles could provide a framework for DOD's plans.
               Our analyses of DOD and Commission documents and our
               interviews--including those with officials from these agencies,
               organizations representing UOCAVA voters, and state and local
               election officials--show that DOD did not obtain sufficient
               stakeholder involvement in planning its recent electronic voting
               initiatives--the 2004 and 2006 IVAS initiatives. In fact,
               Commission officials mentioned that DOD's recent initiatives took
               a "top down" approach and did not seek input from the Commission
               or from local jurisdictions during the planning stage. DOD
               officials noted that both the 2004 and 2006 IVAS initiatives were
               planned, designed, advertised, and implemented just months before
               those two elections. In the case of the 2006 IVAS, however, the
               department reported that it developed the system within 79 days of
               passage of the mandate--June 2006--and noted that it was in fact
               responsive to that mandate. The Commission and state and local
               election officials noted that the aggressive schedules for these
               latest electronic initiatives did not allow sufficient time to
               enable full participation, training, and dissemination of
               information on the efforts. Additionally, at the time of our
               review, DOD officials said they had not yet established interim
               tasks that address issues such as security and privacy,
               milestones, time frames, and contingency plans.

               The principles of sound management used by leading organizations
               and embodied in the Government Performance and Results Act of
               199347 provide a methodology to establish a results-oriented
               framework for DOD to develop its detailed plans. Such a framework
               would provide a firm foundation for DOD's long-term plan for
               electronic voting initiatives. Some of the key management
               principles include (1) involving stakeholders when defining the
               mission and outcomes, (2) identifying specific actions and tasks,
               such as monitoring and assessing security of the initiatives, (3)
               developing schedules and time frames for tasks, and (4) evaluating
               the overall effort, with specific processes to allow for
               adjustments and changes. Furthermore, as we reported in one of our
               executive guides, leading organizations plan for a continuous
               cycle of risk management. This includes determining needs,
               assessing security risks, implementing policies and controls,
               promoting awareness, and monitoring and evaluating controls.48
               Combined with effective leadership, these principles provide
               decision makers with a framework to guide program efforts and the
               means to determine if these efforts are achieving the desired
               results.

               In its December 2006 report to Congress on IVAS,49 DOD stated the
               following:

               o Development of a long-term strategic plan was necessary to
               ensure that all related initiatives were effectively integrated,
               but this was dependent on having sufficient time to assess,
               improve, and evaluate new or evolving electronic alternatives.
               o Major recommendations for its future electronic voting projects
               would include, for example,

                            o recognizing the variation in state and local laws,
                            procedures, and systems;
                            o identifying and mitigating actual and perceived
                            risks, by educating people about risk management
                            practices; and
                            o building consensus among key stakeholders.

    47Pub. L. No. 103-62 (1993).  [34]GAO/GGD-96-118 .

    48GAO, Executive Guide: Information Security Management, Learning From
    Leading Organizations, [35]GAO/AIMD-98-68 (Washington, D.C.: May 1998).

    49DOD, Report on IVAS 2006.

               As stated previously, Commission officials told us that, for
               recent initiatives, DOD did not seek input from the Commission or
               local jurisdictions during the planning stage of these efforts.
               Without a proactive, integrated, long-term, results-oriented plan
               that involves all major stakeholders; includes goals, interim
               tasks--such as identifying security risks and addressing privacy
               concerns--milestones, time frames, and contingency plans; and
               follows the sound management practices used by leading
               organizations, DOD is not in a position to address congressional
               expectations to establish secure and private electronic and
               Internet-based voting initiatives.

    			  Conclusions

               It is imperative that the 6 million Americans who are covered
               under the Uniformed and Overseas Citizens Absentee Voting Act have
               the opportunity to exercise their right to vote--one of the
               hallmarks of a democratic society. The fact that time is an issue
               with absentee voting by regular mail has led many to look toward
               electronic and Internet voting, which represent the next
               generation of voting technology, as alternatives. While these
               alternatives may expedite the absentee voting process, they are
               more vulnerable to privacy and security compromises than the
               conventional methods now in use. Electronic and Internet voting
               require safeguards to limit such vulnerabilities and prevent
               compromises to votes from intentional actions or inadvertent
               errors. However, available safeguards may not adequately reduce
               the risks of compromise. To date, the Election Assistance
               Commission has not assessed the risks or possible safeguards for
               Internet voting, nor has it developed corresponding guidelines
               that define minimum Internet voting capabilities and safeguards to
               be considered by the election community. Furthermore, electronic
               and Internet-based absentee voting can be challenging for UOCAVA
               voters, who reside at multiple locations across the globe. These
               voters are also registered to vote in thousands of local
               jurisdictions across 55 states and territories that employ varying
               levels of technology--from paper ballots to faxes and e-mail. DOD
               faces significant challenges in leveraging electronic and Internet
               technology to facilitate this complex, global absentee voting
               process. Delays in developing guidelines and a demonstration
               project have resulted in two presidential elections passing
               without significant progress in moving toward expanded use of
               electronic and Internet absentee voting. DOD officials told us it
               is now too late in the cycle to implement significant changes
               before the 2008 election. The challenges of coordinating among
               numerous stakeholders--including DOD, the Commission, and state
               and local election officials, as well as organizations
               representing UOCAVA voters--are substantial, and, to date, efforts
               to involve stakeholders in the planning stage of DOD's recent
               initiatives have fallen short. This delay has left an expectation
               gap between what Congress required and what has been accomplished
               so far. Several steps would have to be taken to overcome these
               challenges, including better coordination between the Commission
               and DOD regarding their complementary roles in developing Internet
               voting guidelines and the mandated demonstration project. Unless
               the Commission and DOD move in a timely manner to assess the
               technology risks, develop guidelines that address the risks,
               coordinate among election stakeholders, and establish and execute
               prudent plans, they are unlikely to meet the expectations of
               Congress and military and overseas voters to establish a secure
               and private electronic and Internet-based UOCAVA voting
               environment.

    			  Recommendations for DOD

               To improve the security and accuracy of DOD's electronic and
               Internet initiatives, we recommend that the Secretary of Defense
               direct the Under Secretary of Defense for Personnel and Readiness
               to take the following four actions:

               o Comply with the information security requirements in the DOD
               Certification and Accreditation Process guidance.
               o Incorporate lessons learned into plans for future systems such
               as those we identified, including adding cautionary statements to
               future ballot request and receipt systems to warn UOCAVA voters to
               remove personal data from their computers.
               o Institutionalize a process to review online UOCAVA guidance to
               ensure that DOD provides accurate and consistent information to
               UOCAVA voters.
               o Create an integrated, comprehensive, long-term, results-oriented
               plan for future electronic voting programs that specifies, among
               other things, the goals to be achieved along with tasks including
               identifying safeguards for the security and privacy of all DOD's
               voting systems--both electronic and Internet. The plan should also
               specify milestones, time frames, and contingencies; synchronize
               them with planned development of the Commission's guidelines for
               Internet voting; and be developed in conjunction with major
               stakeholders--including state and local election officials, the
               Election Assistance Commission, overseas voting groups, and each
               of the armed services. The plan should also include initiatives
               that will be done well in advance of federal elections, to allow
               adequate time for training and dissemination of information on the
               options available to UOCAVA voters.

    			  Recommendations for the Election Assistance Commission

               To improve the Election Assistance Commission's efforts to comply
               with the direction from Congress to develop the Internet absentee
               voting guidelines, we recommend that the Commission take the
               following two actions:

               o Determine, in conjunction with major stakeholders like DOD,
               whether the Commission's 2007 Internet voting study and any other
               Commission efforts related to Internet or electronic voting are
               applicable to DOD's plans for Internet-based voting, and
               incorporate them where appropriate.
               o Develop and execute, in conjunction with major
               stakeholders--including state and local election officials and
               DOD--a results-oriented action plan that specifies, among other
               things, goals, tasks, milestones, time frames, and contingencies
               that appropriately address the risks found in the UOCAVA voting
               environment--especially risks related to security and privacy.

    			  Agency Comments and Our Evaluation

               In written comments on a draft of this report, DOD concurred with
               our recommendations to (1) comply with the information security
               requirements, (2) incorporate lessons learned into plans for
               future systems--to include adding cautionary statements to warn
               UOCAVA voters to remove personal data from their computers, (3)
               institutionalize a process to review online UOCAVA guidance, and
               (4) create a comprehensive, results-oriented, long-term plan for
               future electronic voting initiatives. The department said that it
               will contract for services to comply with the information security
               requirements and will incorporate identified lessons learned into
               future registration, ballot request, and ballot receipt systems.
               The department said that it has already streamlined its online
               guidance by, among other things, eliminating the archived
               "Publications" version of the Voting Assistance Guide entirely; it
               will also establish a revised review process for online
               information. DOD noted that these changes will reduce the
               possibility of human error and simplify the review and
               verification process of online information. Finally, DOD stated
               that it was in full support of a long-term, comprehensive plan for
               future electronic voting projects that would allow for sufficient
               time to involve the major stakeholders, train, and disseminate
               information and ultimately serve UOCAVA voters. The department
               said it looked forward to working on this multiyear project plan
               in cooperation with the Election Assistance Commission, the
               National Institute of Standards and Technology, and other major
               stakeholders. It further stated that FVAP, the Commission, and the
               National Institute of Standards and Technology are scheduling a
               meeting to lay the groundwork for the plan. DOD's comments are
               reprinted in appendix III. DOD also provided technical comments,
               which we incorporated in the final report, as appropriate.

               In its written comments, the Election Assistance Commission
               concurred with our recommendations to (1) determine the
               applicability of the Commission's 2007 Internet voting study and
               other Commission studies to DOD's plans for Internet-based voting,
               and (2) develop and execute a results-oriented action plan to
               provide guidelines that appropriately address the risks found in
               the UOCAVA voting environment. The Commission stated that it has
               already met with FVAP and the National Institute of Standards and
               Technology and agreed to develop a time line for creating the
               UOCAVA guidelines. The Commission's comments are reprinted in
               appendix IV.

               We are sending copies of this report to the Secretary of Defense
               and the Under Secretary of Defense (Personnel and Readiness) and
               the Commissioners of the Election Assistance Commission. We will
               also make copies available to others upon request. In addition,
               the report will be available at no charge on the GAO Web site at
               http://www.gao.gov .

               Should you or your staff have any questions about this report,
               please contact me at (202) 512-5559. Contact points for our
               Offices of Congressional Relations and Public Affairs may be found
               on the last page of this report. Key contributors to this report
               are listed in appendix V.

               Derek Stewart
    			  Director, Defense Capabilities and Management

    			  Appendix I: Scope and Methodology

               To assess DOD's electronic initiatives, we reviewed and analyzed
               relevant laws, directives, and guidance. These included DOD
               Directive 1000.4, Federal Voting Assistance Program (FVAP),
               updated April 14, 2004; and DOD's Interim Department of Defense
               (DOD) Certification and Accreditation (C&A) Process Guidance,
               dated July 6, 2006. We also reviewed applicable requirements
               documents for DOD's electronic efforts, as well as relevant
               reports by GAO, DOD, FVAP, the DOD Inspector General, and others,
               including A Security Analysis of the Secure Electronic
               Registration and Voting Experiment (SERVE), dated January 21,
               2004. In addition, we reviewed FVAP's 2006-2007 Voting Assistance
               Guide and its Web site to ascertain what type of information on
               electronic voting alternatives is provided to UOCAVA citizens.

               We interviewed key program officials at the Office of the Under
               Secretary of Defense for Personnel and Readiness's Federal Voting
               Assistance Program (FVAP), the Business Transformation Agency, the
               Defense Manpower Data Center, and Voting Action Officers from
               several service headquarters. We also contacted officials from (1)
               election organizations, including the National Association of
               Secretaries of State and Joint Election Officials Liaison
               Committee and (2) organizations representing UOCAVA voters,
               including those from the National Defense Committee and the
               Overseas Vote Foundation. We made contact with officials from 14
               of the 16 state and local election offices we called to obtain
               their perspectives on DOD's initiatives. Specifically, we included
               all 11 states that had participated in DOD's 2006 Integrated
               Voting Alternative Site--some of which participated in SERVE and
               other DOD programs and initiatives. We also included three other
               states that had 10 or more military bases and had participated in
               SERVE though not in IVAS. Table 3 lists the states we contacted
               and the programs in which these states participated.

    Table 3: State Offices Contacted and Programs Where the States Were
    Participants

              States         SERVE          IVAS Tool 1          IVAS Tool 2
              contacted      participantsa  participantsa        participantsa
    1      Arkansas       Yes            Yes                  No
    2      Florida        Yes            No                   No
    3      Hawaii         Yes            No                   No
    4      Illinois       No             Yes                  No
    5      Indiana        No             No                   Yes
    6      Kentucky       No             No                   Yes
    7      Mississippi    No             Yes                  No
    8      Montana        No             No                   Yes
    9      North Carolina Yes            Yes                  No
    10     Puerto Rico    No             Yes                  No
    11     South Carolina Yes            No                   No
    12     Vermont        No             Yes                  No
    13     Virgin Islands No             Yes                  No
    14     Washington     Yes            Yes                  No
    Totals 14 states      6 SERVE states 8 IVAS Tool 1 states 3 IVAS Tool 2
              contacted      contacted      contacted            states contacted

    Source: GAO analysis of DOD data.

    aWhile a number of jurisdictions were included under each of the DOD
    programs listed, we spoke to at least one election official from each
    state.

    To determine the Commission's efforts to develop Internet voting
    guidelines and DOD's efforts to develop the secure, Internet-based,
    absentee voting demonstration project, we reviewed and analyzed relevant
    laws, Commission reports, and to the extent they existed, the Commission's
    strategic plan and other documents to ascertain its plans and efforts to
    develop Internet voting guidelines for UOCAVA voters. We also reviewed and
    analyzed various DOD requirements documents, GAO reports, internal DOD
    reports, and other reports related to DOD's prior Internet-based absentee
    voting initiatives--Voting Over the Internet and SERVE--to ascertain,
    among other things, challenges and benefits associated with Internet
    voting efforts. Additionally, we interviewed key program officials within
    FVAP, including the Director and Deputy Director of FVAP and the Project
    Manager for SERVE, who is currently retired, along with officials on DOD's
    private sector Security Peer Review Group. We also spoke with officials on
    the Commission's Technical Guidelines Development Committee and with the
    National Institute of Standards and Technology.

    To ascertain DOD's efforts to develop plans to expand the use of
    electronic voting technologies in the future, we reviewed and analyzed
    laws, guidance, and reports to determine DOD's current and future plans
    for the Internet-based absentee voting demonstration project.
    Additionally, we examined, to the extent they existed, DOD's strategic
    plan and other documentation to determine its current and future plans for
    the Internet-based absentee voting demonstration project. We also
    interviewed responsible officials within DOD about these plans--including
    the Principal Deputy Under Secretary of Defense for Personnel and
    Readiness and the Director and Deputy Director of FVAP.

    We conducted our work from August 2006 through April 2007 in accordance
    with generally accepted government auditing standards.

    Appendix II: Examples of the Inconsistent Voting Assistance Guidance on
    DOD's Web Site

    During the course of our review, we compared and analyzed the voting
    assistance guidance provided on DOD's Federal Voting Assistance Program
    (FVAP) Web site that covered electronic alternatives to mail. The online
    links we reviewed included FVAP's: (1) 2006-2007 Voting Assistance Guide
    (VAG)--a PDF version;1 (2) 2006-2007 VAG--an HTML version; 2 (3) the
    archived 2006-2007 VAG--a PDF version dated October 25, 2005;3 (4) changes
    to the archived 2006-2007 VAG--called Errata Sheets; (5) News Releases;
    and (6) the 2006 Integrated Voting Alternative Site (IVAS). While not
    widespread, for 14 of the 55 states and territories, we found differences
    in some of the guidance provided on these links.4 Table 4 shows the
    differences we identified.

    Table 4: Inconsistencies Identified in Guidance on Electronic Alternatives
    to Mail

                     Differences                                    GAO
          State      identified       Questions      FVAP response  observation
    1  California Both PDF         Could an       IVAS page was  Correction to
                     versions and the absentee       incorrect and  IVAS has been
                     HTML Voting      ballot sent by was updated    verified.
                     Assistance       fax by         on1/25/07. The
                     Guides state     military       instruction
                     that only        personnel      should have
                     overseas         within the     specified that
                     military and     United States  Uniformed
                     overseas         be rejected if Servicemembers
                     citizens may     a voter        must be
                     receive and send covered under  overseas to
                     the ballot by    the Uniformed  receive and
                     fax.             and Overseas   send the
                                      Citizens       ballot by fax.
                     IVAS instruction Absentee       By law, an
                     does not         Voting Act     absentee
                     restrict who can relied solely  ballot faxed
                     receive or send  on IVAS for    from within
                     the ballot by    voting         the United
                     fax.             guidance?      States should
                                                     be rejected.
    2  Colorado   The News Release Would overseas The Voting     Corrections to
                     for Colorado on  uniformed      Assistance     PDF, HTML, and
                     October 18,      voters know of Guide, PDF,    errata sheet
                     2006, and IVAS   the e-mail     HTML, and      have been
                     "allow Uniformed options if     errata sheet   verified.
                     Servicemembers   they relied on have been
                     deployed outside the Voting     updated to     FVAP stated
                     the U.S. to      Assistance     reflect the    that the
                     request,         Guide for      change. Web    "Publications"
                     receive, and     voting         site changes   version of the
                     return absentee  guidance?      to the Voting  Voting
                     ballots via                     Assistance     Assistance
                     e-mail."                        Guide were     Guide in PDF
                                                     made January   format was the
                     This is not                     22, 2007.      original book
                     reflected in the                               version of the
                     two PDF versions                               Guide in
                     or HTML Voting                                 electronic
                     Assistance                                     form. Since it
                     Guides, nor was                                was considered
                     an errata sheet                                an archived
                     created.                                       document, FVAP
                                                                    officials
                                                                    stated that it
                                                                    was not
                                                                    intended for
                                                                    update; but,
                                                                    acknowledged
                                                                    that this
                                                                    version could
                                                                    have been
                                                                    marked better
                                                                    as an archived
                                                                    document.
                                                                    These
                                                                    officials have
                                                                    since deleted
                                                                    this version
                                                                    of the Guide
                                                                    from their Web
                                                                    site.
    3  Illinois   FVAP issued an   Would          The fax and    Corrections to
                     errata sheet for uniformed      e-mail         IVAS and HTML
                     Illinois on      voters be      provisions on  have been
                     September 29,    aware of the   the errata     verified.
                     2006, and all    fax and e-mail sheet and the
                     changes except   provisions if  Voting         FVAP officials
                     one are          they relied on Assistance     acknowledged
                     reflected in the IVAS, HTML     Guide PDF are  that the
                     HTML and PDF     Voting         correct as     "Publications"
                     "Publications"   Assistance     accepted by    version of the
                     versions of the  Guide, or      the State of   Voting
                     Voting           "publications" Illinois. The  Assistance
                     Assistance Guide PDF version?   IVAS page and  Guide could
                     and IVAS did not                the Voting     have been
                     mention the                     Assistance     marked better
                     change.                         Guide HTML     as an archived
                                                     were missing   document, and
                     Specifically,                   the            have since
                     the change that                 information    deleted this
                     is not captured                 about the City version of the
                     is in Item IIE                  of Chicago and Guide from
                     (Uniformed                      Suburban Cook  their Web
                     Services):                      County         site.
                                                     allowing
                     "The                            receipt of the
                     Publications"                   blank ballot
                     PDF and HTML                    by fax or
                     Voting                          e-mail. The
                     Assistance                      information
                     Guides say                      was added on
                     Illinois does                   both the IVAS
                     not allow                       and the HTML
                     receipt of blank                on January 26,
                     ballots by fax                  2007.
                     or e-mail and
                     IVAS does not                   See note below
                     address this                    on
                     issue.                          "Publications"
                                                     version of the
                                                     Voting
                                                     Assistance
                                                     Guide.a
    4  North      FVAP issued a    Would voters   Voting         Corrections to
          Carolina   News Release and covered under  Assistance     PDF and HTML
                     updated IVAS on  the Uniformed  Guide pages    Voting
                     October 20,      and Overseas   updated to     Assistance
                     2006, stating    Citizens       reflect        Guide and
                     that North       Absentee       information    errata sheet
                     Carolina now     Voting Act     contained in   have been
                     allows all       know of the    News Release   verified.
                     citizens covered fax or e-mail  on January 29,
                     under the        options if     2007.          FVAP officials
                     Uniformed and    they relied on                acknowledged
                     Overseas         the Voting     See note below that
                     Citizens         Assistance     on             "Publications"
                     Absentee Voting  Guide          "Publications" version of the
                     Act to, among    publications?  version of the Voting
                     other things,                   Voting         Assistance
                     receive blank                   Assistance     Guide could
                     absentee ballots                Guide.a        have been
                     and return voted                               marked better
                     ballots by fax.                                as an archived
                     It also stated                                 document, and
                     that the Federal                               have since
                     Post Card                                      deleted this
                     Application                                    version of the
                     could be faxed                                 Guide from
                     or e-mailed.                                   their Web
                                                                    site.
                     This information
                     was not
                     reflected in the
                     FVAP PDFs or
                     HTML versions of
                     the Voting
                     Assistance
                     Guide, nor was
                     an errata sheet
                     created.
    5  Rhode      Rhode Island's   Would overseas The language   Corrections to
          Island     Overseas         civilians know in question    the PDF, HTML,
                     Civilians        of the option  does not refer IVAS, and
                     instructions for to request the to the ability errata sheet
                     FVAP's PDFs and  blank ballot   of the voter   have been
                     HTML Voting      by e-mail if   to request an  verified.
                     Assistance Guide they relied on absentee
                     include language Section IIIE   ballot via
                     in Section IIIB  of the Voting  e-mail, but to
                     stating that     Assistance     request that a
                     ballots "may be  Guide or IVAS? copy of a
                     requested by                    state form
                     using the                       (now
                     Federal Post                    discarded) be
                     Card                            sent to them,
                     Application,                    which could be
                     letter,                         requested by
                     telephone, fax,                 using a
                     or e-mail."                     Federal Post
                                                     Card
                     This language                   Application,
                     contradicts                     via fax,
                     guidance in                     e-mail, phone,
                     Section IIIE of                 etc. Given
                     the HTML and PDF                that the state
                     Voting                          form has been
                     Assistance                      discarded, the
                     Guides which                    Voting
                     only mentions                   Assistance
                     fax                             Guide has been
                     transmissions.                  updated to
                                                     reflect the
                     Furthermore, the                change. Web
                     IVAS Web site                   site changes
                     says no e-mail                  to the Voting
                     is permitted.                   Assistance
                                                     Guide were
                                                     made January
                                                     29, 2007.
    6  South      South Dakota's   Would          The change was Correction to
          Dakota     errata sheet     stateside      made by South  the HTML has
                     from June 19,    military       Dakota and     been verified.
                     2006 and the PDF voters know    approval
                     Voting           that they are  signed. The    IVAS referred
                     Assistance Guide required to    PDF and errata the voter to
                     require the      have the       sheet were     the Voting
                     Federal Post     Federal Post   changed, the   Assistance
                     Card Application Card           HTML was       Guide
                     be notarized for Application    overlooked,    instructions.
                     stateside        notarized if   and correction
                     military voters. they rely on   was made       FVAP officials
                                      IVAS, HTML or  January 26,    acknowledged
                     This is not      "Publications" 2007. The IVAS that
                     mentioned as a   Voting         page did not   "Publications"
                     requirement in   Assistance     contain full   version of the
                     IVAS, or the     Guides instead instructions   Voting
                     HTML or          of the errata  but referred   Assistance
                     "Publications"   sheet?         the reader to  Guide could
                     Voting                          the Voting     have been
                     Assistance                      Assistance     marked better
                     Guide.                          Guide          as an archived
                     (Specifically,                  instructions.  document, and
                     these say that                                 have since
                     "no registration                See note below deleted this
                     or voting                       on             version of the
                     materials are                   "Publications" Guide from
                     notarized or                    version of the their Web
                     witnessed.")                    Voting         site.
                                                     Assistance
                                                     Guide.a
    7  South      South Dakota's   Would voters   See note below FVAP officials
          Dakota     errata sheet     covered under  on             acknowledged
                     from October 4,  the Uniformed  "Publications" that
                     2006, and HTML   and Overseas   version of the "Publications"
                     and PDF Voting   Citizens       Voting         version of the
                     Assistance       Absentee       Assistance     Voting
                     Guides allow     Voting Act     Guide.a        Assistance
                     voters covered   know of the                   Guide could
                     under the        option to send                have been
                     Uniformed and    the Federal                   marked better
                     Overseas         Post Card                     as an archived
                     Citizens         Application by                document, and
                     Absentee Voting  fax or via                    have since
                     Act to send the  e-mail                        deleted this
                     Federal Post     attachment if                 version of the
                     Card Application they relied on                Guide from
                     by fax and allow the                           their Web
                     a voter to       "Publications"                site.
                     submit a scanned Voting
                     application as   Assistance
                     an e-mail        Guide?
                     attachment.

                     This is not
                     reflected in the
                     "Publications"
                     Voting
                     Assistance
                     Guide.
    8  Utah       Utah's errata    Would          Change was     Correction to
                     sheet from May   uniformed      made to        the HTML has
                     11, 2006, and    voters know    reflect Utah's been verified.
                     PDF Voting       that they were election law
                     Assistance Guide not required   and approval   FVAP officials
                     (uniformed       to have their  signed. The    acknowledged
                     services) states voting         PDF and errata that
                     that             materials      sheet were     "Publications"
                     registration and notarized if   corrected,     version of the
                     voting materials they relied on however, the   Voting
                     are not          the HTML or    HTML was       Assistance
                     notarized or     "Publications" overlooked.    Guide could
                     witnessed.       Voting         Correction was have been
                                      Assistance     made January   marked better
                     This is not      Guide?         26, 2007. See  as an archived
                     reflected in the                note below on  document, and
                     HTML or PDF                     "Publications" have since
                     "Publications"                  version of the deleted this
                     version of the                  Voting         version of the
                     Voting                          Assistance     Guide from
                     Assistance                      Guide.a        their Web
                     Guide.                                         site.

                     For example, the
                     HTML Voting
                     Assistance Guide
                     says that no
                     notary or
                     witness is
                     required, but
                     mentions
                     certification.
    9  Vermont    While the notary Would overseas The PDF Voting Correction to
                     section of       civilians know Assistance     the PDF has
                     Civilian Outside that their     Guide had the  been verified.
                     U.S. in the PDF  signature is   signed
                     Voting           required on    approval of
                     Assistance Guide the inside     Vermont. The
                     has the          envelope       missing line
                     statement about  certificate if was simply
                     witness          they relied on overlooked by
                     requirements for the PDF Voting the state and
                     the return       Assistance     FVAP and was
                     ballot, it does  Guide?         updated on
                     not have the                    January 25,
                     statement:                      2007.
                     "However, your
                     signature must
                     be on the inside
                     envelope
                     certificate."

                     This line is
                     reflected in the
                     HTML Voting
                     Assistance Guide
                     and in all
                     notary sections
                     of the Uniformed
                     Services Voting
                     Assistance
                     Guides.
    10 Alaska     The HTML,        Would voters   See note below FVAP officials
                     "State-by-State" covered under  on             acknowledged
                     PDF Voting       the Uniformed  "Publications" that
                     Assistance       and Overseas   version of the "Publications"
                     Guide, and IVAS  Citizens       Voting         version of the
                     instruction      Absentee       Assistance     Voting
                     allow e-mailing  Voting Act     Guide.a        Assistance
                     of the blank     know of the                   Guide could
                     ballot and voted option to                     have been
                     ballot.          e-mail the                    marked better
                                      blank and                     as an archived
                     This is not      voted ballot                  document, and
                     reflected in the if they relied                have since
                     "Publications"   on the                        deleted this
                     version of the   "Publications"                version of the
                     PDF Voting       Voting                        Guide from
                     Assistance Guide Assistance                    their Web
                     for Alaska.      Guide?                        site.
    11 Oregon     An errata sheet  Would voters   See note below FVAP officials
                     on August 22,    covered under  on             acknowledged
                     2006 for Oregon  the Uniformed  "Publications" that
                     and the HTML and and Overseas   version of the "Publications"
                     PDF Voting       Citizens       Voting         version of the
                     Assistance       Absentee       Assistance     Voting
                     Guides added, in Voting Act     Guide.a        Assistance
                     addition to      know of the                   Guide could
                     faxing, the      option to use                 have been
                     words "or        e-mail for                    marked better
                     e-mail" to the   their voting                  as an archived
                     electronic       materials if                  document, and
                     transmission     they relied on                have since
                     sections in the  the                           deleted this
                     Voting           "Publications"                version of the
                     Assistance       Voting                        Guide from
                     Guide.           Assistance                    their Web
                                      Guide?                        site.
                     This information
                     is not reflected
                     in the
                     "Publications"
                     version of the
                     Voting
                     Assistance
                     Guide.
    12 South      An errata sheet  Would voters   See note below FVAP officials
          Carolina   and a news       covered under  on             acknowledged
                     release on May   the Uniformed  "Publications" that
                     5, 2006 and the  and Overseas   version of the "Publications"
                     HTML and PDF     Citizens       Voting         version of the
                     Voting           Absentee       Assistance     Voting
                     Assistance       Voting Act     Guide.a        Assistance
                     Guides announced know of the                   Guide could
                     that voters are  fax and e-mail                have been
                     allowed to       options if                    marked better
                     receive and      they relied on                as an archived
                     return the       the                           document, and
                     ballot by fax or "Publications"                have since
                     e-mail under any Voting                        deleted this
                     conditions or    Assistance                    version of the
                     circumstances.   Guide?                        Guide from
                                                                    their Web
                     This information                               site.
                     is not reflected
                     in the
                     "Publications"
                     version of the
                     Voting
                     Assistance
                     Guide, which
                     only allows fax
                     and e-mail for
                     emergencies.
    13 Texas      FVAP issued an   Would voters   See note below FVAP officials
                     errata sheet for covered under  on             acknowledged
                     Texas on July    the Uniformed  "Publications" that
                     24, 2006, that   and Overseas   version of the "Publications"
                     changed the      Citizens       Voting         version of the
                     first bullet in  Absentee       Assistance     Voting
                     both electronic  Voting Act     Guide.a        Assistance
                     transmission     know the fax                  Guide could
                     sections, which  option was for The state of   have been
                     says Texas       only to        Texas only     marked better
                     allows voters to request the    allows faxing  as an archived
                     send the Federal ballot and     to be used to  document, and
                     Post Card        temporary      request a      have since
                     Application by   registration,  ballot and for deleted this
                     fax; but adds    if they relied temporary      version of the
                     "to request an   on the         registration.  Guide from
                     absentee ballot  "Publications" It is not      their Web
                     and for          Voting         allowed for    site.
                     temporary        Assistance     the use of
                     registration     Guide?         permanent
                     only."                          registration.
                                                     The impact on
                     This information                voters may be
                     was in the HTML                 negligible as
                     and PDF Voting                  these voters
                     Assistance                      still receive
                     Guides but is                   ballots for
                     not reflected in                two successive
                     the                             election
                     "Publications"                  cycles.
                     version of the
                     Voting
                     Assistance
                     Guide.
    14 Virginia   An errata sheet  Would          See note below FVAP officials
                     for Virginia on  stateside      on             acknowledged
                     July 20, 2006,   military       "Publications" that
                     and the HTML and members know   version of the "Publications"
                     PDF Voting       of the         Voting         version of the
                     Assistance       stipulation    Assistance     Voting
                     Guides allow     that only      Guide.a        Assistance
                     only overseas    overseas                      Guide could
                     military members military                      have been
                     to receive the   members may                   marked better
                     blank ballot by  receive the                   as an archived
                     e-mail or fax    blank ballot                  document, and
                     upon request.    by e-mail or                  have since
                                      fax if they                   deleted this
                     This information relied on the                 version of the
                     is not reflected "Publications"                Guide from
                     in the           Voting                        their Web
                     "Publications"   Assistance                    site.
                     version of the   Guide?
                     Voting
                     Assistance
                     Guide.
    15 Virginia   An errata sheet  Would overseas See note below FVAP officials
                     for Virginia on  civilians know on             acknowledged
                     July 20, 2006,   of the         "Publications" that
                     and the HTML and stipulation    version of the "Publications"
                     PDF Voting       that only some Voting         version of the
                     Assistance       Virginia       Assistance     Voting
                     Guides changed   counties and   Guide.a        Assistance
                     the Civilian     cities allow                  Guide could
                     language to      receipt of the                have been
                     "Some Virginia   blank ballot                  marked better
                     counties and     by fax or                     as an archived
                     cities allow you e-mail if they                document, and
                     to receive the   relied on the                 have since
                     blank ballot by  "Publications"                deleted this
                     e-mail or fax    Voting                        version of the
                     upon request."   Assistance                    Guide from
                                      Guide?                        their Web
                     This limiting                                  site.
                     information
                     "some" is not
                     reflected in the
                     "Publications"
                     version of the
                     Voting
                     Assistance
                     Guide. It simply
                     says that
                     Virginia "allows
                     you to receive
                     the blank ballot
                     you e-mail or
                     fax upon
                     request."
    16 Wisconsin  FVAP issued an   Would voters   See note below FVAP officials
                     errata sheet on  covered under  on             acknowledged
                     July 24, 2006    the Uniformed  "Publications" that
                     for Wisconsin    and Overseas   version of the "Publications"
                     allowing voters  Citizens       Voting         version of the
                     to send the      Absentee       Assistance     Voting
                     Federal Post     Voting Act     Guide.a        Assistance
                     Card Application know of the                   Guide could
                     for absentee     option to send                have been
                     ballot request   the Federal                   marked better
                     by fax or        Post Card                     as an archived
                     e-mail.          Application by                document, and
                                      fax or e-mail                 have since
                     This information if they relied                deleted this
                     is not reflected on the                        version of the
                     in the           "Publications"                Guide from
                     "Publications"   Voting                        their Web
                     Voting           Assistance                    site.
                     Assistance       Guide instead
                     Guide.           of the errata
                                      sheet?

    1PDF means Portable Document Format; it is a file format that is used to
    view electronic copies of paper documents, which allows an exact copy of
    the paper document.

    2HTML means Hypertext Markup Language and is used to structure and format
    documents to be displayed on the World Wide Web.

    3This 2006-2007 VAG was accessed at
    http://www.fvap.gov/pubs/vag/pdfvag/2006-07vag.pdf ; but DOD deleted
    this link in February 2007.

    4We found 16 instances in total. Two of the states had two separate
    discrepancies identified.

    Source: GAO analysis of DOD information.

    aFVAP stated that the "Publications" version of the Voting Assistance
    Guide in PDF format (
    http://www.fvap.gov/pubs/vag/pdfvag/2006-07vag.pdf ) created on
    October 25, 2005, was the original book version of the Voting Assistance
    Guide in electronic format. Since it was considered an archived document
    it was not intended for update.

    Appendix III: Comments from the Department of Defense

    Appendix IV: Comments from the Election Assistance Commission

    Appendix V: GAO Contact and Staff Acknowledgments

    GAO Contact

    Derek B. Stewart, (202) 512- 5559 or stewartd@gao.gov

    Acknowledgments

    In addition to the individual named above, David E. Moser, Assistant
    Director; Marion A. Gatling; Pawnee A. Davis; Amber M. Lopez; Joanne
    Landesman; Paula A. Moore; John K. Needham, John J. Smale; and Julia C.
    Matta made key contributions to this report.

    Related GAO Products

    Elections: All Levels of Government Are Needed to Address Electronic
    Voting System Challenges. [38]GAO-07-576T . Washington, D.C.: March 7,
    2007.

    Elections: DOD Expands Voting Assistance to Military Absentee Voters, but
    Challenges Remain. [39]GAO-06-1134T . Washington, D.C.: September 28,
    2006.

    Elections: The Nation's Evolving Election System as Reflected in the
    November 2004 General Election. [40]GAO-06-450 . Washington, D.C.: June 6,
    2006.

    Election Reform: Nine States' Experiences Implementing Federal
    Requirements for Computerized Statewide Voter Registration Lists.
    [41]GAO-06-247 . Washington, D.C.: February 7, 2006.

    Elections: Views of Selected Local Election Officials on Managing Voter
    Registration and Ensuring Eligible Citizens Can Vote. [42]GAO-05-997 .
    Washington, D.C.: September 27, 2005.

    Elections: Federal Efforts to Improve Security and Reliability of
    Electronic Voting Systems Are Under W ay, but Key Activities Need to Be
    Completed. [43]GAO-05-956 . Washington, D.C.: September 21, 2005.

    Elections: Additional Data Could Help State and Local Elections Officials
    Maintain Accurate Voter Registration Lists. [44]GAO-05-478 . Washington,
    D.C.: June 10, 2005.

    Department of Justice's Activities to Address Past Election-Related Voting
    Irregularities. [45]GAO-04-1041R . Washington, D.C.: September 14, 2004.

    Elections: Electronic Voting Offers Opportunities and Presents Challenges.
    [46]GAO-04-975T . Washington, D.C.: July 20, 2004.

    Elections: Voting Assistance to Military and Overseas Citizens Should Be
    Improved. [47]GAO-01-1026 . Washington, D.C.: September 28, 2001.

    Elections: The Scope of Congressional Authority in Election
    Administration. [48]GAO-01-470 . Washington, D.C.: March 13, 2001.

    (350900)

    GAO's Mission

    The Government Accountability Office, the audit, evaluation and
    investigative arm of Congress, exists to support Congress in meeting its
    constitutional responsibilities and to help improve the performance and
    accountability of the federal government for the American people. GAO
    examines the use of public funds; evaluates federal programs and policies;
    and provides analyses, recommendations, and other assistance to help
    Congress make informed oversight, policy, and funding decisions. GAO's
    commitment to good government is reflected in its core values of
    accountability, integrity, and reliability.

    Obtaining Copies of GAO Reports and Testimony

    The fastest and easiest way to obtain copies of GAO documents at no cost
    is through GAO's Web site ( www.gao.gov ). Each weekday, GAO posts
    newly released reports, testimony, and correspondence on its Web site. To
    have GAO e-mail you a list of newly posted products every afternoon, go to
    www.gao.gov and select "Subscribe to Updates."

    Order by Mail or Phone

    The first copy of each printed report is free. Additional copies are $2
    each. A check or money order should be made out to the Superintendent of
    Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more
    copies mailed to a single address are discounted 25 percent. Orders should
    be sent to:

    U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
    D.C. 20548

    To order by Phone: Voice: (202) 512-6000
    TDD: (202) 512-2537
    Fax: (202) 512-6061

    To Report Fraud, Waste, and Abuse in Federal Programs

    Contact:

    Web site: www.gao.gov/fraudnet/fraudnet.htm
    E-mail: fraudnet@gao.gov
    Automated answering system: (800) 424-5454 or (202) 512-7470

    Congressional Relations

    Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S.
    Government Accountability Office, 441 G Street NW, Room 7125 Washington,
    D.C. 20548

    Public Affairs

    Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800
    U.S. Government Accountability Office, 441 G Street NW, Room 7149
    Washington, D.C. 20548

    www.gao.gov/cgi-bin/getrpt?GAO-07-774 .

    To view the full product, including the scope
    and methodology, click on the link above.

    For more information, contact Derek Stewart at (202) 512-5559 or
    stewartd@gao.gov.

    Highlights of [56]GAO-07-774 , a report to congressional committees

    June 2007

    ELECTIONS

    Action Plans Needed to Fully Address Challenges in Electronic Absentee
    Voting Initiatives for Military and Overseas Citizens

    The Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) protects
    the rights of military personnel, their dependents, and overseas citizens
    to vote by absentee ballot. The Department of Defense (DOD) and others
    have reported that absentee voting, which relies primarily on mail, can be
    slow and may, in certain circumstances, serve to disenfranchise these
    voters. In 2004, Congress required DOD to develop an Internet-based
    absentee voting demonstration project and required the Election Assistance
    Commission--which reviews election procedures--to develop guidelines for
    DOD's project. In 2006, Congress required DOD to report, by May 15, 2007,
    on plans for expanding its use of electronic voting technologies and
    required GAO to assess efforts by (1) DOD to facilitate electronic
    absentee voting and (2) the Commission to develop Internet voting
    guidelines and DOD to develop an Internet-based demonstration project. GAO
    also assessed DOD's efforts to develop plans to expand its use of
    electronic voting technologies. GAO interviewed officials and reviewed and
    analyzed documents related to these efforts.

    [57]What GAO Recommends

    GAO made recommendations to DOD regarding security, guidance, and plans
    for electronic voting initiatives and to the Commission on plans to
    develop the guidelines. DOD and the Commission agreed with these
    recommendations.

    Since 2000, DOD has developed several initiatives to facilitate absentee
    voting by electronic means such as fax or e-mail; however, some of these
    initiatives exhibited weaknesses or had low participation rates that might
    hinder their effectiveness. For example, the 2003 Electronic Transmission
    Service's fax to e-mail conversion feature allows UOCAVA voters who do not
    have access to a fax machine to request ballots by e-mail and then
    converts the e-mails to faxes to send to local election officials. DOD
    officials told us, however, they have not performed, among other things,
    certification tests and thus are not in compliance with information
    security requirements. The 2004 Interim Voting Assistance System
    (IVAS)--which, DOD reported, enabled UOCAVA voters to request and receive
    ballots securely--cost $576,000, and 17 citizens received ballots through
    it. The 2006 Integrated Voting Alternative Site (also called IVAS)--which
    enabled voters to request ballots using one tool, by mail, fax, or
    unsecured e-mail--raised concerns, from Congress and others, that using
    unsecured e-mail could expose voters to identity theft if they transmit
    personal data. While this IVAS displayed a warning that voters had to read
    to proceed, it did not advise them to delete personal voting information
    from the computers they used. DOD spent $1.1 million, and at least eight
    voted ballots were linked to this 2006 IVAS. Both the 2004 and 2006 IVAS
    were each implemented just 2 months before an election. DOD also has a Web
    site with links to guidance on electronic transmission options, but some
    of this guidance was inconsistent and could be misleading. DOD officials
    acknowledged the discrepancies and addressed them during GAO's review.

    The Election Assistance Commission has not developed the Internet absentee
    voting guidelines for DOD's use, and thus DOD has not proceeded with its
    Internet-based absentee voting demonstration project. Commission officials
    told GAO that they had not developed the guidelines because they had been
    devoting constrained resources to other priorities, including challenges
    associated with electronic voting machines. Furthermore, they have not
    established--in conjunction with major stakeholders like DOD--tasks,
    milestones, and time frames for completing the guidelines. The absence of
    such guidelines has hindered DOD's development of its Internet-based
    demonstration project. To assist the Commission, however, DOD has shared
    information on the challenges it faced in implementing prior Internet
    projects--including security threats.

    GAO observed that DOD was developing, but had not yet completed, plans for
    expanding the future use of electronic voting technologies. Because
    electronic voting in federal elections involves numerous federal, state,
    and local-level stakeholders; emerging technology; and time to establish
    the initiatives, developing results-oriented plans that identify goals,
    time frames, and tasks--including addressing security issues--is key.
    Without such plans, DOD is not in a position to address congressional
    expectations to establish secure and private electronic and Internet-based
    voting initiatives.

    References

    Visible links
      26. http://www.gao.gov/cgi-bin/getrpt?GAO-06-521
      27. http://www.gao.gov/cgi-bin/getrpt?GAO-01-1026
      28. http://www.gao.gov/cgi-bin/getrpt?GAO-02-3
      30. http://www.gao.gov/cgi-bin/getrpt?GAO/OP-4.1.4 and
          http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-98-21
      31. http://www.gao.gov/cgi-bin/getrpt?GAO-06-84
      32. http://www.gao.gov/cgi-bin/getrpt?GAO-01-1026
      33. http://www.gao.gov/cgi-bin/getrpt?GAO-02-3
      34. http://www.gao.gov/cgi-bin/getrpt?GAO/GGD-96-118
      35. http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-98-68
      38. http://www.gao.gov/cgi-bin/getrpt?GAO-07-576T
      39. http://www.gao.gov/cgi-bin/getrpt?GAO-06-1134T
      40. http://www.gao.gov/cgi-bin/getrpt?GAO-06-450
      41. http://www.gao.gov/cgi-bin/getrpt?GAO-06-247
      42. http://www.gao.gov/cgi-bin/getrpt?GAO-05-997
      43. http://www.gao.gov/cgi-bin/getrpt?GAO-05-956
      44. http://www.gao.gov/cgi-bin/getrpt?GAO-05-478
      45. http://www.gao.gov/cgi-bin/getrpt?GAO-04-1041R
      46. http://www.gao.gov/cgi-bin/getrpt?GAO-04-975T
      47. http://www.gao.gov/cgi-bin/getrpt?GAO-01-1026
      48. http://www.gao.gov/cgi-bin/getrpt?GAO-01-470
      56. http://www.gao.gov/cgi-bin/getrpt?GAO-07-774
    *** End of document. ***