OAR 165-007-0350
Oregon Voting System Certification
(1)
All voting systems submitted for certification pursuant to ORS 246.550 (Examination and approval of equipment by Secretary of State) must be certified by the Elections Assistance Commission (EAC) or be examined by a federally accredited voting systems testing laboratory (VSTL).(2)
A person or company applying for certification of a voting system in Oregon must submit a complete Oregon Voting System Certification Application to the Secretary of State.(3)
A complete Oregon Voting System Certification Application includes:(a)
Form SEL 675 which initiates the certification process;(b)
VSTL Test Report documenting, at a minimum that the voting system meets or exceeds the Voluntary Voting System Guidelines Version 1.0 promulgated by the U.S. Election Assistance Commission in the following areas:(A)
Technical Data Package (TDP) Review. The TDP provides information that defines the voting system design, method of operation and related resources. It provides a system overview and documents the system’s functionality, including, but not limited to, the version number of any proprietary software, firmware and hardware, if applicable, all commercial off-the-shelf software, firmware and hardware, and the system configuration as proposed for Oregon certification;(B)
Source Code Review. A voting system’s source code is its operating instructions in the original programming language, which must be compiled or assembled into an executable computer program;(C)
System Integration. System integration tests focus on the functionality of integrated hardware and software components, internal and external system interfaces, usability and accessibility and security. Election management functions, ballot-counting logic and system capacity are also tested;(D)
Physical Configuration Audit (PCA). The PCA compares the voting system components submitted against vendor’s technical documentation and establishes a configuration baseline of the software and hardware. The audit also includes witnessing the build of the executable system to verify that it matches the build in the documentation; and(E)
Functional Configuration Audit (FCA). The FCA is an exhaustive verification of every system function and combination of functions cited in the vendor’s documentation and is used to verify the accuracy and completeness of the Technical Data Package. This portion of the testing process will also verify the accuracy of the counting logic for the system.(c)
Oregon Test Report, documenting at a minimum that the voting system adheres to the Oregon Voting System Certification Standards contained in Appendix 1, which is incorporated into this rule by reference and also:(A)
Confirms that the voting system presented is the same as the one certified by the Elections Assistance Commission (EAC) or as the one documented in the VSTL test report submitted under (3)(b) of this rule;(B)
Establishes a baseline for future evaluations or tests of the voting system, such as state review after modifications have been made; and(C)
Define acceptance tests, if any.(4)
The cost of the examination by the VSTL and any additional testing necessary to produce the Oregon Test Report shall be paid by the person or company presenting the voting system for certification.(5)
Certification of the voting system by the Secretary of State may only occur once a complete Oregon Voting System Certification Application has been received and the contents reviewed and assessed. The Secretary of State may require the submission of additional information to complete the review and assessment of the voting system.(6)
Changes or modifications to a certified voting system must be reported in writing to the Secretary of State. Any changes or modifications will be reviewed by the Secretary of State and may require additional examination, testing or recertification.(7)
This rule applies to applications for certification submitted on or after the effective date of this rule.
Source:
Rule 165-007-0350 — Oregon Voting System Certification, https://secure.sos.state.or.us/oard/view.action?ruleNumber=165-007-0350.