brennan center for justice

Provide Timely & Organized Access to InformationThe database would include all of the reports uploaded to it in an easily searchable format essentially inreal time. It would help to eliminate the thousands of state and county government silos by centralizingall the data in one place. Further, placing the database on the Internet via a single home page wouldsignificantly increase the accessibility of the information to all.Assist Election Officials in Evaluating the Comparative Performance of Voting SystemsBy allowing for searches by the make and model of a voting machine or other voting system componentamong other datasets, the database would provide election officials with a helpful resource to determinewhich equipment has been the most reliable. This information would be particularly useful for electionofficials considering the purchase of new voting systems.Provide Election Officials and Others with the Opportunity to Identify Machine Issues withoutFear of RetributionA provision that prohibits the government from disclosing the contact information of any election officialor other person who submits a report to the database to persons other than election officials without thewritten consent of that person protects the confidentiality of these individuals; this protection reducesthe risk that a voting system vendor attempts to harass or seek retribution against them for posting anegative report to the database. For similar reasons, there should be monetary penalties and perhaps thecreation of a private right of action against vendors that retaliate and/or harass individuals or localities,including especially whistleblowers, who report problems.2. Vendor Reporting RequirementsA. Provision DetailsNew legislation or regulations should require voting system vendors to provide “early warning” data tothe appropriate government agency regarding voting system failures or vulnerabilities. This would gowell beyond what manufacturers of the few EAC certified systems must currently report to the EAC (seesupra pp. 8 - 9) if they wish to maintain that EAC certification. We propose that the government requireall vendors to provide written notification via certified mail (in addition to uploading the information tothe database) when they determine that a voting system failure or vulnerability may exist, including when• they receive a complaint from a customer (an election official);• they receive a warranty claim and/or take some action to satisfy a warranty;• they conduct an investigation of a reported problem; and• a customer or other individual sues them.The legislation or regulations should set specific requirements for the notification, including: (1) thelocation of the failure or vulnerability; (2) a description of the failure or vulnerability; (3) the vendorof the voting machine; (4) the jurisdictions where the machine is used; (5) an evaluation of the risk toelection outcomes related to the failure or vulnerability; (6) the vendor’s intended remedy for it; (7)versions of hardware, software, and firmware affected; and (8) any suggested workarounds and fixes, orinstructions for how to retrieve this information when it becomes available. It is critical that the EAC32 | Brennan Center for Justice